Pull devm_kmalloc_obj conversion from Kees Cook:

 - treewide refresh of kmalloc_obj() conversions

 - devm_kmalloc_obj conversion rules added to Coccinelle scripting

 - treewide conversion of devm_kmalloc() family to devm_kmalloc_obj()

* tag 'devm_kmalloc_obj-v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family
  coccinelle: kmalloc_obj: Include devm_kmalloc_obj conversion rules
  treewide: refresh kmalloc_obj() conversions

Pull x86 fixes from Ingo Molnar:

 - Select the BHI mitigation based on the attack vector properly
   (Breno Leitao)

 - Fix i386-gcov build bug in csum_ipv6_magic() due to overly
   strict asm constraints that cannot be met in that build mode
   (Rosen Penev)

 - Fix Vmware-guest i386 high-bandwidth hypercall arguments
   under UNWINDER_GUESS & disabled frame-pointers (Zack Rusin)

 - Fix resctrl AMD ABMC counter ID field width (Babu Moger)

 - Fix restctrl pqos tool ABI breakage by reverting the
   mbm_assign_mode to default mode at boot (Babu Moger)

 - Initialize wall clock in get_rtc_noop() (Naman Jain)

 - Fix ptrace historic ABI quirk regression (Thomas Gleixner)

 - Add Drew Fustini as resctrl reviewer and Ben Horgan
   as fs/resctrl reviewer

 - Clear SEV RMPOPT when segmented RMP is disabled by firmware but
   is advertised as available (Ashish Kalra)

 - Set up SEV RMPOPT only on an active SNP host (Ashish Kalra)

 - Don't emit KCFI_REFERENCE() in modules (Ridge Lomont)

 - Ignore negative NMI handler durations (Breno Leitao)

 - Fix off-by-one error in boot-time sme_clear_pgd() (Thorsten Blum)

 - Fix ASID allocation bug (Chris Mason)

* tag 'x86-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/mm: Fix global ASID handed out to two processes
  x86/boot: Fix off-by-one error in sme_clear_pgd()
  MAINTAINERS: Add Ben Horgan as fs/resctrl reviewer
  x86/nmi: Ignore negative NMI handler durations
  x86/kcfi: Don't emit KCFI_REFERENCE() in modules
  x86/sev: Set up RMPOPT only on an active SNP host
  x86/sev: Clear RMPOPT when segmented RMP is disabled by firmware
  MAINTAINERS: resctrl: Add myself as reviewer
  x86/entry: Fix ptrace regression
  x86/init: Initialize wall clock in get_rtc_noop()
  x86,fs/resctrl: Keep mbm_assign_mode in default mode at boot
  x86/resctrl: Correct ABMC counter ID field width
  x86/vmware: Fix i386 high-bandwidth hypercall arguments
  x86/csum: Relax the len and proto constraints in 32-bit csum_ipv6_magic()
  x86/bugs: Select the BHI mitigation based on the attack vector properly

Pull scheduler fixes from Ingo Molnar:

 - Fix this_bw on class change of a dying SCHED_DEADLINE task
   (Nickolai Zeldovich)

 - Account I/O waits independently of delayed dequeue
   (Christian Loehle)

 - Clear throttle state when leaving the fair class (Daehyeon Ko)

 - Fix u32 truncation of the PELT period count (Hui Su)

 - Fix imbalanced cluster static-key updates that can mistakenly
   disable cluster-aware scheduling (Hui Su)

 - Fix active load balancing logic to ignore non-fair current
   in alb_break_llc() (Kayra Cizmeci)

* tag 'sched-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/cache: Ignore non-fair current in alb_break_llc()
  sched/topology: Balance cluster static-key updates
  sched/pelt: Fix u32 truncation of the PELT period count
  sched/fair: Clear throttle state when leaving the fair class
  sched/core: Account I/O waits independently of delayed dequeue
  sched/deadline: Fix this_bw on class change of a dying task

