Pull drm fixes from Dave Airlie:
 "Fixes for rc2, the usual amdgpu/xe double header, I think xe had a
  couple of weeks combined due to some maintainer access issues,
  otherwise there's just a few misc fixes and documentation fixups.

  core and helpers:
   - calculate framebuffer geometry with format helpers
   - fix docs

  amdgpu:
   - GFX12 fix for CONFIG_DRM_DEBUG_MM configs
   - Fix DC analog support
   - Userq fixes
   - GART placement fix
   - Aldebaran SMU fixes
   - AMDGPU_INFO_READ_MMR_REG fix
   - UVD 3.1 fix
   - GC 6 TCC fix
   - Fix root reservation in amdgpu_vm_handle_fault()
   - RAS fix
   - Module reload fix for APUs
   - Fix build for CONFIG_DRM_FBDEV_EMULATION=n
   - IGT DWB regression fix
   - GC 11.5.4 fix
   - VCN user fence fixes
   - JPEG user fence fixes
   - SMU 13.0.6 fix
   - VCN 3/4 IB parser fixes
   - NV3x+ dGPU vblank fix
   - DCE6/8 fixes for LVDS/eDP panels without an EDID

  amdkfd:
   - Fix for when CONFIG_HSA_AMD is not set
   - SVM fixes

  xe:
   - uapi: Add missing pad and extensions check
   - uapi: Reject unsafe PAT indices for CPU cached memory
   - Drop registration of guc_submit_wedged_fini from xe_guc_submit_wedge
   - Xe3p tuning and workaround fixes
   - USE drm mm instead of drm SA for CCS read/write
   - Fix leaks and null derefs
   - Fix Wa_18022495364

  appletbdrm:
   - allocate protocol buffers with kvzalloc()

  dma-buf:
   - fix docs

  imagination:
   - avoid segfault in debugfs

  ofdrm:
   - put PCI device reference on errors

  udl:
   - increase USB timeout"

* tag 'drm-fixes-2026-05-02' of https://gitlab.freedesktop.org/drm/kernel: (77 commits)
  drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR
  drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
  drm/xe/xelp: Fix Wa_18022495364
  drm/xe/gsc: Fix BO leak on error in query_compatibility_version()
  drm/xe/eustall: Fix drm_dev_put called before stream disable in close
  drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
  drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
  drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure
  drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
  drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
  drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked
  drm/xe/vf: Use drm mm instead of drm sa for CCS read/write
  drm/xe: Add memory pool with shadow support
  drm/xe/debugfs: Correct printing of register whitelist ranges
  drm/xe: Mark ROW_CHICKEN5 as a masked register
  drm/xe/tuning: Use proper register offset for GAMSTLB_CTRL
  drm/xe/xe3p_lpg: Add missing indirect ring state feature flag
  drm/xe: Drop redundant rtp entries for Wa_14019988906 & Wa_14019877138
  drm/xe/vm: Add missing pad and extensions check
  drm/xe: Drop registration of guc_submit_wedged_fini from xe_guc_submit_wedge()
  ...

Pull block fixes from Jens Axboe:

 - MD pull request via Yu:
      - Fix a raid5 UAF on IO across the reshape position
      - Avoid failing RAID1/RAID10 devices for invalid IO errors
      - Fix RAID10 divide-by-zero when far_copies is zero
      - Restore bitmap grow through sysfs
      - Use mddev_is_dm() instead of open-coding gendisk checks
      - Use ATTRIBUTE_GROUPS() for md default sysfs attributes
      - Replace open-coded wait loops with wait_event helpers

 - NVMe pull request via Keith:
      - Target data transfer size configuation (Aurelien)
      - Enable P2P for RDMA (Shivaji Kant)
      - TCP target updates (Maurizio, Alistair, Chaitanya, Shivam Kumar)
      - TCP host updates (Alistair, Chaitanya)
      - Authentication updates (Alistair, Daniel, Chris Leech)
      - Multipath fixes (John Garry)
      - New quirks (Alan Cui, Tao Jiang)
      - Apple driver fix (Fedor Pchelkin)
      - PCI admin doorbell update fix (Keith)

 - Properly propagate CDROM read-only state to the block layer

* tag 'block-7.1-20260430' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (35 commits)
  md: use ATTRIBUTE_GROUPS() for md default sysfs attributes
  md: use mddev_is_dm() instead of open-coding gendisk checks
  md/raid1: replace wait loop with wait_event_idle() in raid1_write_request()
  md/md-bitmap: add a none backend for bitmap grow
  md/md-bitmap: split bitmap sysfs groups
  md: factor bitmap creation away from sysfs handling
  md: use mddev_lock_nointr() in mddev_suspend_and_lock_nointr()
  md: replace wait loop with wait_event() in md_handle_request()
  md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
  md/raid1,raid10: don't fail devices for invalid IO errors
  MAINTAINERS: Add Xiao Ni as md/raid reviewer
  md/raid5: Fix UAF on IO across the reshape position
  cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
  nvme-auth: Hash DH shared secret to create session key
  nvme-pci: fix missed admin queue sq doorbell write
  nvme-auth: Include SC_C in RVAL controller hash
  nvme-tcp: teardown circular locking fixes
  nvmet-tcp: Don't clear tls_key when freeing sq
  Revert "nvmet-tcp: Don't free SQ on authentication success"
  nvme: skip trace completion for host path errors
  ...

