Pull BPF fixes from Daniel Borkmann:

 - Fix BPF verifier to preserve full pointer state for commuted
   scalar += pointer arithmetic (Yiyang Chen, Eduard Zingerman)

 - Fix a use-after-free of request sockets in the BPF TCP iterator
   batching (Jose Fernandez)

 - Fix a use-after-free of sk_redir in the BPF sockmap send verdict
   path (Chengfeng Ye)

 - Fix a netns reference imbalance in the BPF conntrack kfuncs
   (Chengfeng Ye)

 - Fix bpf_get_fsverity_digest() dynptr assumptions and silent
   digest truncation (Eric Biggers)

 - Fix bpf_tcp_{gen,check}_syncookie to check sk_state before
   sk_protocol to make sure it is a full socket (Luxiao Xu)

 - Fix rqspinlock to reset the tail when preserving the queue
   on deadlock (Kumar Kartikeya Dwivedi)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  rqspinlock: Reset tail when preserving queue on deadlock
  bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
  fsverity: Fix silent truncation in bpf_get_fsverity_digest()
  fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
  bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
  bpf: Fix netns reference imbalance in conntrack kfuncs
  bpf, sockmap: Fix sk_redir use-after-free in send verdict
  selftests/bpf: Cover commuted pointer state propagation
  bpf: Propagate untrusted pointer state in commuted arithmetic
  bpf: Preserve pointer state for commuted arithmetic
  bpf: Simplify sanitize_err() signature

Pull networking fixes from Jakub Kicinski:
 "Including fixes from netfilter.

  Looks like our attempt to keep the PRs smaller have only prevented
  this one from getting even bigger. In the last 9 days there were
  405 postings explicitly tagged with [PATCH net], vs 687 with [PATCH
  net-next]. 37% of posted patches being fixes is pretty crazy, and
  that's likely undercounting because LLM "researchers" more often post
  fixes without knowing to tag the patches for specific trees. I don't
  have historic data.

  In any case, we keep adjusting the criteria. The next PR will be
  smaller.

  Current release - regressions:

   - net: defer netdev KOBJ_ADD uevent until the device is published,
     previously rtnl_lock would serialize the accesses vs publishing

   - net: explicitly cancel work to avoid races with ref tracker exit

   - qrtr: ns: raise lookup limit to 128

   - eth: hns3: fix speed configuration residue after driver reload

  Previous releases - regressions:

   - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss(), regressed
     flows with MSS and scaling_ratio variability

   - Revert "net: thunderbolt: Enable end-to-end flow control also in
     transmit", broke some platforms (no packets coming thru)

   - eth: stmmac: resume PHY before hardware setup when opening the
     interface

  Previous releases - always broken:

   - another pile of fixes for less common protocols (SCTP, TLS, SMC
     etc.)

   - close a couple of AF_PACKET bugs and ways it can build skbs
     problematic for the rest of the stack

   - bridge: mrp: fix uninitialised bytes on the wire

   - net: devmem: prevent net-iov / page mixing, avoid crashes

   - eth: atlantic: free RX pages of consumed but not refilled buffers"

* tag 'net-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (116 commits)
  igc: fix netdev not re-attached after resume if interface is down
  tls: don't abort the connection on signal-interrupted sends
  net: avoid theoretical races with ref drain
  net: Defer netdev KOBJ_ADD uevent until the device is published
  MAINTAINERS: dpll: zl3073x: replace Prathosh Satish with Min Li
  sctp: clear control chunk transport if it is being removed
  net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
  s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
  packet: use consistent hard_header_len in TX_RING send path
  packet: use consistent hard_header_len in non-ring send paths
  net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
  bnge: Fix resource leak in bnge_init_nic() error path
  ptp: ocp: Fix board ID over-read
  tls: rx: restore msg_iter before TLS 1.3 optimistic retry
  selftests: tls: add a test for splicing onto a full plaintext record
  tls: don't leave a full plaintext sk_msg ring unpushed
  xdp: reject clones that overrun skb_shared_info tailroom
  mptcp: reclaim forward-allocated memory on RX path errors
  mptcp: fastopen: only mark MPTFO subflows with SYN data
  mptcp: pm: fix memory leak from alloc-during-teardown race
  ...

tls_decrypt_sg() advances msg->msg_iter when it maps user pages for
the optimistic TLS 1.3 zero-copy path. If the decrypted record turns
out not to be unpadded application data, tls_decrypt_sw() retries into
a kernel skb, but leaves the iterator advanced.

The subsequent copy from the skb then writes decrypted bytes again at
a later point in the caller iovecs while recvmsg() reports only the
post-retry length. A TLS peer can trigger this after the receiver
enables TLS_RX_EXPECT_NO_PAD.

Revert the iterator by the number of bytes consumed by the optimistic
mapping before retrying without zero-copy.

Add a selftest which sends a TLS 1.3 control record with
TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not
overwrite later iovecs beyond the returned length.

Fixes: ce61327ce989 ("tls: rx: support optimistic decrypt to user buffer with TLS 1.3")
Cc: stable@vger.kernel.org
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Link: https://patch.msgid.link/20260804125528.2139928-1-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Splicing onto a plaintext sk_msg ring that is already full used to wrap the
ring and make the kernel oops in the scatterwalk once the record was
pushed.

