Pull s390 updates from Vasily Gorbik:

 - Fix PCI MMIO write syscall falsely reporting success for mappings not
   valid for MMIO when MIO is unavailable by returning -EFAULT

 - Fix CPRB parameter buffer overflows in zcrypt CCA AES cipher and ECC
   private key conversion by rejecting oversized key tokens

 - Fix buffer overreads and length underflow in pkey and zcrypt CCA
   token validation by checking length fields against actual buffer
   sizes

 - Fix out of bounds permission bitmap access in zcrypt EP11 admin CPRB
   filtering on custom device nodes by using AP_DOMAINS as the limit

 - Fix speculative permission bitmap reads in zcrypt CCA and EP11 admin
   CPRB handling by sanitizing user controlled domain indexes

 - Fix sensitive key material left in zcrypt CCA clear key import
   buffers by scrubbing CPRB and temporary buffers after use

* tag 's390-7.2-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
  s390/zcrypt: Close speculative mem read possibility
  s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
  s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
  s390/zcrypt: Validate length for CCA ECC private key requests
  s390/zcrypt: Validate length for CCA AES cipher key requests
  s390/pci: Fix s390_pci_mmio_write syscall error return without MIO

Pull SCSI fixes from James Bottomley"
 "No core changes. The largest driver fix is the reversion of threaded
  interrupt handlers in UFS and the next is the resume deadlock fix in
  hisi_sas which extends into libsas"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
  scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
  scsi: target: Clear cmd_cnt when initial counter enrollment fails
  scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
  scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"
  scsi: ufs: core: Cancel RTC work in active-active suspend
  scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
  scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
  scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
  scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
  scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
  scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

Pull dmaengine fixes from Vinod Koul:

 - switchtec fix for register programming

 - sun6i descriptor reclaim fix

 - Intel idxd fixes for double free in error and setup failure

 - Qualcomm bam dma command element fix

* tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
  dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
  dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
  dmaengine: idxd: fix double free of wq, engine, and group structs
  dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
  dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold

Pull phy fixes from Vinod Koul:

 - fixes for zynqmp clock and pm error handling and SERDES scrambler
   register handling

 - Rockchip SSC spread fix

 - Qualcomm musb return call fix

* tag 'phy-fixes-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
  phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
  phy: zynqmp: use read-modify-write for SERDES scrambler bypass
  phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
  phy: zynqmp: fix runtime PM leak on probe allocation failure
  phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
  phy: rockchip: naneng-combphy: Always configure SSC spread direction
  phy: qcom: m31-eusb2: Fix return value of init call

Pull i2c fixes from Andi Shyti:
 "A set of fixes across several host controller drivers. The largest
  part addresses three issues in the i.MX driver, while the remaining
  changes fix probe ordering, power management, timeout recovery and
  error handling.

  amd-mp2:
   - unregister callback if adapter registration fails

  designware:
   - defer probe until child GPIO controllers are bound

  imx:
   - mark adapter suspended while hardware is powered down
   - fix stale slave pointer and shared IRQ registration race
   - stop slave timer before clearing slave pointer

  iproc:
   - reset controller if START_BUSY remains set after timeout

  jz4780:
   - cache clock rate to avoid clk_get_rate() deadlock

  qcom-cci:
   - rely on runtime PM helpers for system sleep

  spacemit:
   - request interrupt after clock initialization"

* tag 'i2c-fixes-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
  i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
  i2c: imx: Cancel hrtimer before clearing slave pointer
  i2c: imx: Fix slave registration race and error handling
  i2c: iproc: reset bus after timeout if START_BUSY is stuck
  i2c: imx: mark I2C adapter when hardware is powered down
  i2c: designware: defer probe if child GpioInt controllers are not bound
  i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
  i2c: amd-mp2: Unregister callback on adapter add failure
  i2c: spacemit: request IRQ after controller initialization

Pull ata fixes from Damien Le Moal:

 - Fix PCI resource initialization in the sata_mv driver to keep legacy
   Marvell boards functional (Rosen)

 - Fix ahci_ceva driver initialization error path (Radhey)

 - Fix libata header file to remove a kernel doc compilation warning
   (Randy)

 - Increase the timeout for the STANDBY IMMEDIATE command to avoid
   suspend failures with drives that are slow to respond to this command
   (Matt)

 - Fixes for the handling of timed out commands in the presence of
   deferred non-NCQ commands, to avoid excessive delays in executing the
   error handler (me)

 - Disable link power management for a couple of WD drives that have
   been identified as not functioning properly when power management is
   used (Niklas)

 - Fix the device iteration loop when checking for link power management
   support to correctly handle port multiplier setups (Niklas)

* tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: libata-sata: fix ata_scsi_lpm_supported() iteration
  ata: libata-core: Disable LPM on WD Green 2.5 480GB
  ata: libata-core: Disable LPM on some WD drives
  scsi: libsas: terminate deferred commands on time out
  ata: libata-scsi: schedule deferred atapi command
  ata: libata-scsi: terminate deferred commands on time out
  ata: libata-eh: Increase STANDBY IMMEDIATE timeout
  ata: libata: avoid kernel-doc warnings
  ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
  ata: sata_mv: accept 1 or 2 resources in platform probe

Pull block fixes from Jens Axboe:

