Pull spi fixes from Mark Brown:
 "Just a couple of small bits for the SpacemiT driver - one small fix,
  and a new compatible in the DT binding"

* tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: dt-bindings: spacemit: add K3 SPI compatible
  spi: spacemit: Correct TX FIFO slot calculation

Pull networking fixes from Jakub Kicinski:
 "Lots of fixes, double the count even for the 'new normal'. Largely due
  to my time off followed by a networking conference which distracted
  most maintainers (less so the AI generators).

  Including fixes from Bluetooth and WiFi.

  Current release - regressions:

   - wifi: mt76: fix MAC address for non OF pcie cards

  Current release - new code bugs:

   - mptcp: fix BUILD_BUG_ON on legacy ARM config

   - wifi: cfg80211: guard optional PMSR nominal time

  Previous releases - regressions:

   - qrtr: ns: raise node count limit to 512, we arbitrarily picked
     256 as a limit, turns out it was too low for real world deployments

   - vhost-net: fix TX stall when vhost owns virtio-net header

   - eth: amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN

   - wifi: ath12k: fix low MLO RX throughput on WCN7850

  Previous releases - always broken:

   - number of random AI fixes for SCTP, RDS and TIPC protocols

   - more AI-looking fixes for WiFi drivers

   - number of fixes for missing pointer reloading after skb pull

   - reject BPF redirect use from qdisc qevent block

   - tcp: initialize standalone TCP-AO response padding

   - vsock/virtio: collapse receive queue under memory pressure to avoid
     client OOMing the host with tiny messages

   - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup,
     make sure the ICMP response routing follows the routing policy

   - gro: fix double aggregation of flush-marked skbs

   - ovpn: fix various refcount bugs

   - tls: device: push pending open record on splice EOF

   - eth: mlx5:
      - use sender devcom for MPV master-up
      - fix MCIA register buffer overflow on 32 dword reads"

* tag 'net-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (234 commits)
  drop_monitor: perform u64_stats updates under IRQ-disabled section
  drop_monitor: fix size calculations for 64-bit attributes
  net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
  mptcp: fix BUILD_BUG_ON on legacy ARM config
  selftests: mptcp: userspace_pm: fix undefined variable port
  mptcp: fix stale skb->sk reference on subflow close
  mptcp: pm: userspace: fix use-after-free in get_local_id
  mptcp: decrement subflows counter on failed passive join
  mac802154: hold an interface reference across the scan worker
  sctp: don't free the ASCONF's own transport in DEL-IP processing
  phonet: check register_netdevice_notifier() error in phonet_device_init()
  phonet: pep: fix use-after-free in pep_get_sb()
  bnge/bng_re: fix ring ID widths
  tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
  net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
  mctp: check register_netdevice_notifier() error in mctp_device_init()
  ptp: netc: explicitly clear TMR_OFF during initialization
  rds: tcp: unregister sysctl before tearing down listen socket
  ipv6: Change allocation flags to match rcu_read_lock section requirements
  net: slip: serialize receive against buffer reallocation
  ...

Pull watchdog fixes from Guenter Roeck:

 - airoha: Prevent division by zero when clock frequency is zero

 - core: pretimeout: Fix UAF in watchdog_unregister_governor()

 - ni903x_wdt: Check ACPI_COMPANION() against NULL

 - s32g_wdt: remove incorrect options in watchdog_info struct

* tag 'watchdog-for-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  watchdog: airoha: Prevent division by zero when clock frequency is zero
  watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
  docs: watchdog: Fix brackets
  watchdog: ni903x_wdt: Check ACPI_COMPANION() against NULL
  watchdog: s32g_wdt: remove incorrect options in watchdog_info struct

The K3 SPI controller is compatible with K1, so allow K3 device trees to
use "spacemit,k1-spi" as fallback.

Signed-off-by: Cody Kang <cody.kang.hk@outlook.com>
Signed-off-by: Zhengyu He <hezhy472013@gmail.com>
Link: https://patch.msgid.link/20260717-k3-com260-spi-v7-2-rc2-b4-preview-20260716-v1-2-969a1b0f783f@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>

A number of IFLA_BRPORT_* attributes are documented in the rt-link spec
as having the "flag" type, i.e. a payload-less NLA_FLAG attribute whose
meaning is presence-only. This does not match the kernel, which emits
these attributes with nla_put_u8() and validates them as NLA_U8 in
br_port_policy[]. The values are not mere presence flags but carry a u8
payload (0/1).

Convert these bridge port attributes from "flag" to "u8" so the spec
reflects the actual wire format.

Fixes: 077b6022d24b ("doc/netlink/specs: Add sub-message type to rt_link family")
Reviewed-by: Petr Machata <petrm@nvidia.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Danielle Ratson <danieller@nvidia.com>
Link: https://patch.msgid.link/a57cdfcfc4a6dcb92106c25b4dde5059fde2bd44.1783236731.git.danieller@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Pull misc fixes from Andrew Morton:
 "12 hotfixes. 8 are cc:stable and the remainder address post-7.1 issues
  or aren't considered appropriate for backporting. 10 are for MM.