Pull io_uring fixes from Jens Axboe:

 - Remove dead struct io_buffer_list member

 - Fix for incrementally consumed buffers with recvmsg multishot, which
   requires a minimum value left in a buffer for any receive for the
   headers. If there's still a bit of buffer left but it's smaller than
   that value, then userspace will see a spurious -EFAULT returned in
   the CQE

 - Locking fix for the DEFER_TASKRUN retry list, which otherwise could
   race with fallback cancelations. If the task is exiting with
   task_work left in both the normal and retry list AND the exit cleanup
   races with the task running task work, then entries could either be
   doubly completed or lost

 - Cap NAPI busy poll timeout to something sane, to avoid syzbot running
   into excessive polling and triggering warnings around that

* tag 'io_uring-7.1-20260430' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/tw: serialize ctx->retry_llist with ->uring_lock
  io_uring/napi: cap busy_poll_to 10 msec
  io_uring/kbuf: support min length left for incremental buffers
  io_uring/kbuf: kill dead struct io_buffer_list 'nr_entries' member

Pull MM fixes from Andrew Morton:
 "20 hotfixes. All are for MM (and for MMish maintainers). 9 are
  cc:stable and the remainder are for post-7.0 issues or aren't deemed
  suitable for backporting.

  There are two DAMON series from SeongJae Park which address races
  which could lead to use-after-free errors, and avoid the possibility
  of presenting stale parameter values to users"

* tag 'mm-hotfixes-stable-2026-04-30-15-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm: memcontrol: fix rcu unbalance in get_non_dying_memcg_end()
  mm/userfaultfd: detect VMA type change after copy retry in mfill_copy_folio_retry()
  MAINTAINERS: remove stale kdump project URL
  mm/damon/stat: detect and use fresh enabled value
  mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
  mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
  selftests/mm: specify requirement for PROC_MEM_ALWAYS_FORCE=y
  mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock
  mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
  MAINTAINERS: update Li Wang's email address
  MAINTAINERS, mailmap: update email address for Qi Zheng
  MAINTAINERS: update Liam's email address
  mm/hugetlb_cma: round up per_node before logging it
  MAINTAINERS: fix regex pattern in CORE MM category
  mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()
  mm: start background writeback based on per-wb threshold for strictlimit BDIs
  kho: fix error handling in kho_add_subtree()
  liveupdate: fix return value on session allocation failure
  mailmap: update entry for Dan Carpenter
  vmalloc: fix buffer overflow in vrealloc_node_align()

amd-drm-fixes-7.1-2026-04-30:

amdgpu:
- GFX12 fix for CONFIG_DRM_DEBUG_MM configs
- Fix DC analog support
- Userq fixes
- GART placement fix
- Aldebaran SMU fixes
- AMDGPU_INFO_READ_MMR_REG fix
- UVD 3.1 fix
- GC 6 TCC fix
- Fix root reservation in amdgpu_vm_handle_fault()
- RAS fix
- Module reload fix for APUs
- Fix build for CONFIG_DRM_FBDEV_EMULATION=n
- IGT DWB regression fix
- GC 11.5.4 fix
- VCN user fence fixes
- JPEG user fence fixes
- SMU 13.0.6 fix
- VCN 3/4 IB parser fixes
- NV3x+ dGPU vblank fix
- DCE6/8 fixes for LVDS/eDP panels without an EDID

amdkfd:
- Fix for when CONFIG_HSA_AMD is not set
- SVM fixes

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20260430135619.3929877-1-alexander.deucher@amd.com

Pull mtd fixes from Miquel Raynal:
 "Besides an out-of-bound bug, this is about properly supporting Winbond
  octal SPI NAND chips which use a specific pattern for stuffing more
  address bits in some operations. This uses the spi-mem flag in SPI
  NAND that was added to the spi-mem layer just before the merge window
  through the spi tree"

* tag 'mtd/fixes-for-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
  mtd: spinand: winbond: Fix ODTR write VCR on W35NxxJW
  mtd: spinand: winbond: Set the packed page read flag to W35N02/04JW
  mtd: spinand: Add support for packed read data ODTR commands
  mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()

Pull ACPI support fixes from Rafael Wysocki:
 "These fix leftover issues in the ACPI Time and Alarm Device (TAD)
  driver on top of the recently merged updates of it and address
  assorted issues in the ACPI support code:

