Pull vfs fixes from Christian Brauner:

 - vfs: Preserve the ACL_DONT_CACHE state in forget_cached_acl().

   ACL_DONT_CACHE is meant to be a permanent opt-out from ACL caching
   which FUSE relies on for servers that don't negotiate FUSE_POSIX_ACL.
   The helper replaced it with ACL_NOT_CACHED, silently re-enabling the
   cache, and as fuse doesn't invalidate the cache for such servers a
   properly timed get_acl() returned stale ACLs. Comes with a fuse
   selftest reproducing this.

 - pidfs:

     - Preserve PIDFD_THREAD when a thread pidfd is reopened via
       open_by_handle_at(). PIDFD_THREAD shares the O_EXCL bit which
       do_dentry_open() strips after the flags have been validated, so
       the reopened pidfd silently became a process pidfd. Comes with a
       selftest.

     - Add a pidfs_dentry_open() helper so the regular pidfd allocation
       path and the file handle path share the code that forces O_RDWR
       and reapplies the pidfd flags that do_dentry_open() strips.

     - Handle FS_IOC32_GETVERSION in the compat ioctl path.

     - Make pidfs_ino_lock static.

 - iomap:

     - Fix the block range calculation in ifs_clear_range_dirty() so a
       partial clear doesn't drop the dirty state of blocks the range
       only partially covers.

     - Support invalidating partial folios so a partial truncate or hole
       punch with blocksize < foliosize doesn't leave stale dirty bits
       behind.

     - Only set did_zero when iomap_zero_iter() actually zeroed
       something.

     - Guard ifs_set_range_dirty() and ifs_set_range_uptodate() against
       zero-length ranges where the unsigned last-block calculation
       underflows and bitmap_set() writes far beyond the ifs->state
       allocation.

     - Don't merge ioends with different io_private values as the merge
       could leak or corrupt the private data of the individual ioends.

 - exec:

     - Raise bprm->have_execfd only once the binfmt_misc interpreter has
       actually been opened. The flag was set as soon as a matching 'O'
       or 'C' entry was found. If the interpreter open failed with
       ENOEXEC the exec fell through to the next binary format with
       have_execfd raised but no executable staged and begin_new_exec()
       NULL derefed past the point of no return.

     - Fix an unsigned loop counter wrap in transfer_args_to_stack() on
       nommu. An overlong argument or environment string pushes bprm->p
       below PAGE_SIZE, the stop index becomes zero, and the loop never
       terminates, wrapping its counter and copying garbage from in
       front of the page array into the new process stack.

     - Make binfmt_elf_fdpic only honour the first PT_INTERP like
       binfmt_elf does. Each additional PT_INTERP overwrote the previous
       interpreter, leaking the name allocation and the interpreter file
       reference together with the write denial open_exec() took,
       leaving the file unwritable for as long as the system runs.

 - overlayfs:

     - Compare the full escaped xattr prefix including the trailing dot.
       An xattr like "trusted.overlay.overlayfoo" was misclassified as
       an escaped overlay xattr.

     - Check read access to the copy_file_range() source with the
       source's mounter credentials.

 - super: Thawing a filesystem whose block device was frozen with
   bdev_freeze() deadlocked. Dropping the last block layer freeze
   reference from under s_umount ends up in fs_bdev_thaw() which
   reacquires s_umount on the same task. Pin the superblock with an
   active reference instead and call bdev_thaw() without holding
   s_umount.

 - procfs: Return EACCES instead of success when the ptrace access check
   for namespace links fails.

 - afs: Use afs_dir_get_block() rather than afs_dir_find_block() for
   block 0 in afs_edit_dir_remove(), matching afs_edit_dir_add().

 - Push the memcg gating of ->nr_cached_objects() down into the btrfs
   and shmem callbacks instead of skipping every callback during
   non-root memcg reclaim. The blanket check short-circuited XFS whose
   inode reclaim hook is intentionally driven from per-memcg contexts to
   free memcg-charged slab.

 - eventpoll: Pin files while checking reverse paths.