 - A set of fixes for s390/dasd, via Stefan

 - Fix for a missing stop of the timeout timer, if a disk has never been
   added

 - Clear kernel owned fields on ublk setup by default

* tag 'block-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  s390/dasd: Fix undersized format-check buffer
  s390/dasd: Fix potential NULL pointer dereference
  s390/dasd: Fix path verification interrupted by concurrent dasd_sleep_on_immediatly
  block: stop the timeout timer when releasing a never added disk
  ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

Pull drm fixes from Dave Airlie:
 "Weekly pulls request. As expected there is more AMD this week since
  Alex was off last week, vmwgfx looks to have been hit with the AI
  stick a bit and mediatek as well. Otherwise some minor fixes across
  the board, the new normal definitely seems to be a thing.

  dp:
   - Restrict some DP bandwidth calculations to HDMI DFP

  bridge:
   - Fix small leak in bridge/display-connector

  mediatek:
   - Check CRTC state before freeing
   - mtk_hdmi: Fix DDC adapter double put in v2
   - mtk_hdmi_common: take i2c adapter module reference
   - mtk_dsi: Enable HS clock only at pre-enable
   - ovl_adaptor: balance component registrations

  amdgpu:
   - VCN 5.3 fix
   - UserQ fixes
   - GEM close optimization
   - HDMI AV mute fix
   - UML build fixes
   - GFXOFF residency metrics fixes
   - SMU 15 fixes
   - debug_vm fix
   - PSP 15 fixes
   - NBIO 7.11.5 fix
   - pptable use after free fix
   - gpu metrics fetch fix
   - DC viewport fix
   - DML2.1 fix
   - i2c retimer spam fix
   - UMD profile pstate fix
   - Power metrics format cleanup
   - GTT size fix on APUs
   - DC context logging fix
   - PM sysfs fix for APUs
   - Follow on pageflip timeout fix

  amdkfd:
   - Various bounds checking fixes
   - Mutex locking fix

  i915/xe:
   - Check no-DMA huge-pte cases before DMA segment test
   - sink FRL rate fix
   - 200ms fix for TMDS scrambler status

  vmwgfx:
   - Improve various size checks and limit checks
   - Fix oops when submitting  invalid execbuf ioctl
   - Correctly lock in vmfwgx fence signaling path
   - More validation of execbuf ioctl
   - Fix oops in vmwgfx vkms init failure path
   - Overflow handling in shader path

  panthor:
   - Improve firmware validation

  imagination:
   - Improve imagination trace points.

  qaic:
   - Fix QAIC transaction length check"

* tag 'drm-fixes-2026-08-01' of https://gitlab.freedesktop.org/drm/kernel: (59 commits)
  drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status
  drm/amd/display: Exit idle optimizations before programming
  drm/amd/pm: hide pp_table sysfs on APUs
  accel/qaic: use sizeof(*trans_hdr) for transaction length check
  drm/panthor: validate firmware interface structure sizes
  drm/xe/pt: check no-DMA huge-pte cases before DMA segment test
  drm/imagination: Update the trace point pvr_job_submit_fw()
  drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder
  drm/mediatek: ovl_adaptor: balance component registrations
  drm/mediatek: mtk_dsi: Enable HS clock only at pre-enable
  drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
  drm/amd/display: use proper context for logging
  drm/amdgpu: cap GTT size to physical RAM on APUs
  drm/amd/pm: use milliwatts for GPU power sensors
  drm/amdgpu: restore UMD profile pstate after runtime resume
  drm/amd/display: Silence link_dpms I2C retimer failures
  drm/amdkfd: hold event_mutex while checkpointing CRIU events
  drm/amd/display: check if dml21_add_phantom_plane() is successful
  drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
  drm/amd/display: Add AV mute wait frames to dce110_set_avmute
  ...

Pull devicetree fixes from Rob Herring:

 - Fix NULL bus dereference in of_pci_range_parser_one()

 - Prevent out-of-bounds access when too many dynamic reserved memory
   regions are defined

* tag 'devicetree-fixes-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
  of/address: Fix NULL bus dereference in of_pci_range_parser_one()
  of: reserved_mem: prevent OOB when too many dynamic regions are defined

Pull hyper-v fixes from Wei Liu:

 - Multiple fixes for the MSHV driver (Stanislav Kinsburskii, Wei Liu,
   Yi Xie, Yousef Alhouseen)

 - Multiple fixes for the VMBus driver (Hardik Garg, Michael Kelley,
   Sebastian Andrzej Siewior)

* tag 'hyperv-fixes-signed-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
  mshv_vtl: bounds-check cpu index in vtl mmap fault handler
  mshv: Publish VP to pt_vp_array before installing the file descriptor
  Drivers: hv: vmbus: add VTL2 redirect connection ID
  mshv: Order pt_vp_array publish against irqfd assertion path
  mshv: Fix missing error code on VP allocation failure
  mshv: Fix level-triggered check on uninitialized data
  mshv: Fix race in mshv_irqfd_deassign
  mshv: Use kfree_rcu in mshv_portid_free
  mshv: Fix sleeping under spinlock in mshv_portid_alloc
  mshv: Fix duplicate GSI detection for GSI 0
  Drivers: hv: vmbus: Remove vmbus_irq_initialized
  Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
  mshv_vtl: fix fd leak in mshv_ioctl_create_vtl()
  mshv_vtl: clear hypercall output before copyout
  Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices
  mshv: fix hv_input_get_system_property struct