   - Fix removal code ordering in the ACPI TAD driver, refine timer
     value computations and checks in its RTC class device interface,
     make it use the __ATTRIBUTE_GROUPS() macro, and fix a comment in it
     (Rafael Wysocki)

   - Fix EINJV2 memory error injection in APEI (Tony Luck)

   - Add missing notifier_block structure forward declaration to
     acpi_bus.h (Bartosz Golaszewski)

   - Fix related_cpus inconsistency during CPU hotplug in the ACPI CPPC
     library (Jinjie Ruan)

   - Add a quirk to force native backlight on HP OMEN 16 (8A44) in the
     ACPI video bus driver (Shivam Kalra)"

* tag 'acpi-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: bus: add missing forward declaration to acpi_bus.h
  ACPI: video: force native backlight on HP OMEN 16 (8A44)
  ACPI: TAD: Fix up a comment in acpi_tad_probe()
  ACPI: TAD: RTC: Refine timer value computations and checks
  ACPI: TAD: Use devres for all driver cleanup
  ACPI: TAD: Use __ATTRIBUTE_GROUPS() macro
  ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
  ACPI: APEI: EINJ: Fix EINJV2 memory error injection
  ACPICA: Provide #defines for EINJV2 error types

Merge assorted ACPI support fixes for 7.1-rc2:

 - Fix EINJV2 memory error injection in APEI (Tony Luck)

 - Add missing notifier_block structure forward declaration to
   acpi_bus.h (Bartosz Golaszewski)

 - Fix related_cpus inconsistency during CPU hotplug in the ACPI CPPC
   library (Jinjie Ruan)

 - Add a quirk to force native backlight on HP OMEN 16 (8A44) in the
   ACPI video bus driver (Shivam Kalra)

* acpi-apei:
  ACPI: APEI: EINJ: Fix EINJV2 memory error injection
  ACPICA: Provide #defines for EINJV2 error types

* acpi-bus:
  ACPI: bus: add missing forward declaration to acpi_bus.h

* acpi-cppc:
  ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug

* acpi-video:
  ACPI: video: force native backlight on HP OMEN 16 (8A44)

Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter.

  Current release - regressions:

   - ipmr: free mr_table after RCU grace period.

  Previous releases - regressions:

   - core: add net_iov_init() and use it to initialize ->page_type

   - sched: taprio: fix NULL pointer dereference in class dump

   - netfilter: nf_tables:
      - use list_del_rcu for netlink hooks
      - fix strict mode inbound policy matching

   - tcp: make probe0 timer handle expired user timeout

   - vrf: fix a potential NPD when removing a port from a VRF

   - eth: ice:
      - fix NULL pointer dereference in ice_reset_all_vfs()
      - fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw

  Previous releases - always broken:

   - page_pool: fix memory-provider leak in error path

   - sched: sch_cake: annotate data-races in cake_dump_stats()

   - mptcp: fix scheduling with atomic in timestamp sockopt

   - psp: check for device unregister when creating assoc

   - tls: fix strparser anchor skb leak on offload RX setup failure

   - eth:
      - stmmac: prevent NULL deref when RX memory exhausted
      - airoha: do not read uninitialized fragment address
      - rtl8150: fix use-after-free in rtl8150_start_xmit()

  Misc:

   - add Ido Schimmel as IPv4/IPv6 maintainer

   - add David Heidelberg as NFC subsystem maintainer"

* tag 'net-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (79 commits)
  net/sched: cls_flower: revert unintended changes
  sfc: fix error code in efx_devlink_info_running_versions()
  net: tls: fix strparser anchor skb leak on offload RX setup failure
  ice: add dpll peer notification for paired SMA and U.FL pins
  ice: fix missing dpll notifications for SW pins
  dpll: export __dpll_pin_change_ntf() for use under dpll_lock
  ice: fix SMA and U.FL pin state changes affecting paired pin
  ice: fix missing SMA pin initialization in DPLL subsystem
  ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw
  ice: fix NULL pointer dereference in ice_reset_all_vfs()
  iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
  iavf: wait for PF confirmation before removing VLAN filters
  iavf: stop removing VLAN filters from PF on interface down
  iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
  page_pool: fix memory-provider leak in page_pool_create_percpu() error path
  bonding: 3ad: implement proper RCU rules for port->aggregator
  net: airoha: Do not return err in ndo_stop() callback
  hv_sock: fix ARM64 support
  MAINTAINERS: update the IPv4/IPv6 entry and add Ido Schimmel
  selftests: drv-net: clarify linters and frameworks in README
  ...

Export __dpll_pin_change_ntf() so that drivers can send pin change
notifications from within pin callbacks, which are already called
under dpll_lock. Using dpll_pin_change_ntf() in that context would
deadlock.

Add lockdep_assert_held() to catch misuse without the lock held.

Acked-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Signed-off-by: Petr Oros <poros@redhat.com>
Tested-by: Alexander Nowlin <alexander.nowlin@intel.com>
Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-9-cdcb48303fd8@intel.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>