Pull clk fixes from Stephen Boyd:
 "A few Allwinner clk driver fixes:

   - Mark Allwinner A523 MBUS clock as critical to avoid
     system stalls

   - Fix names of CSI related clocks on Allwinner V3s. This
     includes changes to the driver, DT bindings and DT files.

   - Fix parents of TCON clock on Allwinner V3s"

* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
  clk: sunxi-ng: v3s: Fix TCON clock parents
  clk: sunxi-ng: v3s: Fix CSI1 MCLK clock name
  clk: sunxi-ng: v3s: Fix CSI SCLK clock name
  clk: sunxi-ng: a523: Mark MBUS clock as critical

Pull Allwinner clock fixes from Chen-Yu Tsai:

 - Mark A523 MBUS clock as critical
 - Fix names of CSI related clocks on V3s
   This includes changes to the driver, DT bindings and DT files.
 - Fix parents of TCON clock on V3s

* tag 'sunxi-clk-fixes-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
  clk: sunxi-ng: v3s: Fix TCON clock parents
  clk: sunxi-ng: v3s: Fix CSI1 MCLK clock name
  clk: sunxi-ng: v3s: Fix CSI SCLK clock name
  clk: sunxi-ng: a523: Mark MBUS clock as critical

Pull char / misc / IIO fixes from Greg KH:
 "Here are some char/misc/iio and other driver fixes for 6.16-rc7.
  Included in here are:

   - IIO driver fixes for reported problems

   - Interconnect driver fixes for reported problems

   - nvmem driver fixes

   - bunch of comedi driver fixes for long-term bugs

   - Kconfig dependancy fixes for mux drivers

   - other small driver fixes for reported problems.

  All of these have been in linux-next for a while with no reported
  problems"

* tag 'char-misc-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (35 commits)
  nvmem: layouts: u-boot-env: remove crc32 endianness conversion
  misc: amd-sbi: Explicitly clear in/out arg "mb_in_out"
  misc: amd-sbi: Address copy_to/from_user() warning reported in smatch
  misc: amd-sbi: Address potential integer overflow issue reported in smatch
  comedi: comedi_test: Fix possible deletion of uninitialized timers
  comedi: Fix initialization of data for instructions that write to subdevice
  comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  comedi: das6402: Fix bit shift out of bounds
  comedi: aio_iiro_16: Fix bit shift out of bounds
  comedi: pcl812: Fix bit shift out of bounds
  comedi: das16m1: Fix bit shift out of bounds
  comedi: Fix some signed shift left operations
  comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
  nvmem: imx-ocotp: fix MAC address byte length
  MAINTAINERS: add miscdevice Rust abstractions
  mux: mmio: Fix missing CONFIG_REGMAP_MMIO
  iio: dac: ad3530r: Fix incorrect masking for channels 4-7 in powerdown mode
  iio: adc: ad7380: fix adi,gain-milli property parsing
  iio: adc: ad7949: use spi_is_bpw_supported()
  iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
  ...

Fixes for a few clk drivers and bindings:

 - Add a missing property to the Mediatek MT8188 clk binding to
   keep binding checks happy

 - Avoid an OOB by setting the correct number of parents in
   dispmix_csr_clk_dev_data

 - Allocate clk_hw structs early in probe to avoid an ordering
   issue where clk_parent_data points to an unallocated clk_hw
   when the child clk is registered before the parent clk in the
   SCMI clk driver

* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
  dt-bindings: clock: mediatek: Add #reset-cells property for MT8188
  clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data
  clk: scmi: Handle case where child clocks are initialized before their parents

Pull networking fixes from Paolo Abeni:
 "Including fixes from Bluetooth.

  Current release - regressions:

   - tcp: refine sk_rcvbuf increase for ooo packets

   - bluetooth: fix attempting to send HCI_Disconnect to BIS handle

   - rxrpc: fix over large frame size warning

   - eth: bcmgenet: initialize u64 stats seq counter

  Previous releases - regressions:

   - tcp: correct signedness in skb remaining space calculation

   - sched: abort __tc_modify_qdisc if parent class does not exist

   - vsock: fix transport_{g2h,h2g} TOCTOU

   - rxrpc: fix bug due to prealloc collision

   - tipc: fix use-after-free in tipc_conn_close().