   Since struct file became SLAB_TYPESAFE_BY_RCU a concurrent close
   could free and recycle the file under the check which then took and
   dropped the f_lock of whatever live file now occupies that slot.

* tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
  super: fix emergency thaw deadlock on frozen block devices
  pidfs: make pidfs_ino_lock static
  eventpoll: pin files while checking reverse paths
  fs: push nr_cached_objects memcg gating into individual filesystems
  afs: Fix afs_edit_dir_remove() to get, not find, block 0
  iomap: prevent ioend merge when io_private differs
  iomap: add comments for ifs_clear/set_range_dirty()
  iomap: fix out-of-bounds bitmap_set() with zero-length range
  iomap: fix incorrect did_zero setting in iomap_zero_iter()
  iomap: support invalidating partial folios
  iomap: correct the range of a partial dirty clear
  fs/super: fix emergency thaw double-unlock of s_umount
  pidfs: handle FS_IOC32_GETVERSION in compat ioctl
  ovl: check access to copy_file_range source with src mounter creds
  proc: Fix broken error paths for namespace links
  pidfs: add pidfs_dentry_open() helper
  selftests/pidfd: check PIDFD_THREAD survives open_by_handle_at()
  pidfs: preserve thread pidfds reopened by file handle
  ovl: fix trusted xattr escape prefix matching
  selftests/fuse: add ACL_DONT_CACHE regression test
  ...

Pull char/misc driver fixes from Greg KH:
 "Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that
  resolve a bunch of different reported issues. Included in here are:

   - rust_binder error message reporting fix

   - stratix10-svc firmware driver fixes

   - mei driver fix

   - intel_th hardware tracing driver fix

   - comedi driver fix

   - uio_hv_generic driver fix

   - ntsync selftest fix

   - nsm misc driver fix

   - some MAINTAINER file updates

  All of these have been in linux-next for over a week with no reported
  issues"

* tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  MAINTAINERS: Update wine-devel list address
  rust_binder: only print failure if error has source
  intel_th: fix MSC output device reference leak
  misc: nsm: pin the module while the device is open
  mei: bus: access mei_device under device_lock on cleanup
  misc: nsm: only unlock nsm_dev on post-lock error paths
  selftests: ntsync: correct CONFIG_NTSYNC name
  comedi: comedi_parport: deal with premature interrupt
  uio_hv_generic: Bind to FCopy device by default
  MAINTAINERS: Add Greg Kroah-Hartman to GPIB
  firmware: stratix10-svc: fix teardown order in remove to prevent race
  firmware: stratix10-svc: handle NO_RESPONSE in async poll
  firmware: stratix10-svc: fix FCS SMC call kernel-doc
  firmware: stratix10-svc: fix memory leaks and list corruption bugs

Pull tracing fixes from Steven Rostedt:

 - Move rb_desc->nr_page_va before updating dynamic array

   The rb_descr->page_va is a dynamic array counted by nr_page_va. But
   the updating of the page_va[] is done before the nr_page_va is
   incremented causing a build with CONFIG_UBSAN_BOUNDS to flag it as an
   overflow.

   Move the increment of the counted by value before the array element
   is updated.

 - Propagate errors from remote event bulk updates

   The return value of trace_remote_enable_event() was not being checked
   by remote_events_dir_enable_write() where it would silently fail.
   Have it check the return value and propagate that back up to user
   space.

 - Fix resource leak on mmiotrace trace_pipe close

   The mmiotrace tracer was created in 2008 before the trace_pipe had a
   close callback to allow tracers to do clean up from trace_pipe open.
   The trace_pipe close cleanup callback was added in 2009 but the
   mmiotrace tracer was not updated. It had a hack to do the cleanup in
   the read call, where it may leak if user space did not read the
   entire buffer.

   Add a callback to mmiotrace trace_pipe close do to the cleanup
   properly.

 - Fix a possible NULL pointer dereference in the mmiotrace tracer

   If the mmio_pipe_open() fails to find a PCI device, it will set the
   hiter->dev pointer to NULL. The read function will blindly
   dereference that pointer. Fix the read call to check to see if that
   pointer is populated before dereferencing it.

