Pull scheduler fix from Ingo Molnar:

 - Fix ARM64-specific rseq regressions (Mark Rutland)

* tag 'sched-urgent-2026-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  arm64/entry: Fix arm64-specific rseq brokenness

Pull IRQ fixes from Ingo Molnar:

 - Fix use-after-free in irq_work_single() on PREEMPT_RT (Jiayuan Chen)

 - Don't call add_interrupt_randomness() for NMIs in
   handle_percpu_devid_irq() (Mark Rutland)

 - Remove unused function in the ath79-cpu irqchip driver causing LKP
   CI build warnings (Rosen Penev)

 - Fix IRQ allocation/teardown leakage regressions in the GICv5 irqchip
   driver (Sascha Bischoff)

 - Fix an IRQ trigger type regression in the Meson S4 SoC irqchip driver
   (Xianwei Zhao)

 - Fix CPU offlining regression in the RiscV IMSIC irqchip driver
   (Yong-Xuan Wang)

* tag 'irq-urgent-2026-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
  irqchip/riscv-imsic: Clear interrupt move state during CPU offlining
  irqchip/meson-gpio: Use the correct register in meson_s4_gpio_irq_set_type()
  irqchip/ath79-cpu: Remove unused function
  genirq/chip: Don't call add_interrupt_randomness() for NMIs
  irqchip/gic-v5: Allocate ITS parent LPIs as a range
  irqchip/gic-v5: Support range allocation for LPIs
  irqchip/gic-v5: Move LPI allocation into the LPI domain

Pull drm fixes from Dave Airlie:
 "Weekly fixes pull, small and all over fixes, mostly xe and amdgpu,
  with some ttm and a core fix for the handle change pain.

  core:
   - fix for the fix for the handle change race

  ttm:
   - avoid infinite loop in swap out
   - avoid infinite loop in BO shrinking
   - convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC

  bridge:
   - imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup

  i915:
   - Skip __i915_request_skip() for already signaled requests
   - Fix VSC dynamic range signaling for RGB formats [dp]

  xe:
   - Madvise fix around purgeability tracking
   - Restore engine mask for specific blitter style
   - Couple UAF fixes
   - Drop unused ggtt_balloon field

  amdgpu:
   - Userq fixes
   - DCN 3.2 fix
   - RAS fix
   - GC 12 fix

  gma500:
   - oaktrail_lvds: fix i2c handling

  loongson:
   - use managed cleanup for connector polling

  panfrost:
   - handle results from reservation locking correctly

  qaic:
   - check for integer overflows in mmap logic

  rocket:
   - handle results from reservation locking correctly"

* tag 'drm-fixes-2026-05-16' of https://gitlab.freedesktop.org/drm/kernel: (26 commits)
  drm: Replace old pointer to new idr
  drm/loongson: Use managed KMS polling
  drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure
  drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC
  drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
  drm/gma500/oaktrail_lvds: fix hang on init failure
  drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
  drm/xe: Drop unused ggtt_balloon field
  accel/qaic: Add overflow check to remap_pfn_range during mmap
  drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
  drm/i915: skip __i915_request_skip() for already signaled requests
  drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup
  drm/amdgpu/gfx_v12_0: set gfx.rs64_enable from PFP header on GFX12
  drm/amd/ras: Fix CPER ring debugfs read overflow
  drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
  drm/amdgpu: fix userq hang detection and reset
  drm/amdgpu: remove almost all calls to amdgpu_userq_detect_and_reset_queues
  drm/amdgpu: rework amdgpu_userq_signal_ioctl v3
  drm/amdgpu: remove deadlocks from amdgpu_userq_pre_reset
  drm/xe/dma-buf: fix UAF with retry loop
  ...

Pull VFIO fixes from Alex Williamson:

 - Convert vfio-pci BAR resource requests and iomaps initialization
   from a lazy, on-demand model to an eager pre-allocation model to
   avoid races while preserving legacy error behavior.  Fix unchecked
   barmap access in dma-buf export path (Matt Evans)

 - Introduce an implicit unsigned cast in converting vfio-pci device
   offsets to region indexes, closing a potential out-of-bounds
   access through the vfio_pci_ioeventfd() interface (Matt Evans)

 - Fix a dma-buf kref underflow and stuck wait_for_completion() when
   closing a previously revoked dma-buf (Alex Williamson)

* tag 'vfio-v7.1-rc4' of https://github.com/awilliam/linux-vfio:
  vfio/pci: Check BAR resources before exporting a DMABUF
  vfio/pci: Set up BAR resources and maps in vfio_pci_core_enable()
  vfio/pci: Make VFIO_PCI_OFFSET_TO_INDEX() return unsigned
  vfio/pci: fix dma-buf kref underflow after revoke

Short summary of fixes pull:

bridge:
- imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup

gma500:
- oaktrail_lvds: fix i2c handling

loongson:
- use managed cleanup for connector polling

panfrost:
- handle results from reservation locking correctly

qaic:
- check for integer overflows in mmap logic

rocket:
- handle results from reservation locking correctly

ttm:
- avoid infinite loop in swap out
- avoid infinite loop in BO shrinking
- convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260515070816.GA88575@2a02-2455-9062-2500-7dec-552d-233d-9fe0.dyn6.pyur.net

Pull btrfs fixes from David Sterba:

 - fixup warning when allocating memory for readahead, __GFP_NOWARN was
   accidentally dropped when setting mapping constraints

 - in tracepoint of file sync, fix sleeping in atomic context when
   handling dentries

 - harden initial loading of block group on crafted/fuzzed images,
   iterate all chunk mapping entries unconditionally

 - fix freeing pages of submitted io after checking for errors

 - fix incorrect inode size after remount when using fallocate KEEP_SIZE
   mode (also requires disabled 'no-holes' feature)

* tag 'for-7.1-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: fix incorrect i_size after remount caused by KEEP_SIZE prealloc gap
  btrfs: only release the dirty pages io tree after successful writes
  btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
  btrfs: always pass __GFP_NOWARN from add_ra_bio_pages()
  btrfs: fix check_chunk_block_group_mappings() to iterate all chunk maps

Pull block fixes from Jens Axboe:

 - NVMe merge request via Keith:
     - Fix memory leak on a passthrough integrity mapping failure (Keith)
     - Hide secrets behind debug option (Hannes)
     - Fix pci use-after-free for host memory buffer (Chia-Lin Kao)
     - Fix tcp taregt use-after-free for data digest (Sagi)
     - Revert a mistaken quirk (Alan Cui)
     - Fix uevent and controller state race condition (Maurizio)
     - Fix apple submission queue re-initialization (Nick Chan)

 - Three fixes for blk-integrity, fixing an issue with the user data
   mapping and two problems with recomputing number of segments

 - Two fixes for the iov_iter bounce buffering

 - Fix for the handling of dead zoned write plugs

 - ublk max_sectors validation fix, with associated selftest addition

* tag 'block-7.1-20260515' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  nvme-apple: Reset q->sq_tail during queue init
  block: align down bounces bios
  block: pass a minsize argument to bio_iov_iter_bounce
  selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
  block: fix handling of dead zone write plugs
  block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
  block: recompute nr_integrity_segments in blk_insert_cloned_request
  block: don't overwrite bip_vcnt in bio_integrity_copy_user()
  nvme: fix race condition between connected uevent and STARTED_ONCE flag
  Revert "nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808"
  nvmet-tcp: Fix potential UAF when ddgst mismatch
  nvme-pci: fix use-after-free in nvme_free_host_mem()
  nvmet-auth: Do not print DH-HMAC-CHAP secrets
  nvme: fix bio leak on mapping failure
  nvme: make prp passthrough usage less scary
  ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation

Pull xen fixes from Juergen Gross:

 - one simple cleanup

 - a fix for a corner case when running as Xen PV dom0

 - a fix of a regression for Xen PV guests, introduced in 7.0

* tag 'for-linus-7.1b-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  x86/xen: Tolerate nested XEN_LAZY_MMU entering/leaving
  x86/xen: Fix xen_e820_swap_entry_with_ram()
  xen/arm: Replace __ASSEMBLY__ with __ASSEMBLER__ in interface.h

Pull x86 platform driver fixes from Ilpo Järvinen:

 - asus-nb-wmi:
    - Use existing keyboard quirk for ASUS Zenbook Duo UX8407AA

 - hp-wmi:
    - Add support for Victus 16-r0xxx (8BC2)

 - intel/vsec_tpmi:
    - Move debugfs register before creating devices
    - Prevent fault during unbind

 - lenovo-wmi-*:
    - Fix memory leak in lwmi_dev_evaluate_int()
    - Balance IDA id allocation and free
    - Balance component bind and unbind
    - Prevent sending uninitialized WMI arguments to the device
    - Decouple lenovo-wmi-gamezone and lenovo-wmi-other to simplify
      module dependency graph
    - Limit adding attributes to supported devices

 - samsung-galaxybook:
    - Handle kbd backlight, mic mute and camera block hotkeys

* tag 'platform-drivers-x86-v7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
  platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8407AA
  platform/x86: lenovo-wmi-other: Limit adding attributes to supported devices
  platform/x86: lenovo-wmi-other: Add Attribute ID helper functions
  platform/x86: lenovo-wmi-helpers: Move gamezone enums to wmi-helpers
  platform/x86: lenovo: Decouple lenovo-wmi-gamezone and lenovo-wmi-other
  platform/x86: lenovo-wmi-other: Fix tunable_attr_01 struct members
  platform/x86: lenovo-wmi-other: Zero initialize WMI arguments
  platform/x86: lenovo-wmi-other: Balance component bind and unbind
  platform/x86: lenovo-wmi-other: Balance IDA id allocation and free
  platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()
  platform/x86: hp-wmi: Add support for Victus 16-r0xxx (8BC2)
  platform/x86/intel/tpmi/plr: Prevent fault during unbind
  platform/x86: intel: Add notifiers support
  platform/x86: intel: Move debugfs register before creating devices
  platform/x86: samsung-galaxybook: Handle ACPI hotkey notifications
  platform/x86: samsung-galaxybook: Refactor camera lens cover input device

Pull crypto fixes from Herbert Xu:

 - Fix potential dead-lock in rhashtable when used by xattr

 - Avoid calling kvfree on atomic path in rhashtable

* tag 'v7.1-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  rhashtable: Add bucket_table_free_atomic() helper
  mm/slab: Add kvfree_atomic() helper
  rhashtable: drop ht->mutex in rhashtable_free_and_destroy()