   - bluetooth: fix not marking Broadcast Sink BIS as connected

   - phy: qca808x: fix WoL issue by utilizing at8031_set_wol()

   - eth: am65-cpsw-nuss: fix skb size by accounting for skb_shared_info

  Previous releases - always broken:

   - netlink: fix wraparounds of sk->sk_rmem_alloc.

   - atm: fix infinite recursive call of clip_push().

   - eth:
      - stmmac: fix interrupt handling for level-triggered mode in DWC_XGMAC2
      - rtsn: fix a null pointer dereference in rtsn_probe()"

* tag 'net-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (37 commits)
  net/sched: sch_qfq: Fix null-deref in agg_dequeue
  rxrpc: Fix oops due to non-existence of prealloc backlog struct
  rxrpc: Fix bug due to prealloc collision
  MAINTAINERS: remove myself as netronome maintainer
  selftests/net: packetdrill: add tcp_ooo-before-and-after-accept.pkt
  tcp: refine sk_rcvbuf increase for ooo packets
  net/sched: Abort __tc_modify_qdisc if parent class does not exist
  net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info
  net: thunderx: avoid direct MTU assignment after WRITE_ONCE()
  selftests/tc-testing: Create test case for UAF scenario with DRR/NETEM/BLACKHOLE chain
  atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
  atm: clip: Fix infinite recursive call of clip_push().
  atm: clip: Fix memory leak of struct clip_vcc.
  atm: clip: Fix potential null-ptr-deref in to_atmarpd().
  net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
  net: phy: smsc: Force predictable MDI-X state on LAN87xx
  net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
  net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
  rxrpc: Fix over large frame size warning
  net: airoha: Fix an error handling path in airoha_probe()
  ...

The datasheets refer to the first Ethernet controller as GMAC0, not
EMAC0.

Rename the compatible string to align with the datasheets. A fix for
the device trees will be sent separately.

Fixes: 0454b9057e98 ("dt-bindings: net: sun8i-emac: Add A523 EMAC0 compatible")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20250628054438.2864220-2-wens@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Pull i2c fixes from Wolfram Sang:

 - designware: initialise msg_write_idx during transfer

 - microchip: check return value from core xfer call

 - realtek: add 'reg' property constraint to the device tree

* tag 'i2c-for-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  dt-bindings: i2c: realtek,rtl9301: Fix missing 'reg' constraint
  i2c: microchip-core: re-fix fake detections w/ i2cdetect
  i2c/designware: Fix an initialization issue

Pull input updates from Dmitry Torokhov:

 - support for Acer NGR 200 Controller added to xpad driver

 - xpad driver will no longer log errors about URBs at sudden disconnect

 - a fix for potential NULL dereference in cs40l50-vibra driver

 - several drivers have been switched to using scnprintf() to suppress
   warnings about potential output truncation

* tag 'input-for-v6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt()
  Input: alps - use scnprintf() to suppress truncation warning
  Input: iqs7222 - explicitly define number of external channels
  Input: xpad - support Acer NGR 200 Controller
  Input: xpad - return errors from xpad_try_sending_next_out_packet() up
  Input: xpad - adjust error handling for disconnect
  Input: apple_z2 - drop default ARCH_APPLE in Kconfig
  Input: Fully open-code compatible for grepping
  dt-bindings: HID: i2c-hid: elan: Introduce Elan eKTH8D18
  Input: psmouse - switch to use scnprintf() to suppress truncation warning
  Input: lifebook - switch to use scnprintf() to suppress truncation warning
  Input: alps - switch to use scnprintf() to suppress truncation warning
  Input: atkbd - switch to use scnprintf() to suppress truncation warning
  Input: fsia6b - suppress buffer truncation warning for phys
  Input: iqs626a - replace snprintf() with scnprintf()

Jonathan writes:

iio: 1st set of fixes for the 6.16 cycle

The usual mixed back of the recent and ancient issues that have surfaced
so far this cycle.

iio-core
- Fix a possible out of bounds write on writing string terminator.
iio-backend:
- Fix a possible out of bounds write on writing string terminator.