 - Fix union collision of module and refcnt for dynamic events

   In 'struct trace_event_call', the 'module' pointer and the 'refcnt'
   atomic variable share the same memory space in a union. The filter on
   module logic only checked if the 'module' was set to determine if the
   event belonged to the module. As dynamic events are always builtin,
   it doesn't need the 'module' field of the structure and used a
   refcount. But the module filtering logic would then mistaken these
   dynamic events as a module and call module_name(event->module) on it.

   Add a check to see if the event is a dynamic event and if so, do not
   check it for being part of the given module.

 - Reset the top level buffer in selftests before running instances

   The ftracetest selftest initializes each instance before executing
   the tests. But it does not reset the top level buffer. Dynamic events
   are only added and removed by the top level so any left over dynamic
   events will not be removed by the reset in the instances.

   Left over dynamic events can cause the tests to incorrectly fail.
   Reset the top level buffer before running the instances.

 - Make the context_switch counter 64 bit

   The code to read user space for a system call trace event or for a
   trace_marker will disable migration, enable preemption, read user
   space into a per CPU buffer, disable preemption and enable migration
   again. It checks if the per CPU context switch counter to see if it
   changed, and if it did not, it would know that the per CPU buffer was
   not touched by another task.

   But the save counter was 32 bit and it would compare it to the 64 bit
   context_switch variable. A long running system could have the
   context_switch variable greater that 1<<32 in which case the compare
   will always fail. The compare will promote the 32 bit int saved value
   to 64 bit and compare it to the full 64 bit counter. Since the top 32
   bits of the saved value was zero, it would never match.

 - Fix a use-after-free of the event_enable trigger

   The event_enable trigger allows for enabling one event when another
   event is triggered. When the trigger is removed, it must go through a
   synchronization phase to make sure it is not triggered again. The
   trigger itself is delayed by the "bulk delay" logic that was recently
   added. But the code that frees the event_enable data used to rely on
   the trigger code to do the synchronization. Now that the code uses
   the call RCU functions (and a workqueue), that delay no longer is
   there.

   Add a callback private_data_free() function that allows triggers to
   clean up data after the synchronization phase has completed.

 - Move the module_ref counter into the delay callback

   Since an event of the event_enable trigger can enable an event for a
   module, it ups the module ref count for that event's module. This
   prevents the event from trying to enable an event that no longer
   exists and cause a use-after-free bug.

   The ref counter was set back down when the trigger was removed but
   not after thy synchronization phase. This could lead to the module
   data being accessed after module was unloaded.

   Move the module ref decrement into the private_data_free() callback
   of the event_enable trigger.

 - Add mutex to protect parser in ftrace filtering

   The set_ftrace_filter file uses a parsing descriptor that is
   allocated at open and modified by writes. If multiple threads were to
   write to the descriptor at the same time, it can corrupt the parser.

   Add a mutex around the modifications of the parser descriptor.

 - Fix possible corruption in perf syscall tracing

   The perf system call trace events can now read user space. To do so,
   the reads of user space enable preemption and disables it again.
   During this time that preemption is enabled, the task can migrate.
   The perf event list head is assigned via a per CPU pointer. It is
   done before the user space part is called. If the user space reading
   migrates the task to another CPU, then the head pointer is no longer
   valid.

   Re-assign the head pointer after the reading of user space to keep it
   using the correct data.

* tag 'trace-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing: perf: Fix stale head for perf syscall tracing
  ftrace: Add global mutex to serialize trace_parser access
  tracing: Delay module ref count for "enable_event" trigger
  tracing: Fix use-after-free freeing trigger private data
  tracing: Fix context switch counter truncation
  selftests/ftrace: Reset triggers at top level before instance loop
  tracing: Fix union collision of module and refcnt for dynamic events
  tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
  tracing: Fix resource leak on mmiotrace trace_pipe close
  tracing: Propagate errors from remote event bulk updates
  tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer()

Pull rust fixes from Miguel Ojeda:
 "Toolchain and infrastructure:

   - 'zerocopy' crates: update to v0.8.54 to fix a modpost error under
     'CONFIG_CC_OPTIMIZE_FOR_SIZE=y'.