  All are singletons - please see the relevant changelogs for details"

* tag 'mm-hotfixes-stable-2026-07-20-11-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm/memory-failure: trace: change memory_failure_event to ras subsystem
  mm: page_reporting: allow driver to set batch capacity
  mm/kmemleak: fix checksum computation for per-cpu objects
  mm/damon/core: disallow overlapping input ranges for damon_set_regions()
  MAINTAINERS: add Usama as a THP reviewer
  fat: avoid stack overflow warning
  mm/damon/core: validate ranges in damon_set_regions()
  m68k: avoid -Wunused-but-set-parameter in clear_user_page()
  mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established
  mm/page_vma_mapped: fix device-private PMD handling
  MAINTAINERS: s/SeongJae/SJ/
  userfaultfd: prevent registration of special VMAs

Pull crypto library fixes from Eric Biggers:

 - Fix a build error in certain configurations

 - Clarify some parts of the documentation

 - Remove unused code that I forgot to remove in commit cf52058dcdd9
   ("lib/crypto: powerpc/md5: Drop powerpc optimized MD5 code")

* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
  crypto: aes - Fix conditions for selecting MAC dependencies
  lib/crypto: docs: Improve introduction sentence
  lib/crypto: docs: Fix some sentence fragments
  lib/crypto: md5: Remove support for md5_mod_init_arch()

Pull MMC fixes from Ulf Hansson:
 "MMC core:
   - Fix RPMB device unregister ordering
   - Fix __counted_by handling in mmc_test

  MMC host:
   - mtk-sd: Document missing clocks for MT8189
   - sdhci-esdhc-imx: Fix the support for system suspend/resume for SDIO
   - sdhci-of-dwcmshc: Fix error handling for clock prepare/enable
   - vub300:
       - Fix lockdep issue for the cmd_mutex
       - Fix use-after-free on probe failure

  MEMSTICK:
   - Reject a card that reports too many blocks"

* tag 'mmc-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: sdhci-esdhc-imx: fix resume error handling
  mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
  mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
  mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
  mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume
  mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
  mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
  mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
  mmc: block: fix RPMB device unregister ordering
  memstick: ms_block: reject a card that reports too many blocks
  dt-bindings: mmc: mtk-sd: Document extra clocks for MT8189
  mmc: vub300: defer reset until cmd_mutex is unlocked
  mmc: vub300: fix use-after-free on probe failure
  mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion
  mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method

Pull sound fixes from Takashi Iwai:
 "A collection of small fixes. All are device-specific fixes (including
  regression fixes) or quirks accumulated since the last update. Some
  highlights:

  USB-audio:
   - Fix per-channel volume imbalance regression for sticky mixers
   - Validate input packet length in caiaq driver
   - Quirks for iBasso DC-Elite, Musical Fidelity M6s DAC, and Redragon
     H510-PRO Wireless headset

  HD-audio:
   - Fix a long-standing bug of cached processing coefficient verbs
   - Make cs35l56 driver failing with missing firmware
   - Fix cirrus codec Kconfig dependency, update MAINTAINERS
   - Remove unneeded mic bias threshold override on Conexant
   - Realtek codec quirks for ASUS ROG Ally X (headphone & mic), Dell
     QCM1255, Legion Pro 7, HP/Victus laptops, Framework, and TongFang
     laptops

  ASoC:
   - Add Eliza audio support on Qualcomm sc8280xp/sm8250 SoCs
   - Fix SDCA linker error with ACP on AMD
   - A few fixes for AMD ACP PCI driver
   - Add TAS2783 support on AMD ACP 7.0 platforms
   - Reset RT712-SDCA codec to fix silent headphone issue
   - Soft reset S/PDIF datapath on Meson AIU FIFO
   - Jack report fix for cs42l43
   - TAS2562 shutdown GPIO clearing fix
   - Sidecar amps quirk for Lenovo laptop in SOF SDW driver

  Misc:
   - Drop redundant mod_devicetable.h includes from FireWire drivers
   - Fix memory leak and format mismatch in mixer kselftest"

* tag 'sound-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (36 commits)
  ALSA: usb-audio: Add delay quirk for iBasso DC-Elite
  ALSA: hda: conexant: Remove mic bias threshold override
  ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID 17aa:38a7
  ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series
  ALSA: hda: cs35l56: Fail if wmfw file is missing
  ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
  ALSA: hda: MAINTAINERS: Fix missing cirrus* file reference
  ALSA: hda/cirrus_scodec: Make Kconfig visible if KUNIT
  ALSA: hda/realtek: Add quirk for TongFang X6xx45xU
  ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255
  ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
  ASoC: cs42l43: Correct report for forced microphone jack
  ASoC: qcom: sc8280xp: Add support for Eliza
  ASoC: dt-bindings: qcom,sm8250: Add Eliza sound card
  ASoC: dt-bindings: qcom: Add Eliza LPASS macro codecs
  ALSA: hda/realtek: Add mic mute LED quirk for HP Laptop 15-fd0xxx
  ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50)
  ALSA: usb-audio: Add quirk for Redragon H510-PRO Wireless headset
  ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check
  ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
  ...

Pull cgroup fixes from Tejun Heo:

 - A cpuset that never set its memory nodes could divide by zero when a
   task's mempolicy rebinds on CPU hotplug. Rebind against the effective
   nodes, which are always populated

 - Documentation fixes for memory.stat, io.stat, and the misc and v1
   RDMA controllers

* tag 'cgroup-for-7.2-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  Docs/admin-guide/cgroup-v2: note blkcg_debug_stats gates io.latency stats
  Docs/admin-guide/cgroup-v1: document rdma.peak, rdma.events and rdma.events.local
  Docs/admin-guide/cgroup-v2: drop stale misc interface file count
  cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
  Docs/admin-guide/cgroup-v2: fix memory.stat doc details