adi,ad3530r
- Fix wrong masking for channels 4-7 in powerdown mode as they are in a
  second register and mask assumed all in one larger register.
adi,ad7380
- Fix parsing of adi,gain-milli property by reading it as u16 as specified
  in the binding.
adi,ad7606
- Tweak dt-binding to allow both interrupts and backend to be wired up
  resolving some dt_schema warnings.
- Mask value before returning it in register read as for parallel busses
  both the value and (unwanted) address are read back.
adi,ad7949
- Use spi_is_bpw_supported() to correctly handle bits_per_word_mask == 0
  which means default value of 8.
invensense,mpu3050
- Fix wrong number of interrupts in the binding as minItems should have
  been maxItems.
maxim,max1363
- Two related fixes for a long running mismatch between array indexes
  that now results in warnings after the core gained a sanity check.
  Resulted in unnecessary channels being sampled.
nxp,fxls8962
- Fix a use after free in fxls8962af_fifo_flush() if it races with buffer
  mode tear down.
st,sensors
- Stop using indio_dev->dev before it was initialized as the parent device
  should be used anyway for error messages and similar.
st,stm32-adc
- Fix a race when installing chained IRQ handler.
x-powers,axp20x_adc
- Add missing sentinel in ADC channel map (avoid out of bounds read).

* tag 'iio-fixes-for-6.16a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio:
  iio: dac: ad3530r: Fix incorrect masking for channels 4-7 in powerdown mode
  iio: adc: ad7380: fix adi,gain-milli property parsing
  iio: adc: ad7949: use spi_is_bpw_supported()
  iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
  iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps
  dt-bindings: iio: gyro: invensense,mpu3050: change irq maxItems
  iio: common: st_sensors: Fix use of uninitialize device structs
  iio: adc: adi-axi-adc: fix ad7606_bus_reg_read()
  dt-bindings: iio: adc: adi,ad7606: fix dt_schema validation warning
  iio: adc: max1363: Reorder mode_list[] entries
  iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
  iio: adc: stm32-adc: Fix race in installing chained IRQ handler
  iio: fix potential out-of-bound write
  iio: backend: fix out-of-bound write

Pull networking fixes from Paolo Abeni:
 "Including fixes from Bluetooth.

  Current release - new code bugs:

    - eth:
       - txgbe: fix the issue of TX failure
       - ngbe: specify IRQ vector when the number of VFs is 7

  Previous releases - regressions:

    - sched: always pass notifications when child class becomes empty

    - ipv4: fix stat increase when udp early demux drops the packet

    - bluetooth: prevent unintended pause by checking if advertising is active

    - virtio: fix error reporting in virtqueue_resize

    - eth:
       - virtio-net:
          - ensure the received length does not exceed allocated size
          - fix the xsk frame's length check
       - lan78xx: fix WARN in __netif_napi_del_locked on disconnect

  Previous releases - always broken:

    - bluetooth: mesh: check instances prior disabling advertising

    - eth:
       - idpf: convert control queue mutex to a spinlock
       - dpaa2: fix xdp_rxq_info leak
       - amd-xgbe: align CL37 AN sequence as per databook"

* tag 'net-6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (38 commits)
  vsock/vmci: Clear the vmci transport packet properly when initializing it
  dt-bindings: net: sophgo,sg2044-dwmac: Drop status from the example
  net: ngbe: specify IRQ vector when the number of VFs is 7
  net: wangxun: revert the adjustment of the IRQ vector sequence
  net: txgbe: request MISC IRQ in ndo_open
  virtio_net: Enforce minimum TX ring size for reliability
  virtio_net: Cleanup '2+MAX_SKB_FRAGS'
  virtio_ring: Fix error reporting in virtqueue_resize
  virtio-net: xsk: rx: fix the frame's length check
  virtio-net: use the check_mergeable_len helper
  virtio-net: remove redundant truesize check with PAGE_SIZE
  virtio-net: ensure the received length does not exceed allocated size
  net: ipv4: fix stat increase when udp early demux drops the packet
  net: libwx: fix the incorrect display of the queue number
  amd-xgbe: do not double read link status
  net/sched: Always pass notifications when child class becomes empty
  nui: Fix dma_mapping_error() check
  rose: fix dangling neighbour pointers in rose_rt_device_down()
  enic: fix incorrect MTU comparison in enic_change_mtu()
  amd-xgbe: align CL37 AN sequence as per databook
  ...