     There are actually two updates in the PR: the one to v0.8.52 is
     fairly large and was originally not intended for a fixes PR, but the
     actual fix landed in the v0.8.54 one. Thus I included both here.

     The v0.8.52 update includes two things upstream added for us:
     '--cfg no_fp_fmt_parse' to avoid a local workaround, and the new
     'most_traits' feature.

     The good news is that, after these updates, the delta with upstream
     is now trivial: only an identifier prefix change and the SPDX
     parentheses.

   - Fix an objtool warning by adding one more 'noreturn' function for
     Rust 1.99.0 (expected 2026-10-01).

   - Clean up new 'semicolon_in_expressions_from_macros' lint errors for
     Rust 1.99.0 (expected 2026-10-01). The lint can be allowed, but it
     will be a hard error at some point in the future anyway, so clean it
     up now.

   - Locally allow new 'suspicious_runtime_symbol_definitions' lint for
     Rust 1.98.0 (expected 2026-08-20).

   - Globally allow 'clippy::unwrap_or_default' lint since it relies on
     optimizations -- under 'CONFIG_CC_OPTIMIZE_FOR_SIZE=y' it does not
     work well.

  'kernel' crate:

   - 'time' module: fix 'Delta::as_micros_ceil()' to round negative values
     correctly"

* tag 'rust-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: time: fix as_micros_ceil() to round correctly for negative Delta
  rust: device: avoid trailing ; in printing macros
  objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
  rust: zerocopy: update to v0.8.54
  rust: zerocopy: update to v0.8.52
  rust: allow `clippy::unwrap_or_default` globally
  rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98

Pull perf tools fixes from Arnaldo Carvalho de Melo:

 - Update header copies of kernel headers, including const.h, fs.h,
   perf_event.h, gfp_types.h, kvm.h, cpufeatures.h, rtnetlink.hp,
   msr-index.h, drm.h and socket.h

 - Add some build files related to BPF skels to .gitignore

* tag 'perf-tools-fixes-for-v7.2-1-2026-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:
  tools headers: Sync KVM headers with the kernel sources
  tools headers: Sync UAPI linux/fs.h with the kernel sources
  perf beauty: Update copy of linux/socket.h with the kernel sources
  tools headers: Sync UAPI drm/drm.h with kernel sources
  tools arch x86: Sync the msr-index.h copy with the kernel sources
  tools headers x86 cpufeatures: Sync with the kernel sources
  tools headers: Sync linux/gfp_types.h with the kernel sources
  tools headers UAPI: Sync linux/rtnetlink.h with the kernel sources
  tools headers UAPI: Sync linux/const.h with the kernel sources
  perf bench bpf: Add missing .gitignore file

Pull bpf fixes from Eduard Zingerman:

 - Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed
   sk_psock->cork for the local temporary message and freeing it again
   (Chengfeng Ye)

 - Reject passing scalar NULL to nonnull arg of a global subprog.

   Previously the verifier did not account for the cases directly
   passing scalars to a global subprog, e.g.: 'global_func(0);' would
   pass even if 'global_func' argument was marked nonnull (Amery Hung)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
  selftests/bpf: Test passing scalar NULL to nonnull global subprog
  bpf: Reject passing scalar NULL to nonnull arg of a global subprog

When running instance tests, 'ftracetest' creates a new ftrace instance
and runs the tests inside it. Before starting each test, it executes
'initialize_system()' to reset the ftrace state to initial-state.

However, since 'initialize_system()' is executed in the context of the
instance directory, it only cleans up triggers and filters of that
instance.
Any triggers or dynamic events left behind in the top-level instance by
previous failed top-level tests, are left completely untouched. These
top-level leftovers can cause subsequent instance-based tests to fail
or even crash the kernel.

Fix this by executing 'initialize_system()' in the top-level tracing
directory once before entering the instance loop.

Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/178425671889.84440.9477850701738666404.stgit@devnote2
Fixes: b5b77be812de ("selftests: ftrace: Allow some tests to be run in a tracing instance")
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

Make sure the verifier reject passing a hardcoded NULL to an
__arg_nonnull argument.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://patch.msgid.link/20260723221815.367797-2-ameryhung@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>

Pull networking fixes from Jakub Kicinski:
 "Lots of fixes, double the count even for the 'new normal'. Largely due
  to my time off followed by a networking conference which distracted
  most maintainers (less so the AI generators).

  Including fixes from Bluetooth and WiFi.

  Current release - regressions:

   - wifi: mt76: fix MAC address for non OF pcie cards

  Current release - new code bugs:

   - mptcp: fix BUILD_BUG_ON on legacy ARM config

   - wifi: cfg80211: guard optional PMSR nominal time

  Previous releases - regressions:

   - qrtr: ns: raise node count limit to 512, we arbitrarily picked
     256 as a limit, turns out it was too low for real world deployments

   - vhost-net: fix TX stall when vhost owns virtio-net header

   - eth: amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN

   - wifi: ath12k: fix low MLO RX throughput on WCN7850

  Previous releases - always broken:

   - number of random AI fixes for SCTP, RDS and TIPC protocols

   - more AI-looking fixes for WiFi drivers

   - number of fixes for missing pointer reloading after skb pull

   - reject BPF redirect use from qdisc qevent block

   - tcp: initialize standalone TCP-AO response padding

   - vsock/virtio: collapse receive queue under memory pressure to avoid
     client OOMing the host with tiny messages

   - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup,
     make sure the ICMP response routing follows the routing policy

   - gro: fix double aggregation of flush-marked skbs

   - ovpn: fix various refcount bugs

   - tls: device: push pending open record on splice EOF

   - eth: mlx5:
      - use sender devcom for MPV master-up
      - fix MCIA register buffer overflow on 32 dword reads"

* tag 'net-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (234 commits)
  drop_monitor: perform u64_stats updates under IRQ-disabled section
  drop_monitor: fix size calculations for 64-bit attributes
  net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
  mptcp: fix BUILD_BUG_ON on legacy ARM config
  selftests: mptcp: userspace_pm: fix undefined variable port
  mptcp: fix stale skb->sk reference on subflow close
  mptcp: pm: userspace: fix use-after-free in get_local_id
  mptcp: decrement subflows counter on failed passive join
  mac802154: hold an interface reference across the scan worker
  sctp: don't free the ASCONF's own transport in DEL-IP processing
  phonet: check register_netdevice_notifier() error in phonet_device_init()
  phonet: pep: fix use-after-free in pep_get_sb()
  bnge/bng_re: fix ring ID widths
  tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
  net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
  mctp: check register_netdevice_notifier() error in mctp_device_init()
  ptp: netc: explicitly clear TMR_OFF during initialization
  rds: tcp: unregister sysctl before tearing down listen socket
  ipv6: Change allocation flags to match rcu_read_lock section requirements
  net: slip: serialize receive against buffer reallocation
  ...

In make_connection(), the variable "port" is used but never defined.
This leads to an empty argument being passed to wait_local_port_listen(),
causing "printf: : invalid number" errors:

 # INFO: Init
 # 01 Created network namespaces ns1, ns2                          [ OK ]
 # INFO: Make connections
 # ./../lib.sh: line 651: printf: : invalid number
 # 02 Established IPv4 MPTCP Connection ns2 => ns1                 [ OK ]
 # INFO: Connection info: 10.0.1.2:59516 -> 10.0.1.1:50002
 # ./../lib.sh: line 651: printf: : invalid number
 # 03 Established IPv6 MPTCP Connection ns2 => ns1                 [ OK ]

Fix it by using the correctly defined variable "app_port", which holds the
appropriate port number for the connection.

Fixes: 39348f5f2f13 ("selftests: mptcp: wait for port instead of sleep")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-4-6fb595bc86ef@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>