Only the copy path leaves the ring full without pushing it, so splice until
the ring is one fragment short, add the last fragment with a one-byte
MSG_MORE send, and splice once more before pushing the record.

CONFIG_MAX_SKB_FRAGS is 17..45, so that last fragment follows between 16
and 44 splices; sweep that range to trigger the bug on any build.

Signed-off-by: chanyoung <ppoo1220@gmail.com>
Link: https://patch.msgid.link/20260804052837.49015-3-ppoo1220@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

check_transfer() compares the input and output files byte-by-byte using
`cmp -l "$in" "$out" | while read ...`. Because the while-loop body runs
in a subshell (the script sets neither lastpipe nor pipefail), the
fail_test call inside it -- which sets the global ret/last_test_failed --
and the `return 1` both act on the subshell, not on check_transfer().

check_transfer() thus always falls through to `return 0`, and any data
corruption affecting only the payload (leaving the subflow/PM counters
untouched) is silently reported as PASS.

Fixes: 8117dac3e7c3 ("selftests: mptcp: add invert check in check_transfer")
Cc: stable@vger.kernel.org
Signed-off-by: Gang Yan <yangang@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260803-net-mptcp-misc-fixes-7-2-rc6-v2-5-b8f496d71664@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Add tdc coverage for the qdisc hierarchy depth limit.

The tests verify that the deepest allowed hierarchy can still be created
and that adding another child qdisc below it is rejected.

Signed-off-by: Zijie Huang <milkory@outlook.com>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Ren Wei <enjou1224z@gmail.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/5cc2d26a7c8e553759cdd29a3116f843fabc25ba.1785434373.git.milkory@outlook.com
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

The add/remove eprobe test installs an eprobe for the openat syscall and
runs ls. It checks the filenames that were opened by ls against a
whitelist and a blacklist.

Commit 206b25c09080 ("tracing: eprobe: read the complete FILTER_PTR_STRING
pointer") fixed access to some string fields in eprobes. This triggers
test failures as the blacklist does not allow relative paths for the
openat parameters.

What makes this test unstable is the fact that the openat calls vary a
lot between different systems.

Refactor the test to make it more robust. "cd <directory>" will issue a
chdir syscall with the target directory as parameter. Set an eprobe on
the sys_enter_chdir event and filter for the exact directory name. Allow
(fault) as fallback.

Link: https://lore.kernel.org/all/20260804194705.760893-1-martin@kaiser.cx/

Fixes: 206b25c09080 ("tracing: eprobe: read the complete FILTER_PTR_STRING pointer")
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202607151010.b68428e1-lkp@intel.com
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Pull sched_ext fixes from Tejun Heo:

 - More lifecycle fixes for the new sub-scheduler support: a failed
   enable could tear down a never-linked sub-scheduler in a way that
   races the root scheduler's disable and leads to a use-after-free,
   tasks that were not on the ext class could still get the enable
   callback, and a policy-rejection path silently rewrote a running
   task's scheduling policy instead of aborting the scheduler.

 - Scheduler enable/disable could deadlock with cgroup removal and a
   concurrent cgroup weight write through kernfs. Fixed by reordering
   lock acquisition.

 - Sync wakeups could leave the waker CPU incorrectly marked idle in the
   built-in idle-CPU tracking.

 - A selftest fix for sleeping tasks whose CPU affinity changes before
   wakeup.

* tag 'sched_ext-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  selftests/sched_ext: Handle sleeping task affinity changes in numa test
  sched_ext: Mark waker CPU busy when selected in WAKE_SYNC case
  sched_ext: Don't enable non-ext tasks in the sub-sched task loops
  sched_ext: Skip sub-disable teardown for never-linked sub-schedulers
  sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
  sched_ext: Reject setting disallow from init_task outside the enable path

Add verifier coverage for the three cases affected by preserving the full
pointer state across scalar += pointer: stack frame number inheritance,
readonly-untrusted memory access, and dynptr data-slice invalidation.

Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Tested-by: Daniel Wade <danjwade95@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-4-8ee297e2346b@mails.tsinghua.edu.cn
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>

Pull misc fixes from Andrew Morton:
 "12 hotfixes.  6 are cc:stable.  9 are for MM.

  There's a two-patch series from Nico which fixes a couple of PMD level
  mTHP accounting bugs and a two-patch series from Chris Gellermann
  which addresses mishandling of getline() in selftests. All the
  remainder are singletons - please see the changelogs for details"

* tag 'mm-hotfixes-stable-2026-07-30-19-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  selftests/mm: fix potential wild pointer access of getline due to missing init
  selftests/clone3: fix wild pointer access of getline due to missing init
  mm/page_reporting: use system_freezable_wq to fix UAF during suspend
  mm: vmscan: abort proactive reclaim early when freezing for suspend
  MAINTAINERS: update Nico Pache's email address
  arm64, mailmap: update email address for Peter Collingbourne
  MAINTAINERS: update address for Burak Emir
  mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
  riscv/mm: use physical alignment for vmemmap_start_pfn
  mm/migrate: exclude hugetlb folios from MTHP_STAT_NR_ANON accounting
  mm: decrement MTHP_STAT_NR_ANON in free_zone_device_folio()
  mm: memcg: initialize *locked in memcg1_oom_prepare() stub