Pull perf events fixes from Ingo Molnar:

 - Fix sideband event output when only requesting attr.defer_output
   (Ian Rogers)

 - Clamp deferred callchain entry count to fit u16 header.size
   (Ian Rogers)

 - Various AMD IBS fixes (Ravi Bangoria):
    - Reset CPU0 IBS state on syscore resume
    - Fix kernel address leak via REGS_USER and REGS_INTR
    - Simplify/fix event state handling with IBS_CAPS_DIS

 - Revert AUX page allocation order default to be continuous (Leo Yan)

 - Don't send SIGTRAP after exec removed the event (Danish Khateeb)

* tag 'perf-urgent-2026-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/core: Don't send SIGTRAP after exec removed the event
  Revert "perf/aux: Allocate non-contiguous AUX pages by default"
  perf/amd/ibs: Simplify event state handling with IBS_CAPS_DIS
  perf/amd/ibs: Fix kernel address leak via REGS_USER and REGS_INTR
  perf/amd/ibs: Reset CPU0 IBS state on syscore resume
  perf/core: Clamp deferred callchain entry count to fit u16 header.size
  perf/core: Include perf_event_attr::defer_output in is_sb_event() check

Pull regulator fixes from Mark Brown:
 "A small collection of mostly fairly standard driver specific fixes.

  The mt6363 changes are a little large but are the result of two
  independent users running into the same issues and testing each
  other's changes so given that it's only -rc1 it seemed sensible to
  take the changes as fixes"

* tag 'regulator-fix-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: mt6363: Fix VEMC voltage selection
  regulator: mt6363: Use 8-bit register values
  regulator: mt6363: Fix the registers of the VSRAM CPU and APU LDOs
  regulator: qcom_spmi: don't take a sleeping lock in the SAW IPI

Pull sound fixes from Takashi Iwai:
 "A collection of (unsurprisingly high amount of) small fixes since the
  previous PR. Majority of changes are device-specific quirks and driver
  fixes, along with a few ALSA core fixes and USB-audio driver
  hardening.

  ALSA Core:
   - Fix page leak on WC DMA buffer allocation failure
   - Prevent O_APPEND on OSS streams to avoid UAF
   - A PCM regression fix for PulseAudio to allow hw_refine with mmap
   - Serialize DSP image loading requests in hwdep
   - Clear user-provided numid before adding a control
   - Fix dropped data bytes in UMP to MIDI 1.0 System message conversion

  HD-audio:
   - Fix double-free on stream page allocation failure in core
   - Stop capability walk cleanly on empty capability header
   - Fix silent output on Nvidia codecs due to shared converters
   - Restore audio registers after AE-5 LED strip transmission
   - Calibration data validation and custom address fixes for TAS2781
   - Shared boot wait and reset helpers for CS35L41
   - Cleanups and fixes for CS35L56 and AW88399
   - Add Tegra268 HDMI/DP codec ID
   - Device quirks for Acer, Alienware, ASUS, HP, Huawei, Lenovo, MSI

  USB-audio:
   - Hardening and bug fixes for usx2y and us122l drivers
   - Delay MIDI URB retry on -EPIPE to allow disconnect handling
   - Fix use-after-free of MIDI URBs on close in bcd2000
   - Reject undersized capture buffers in line6 driver
   - Fix URB leak on input setup failure in caiaq driver
   - Check return value of qmi_handle_init() in Qualcomm offload driver
   - Quirks for Yamaha ZG02, HIK camera, and CVT Touch Device

  ASoC:
   - AMD: Support more ACP7.0 projects, quirks for HP and Lenovo models
   - Intel: Dummy topology for SN624x codec, SOF BPT DMA stream fix
   - Qualcomm: Guard q6apm callbacks, fix runtime PM refcount leak
   - Rockchip: Add missing REGMAP_MMIO Kconfig dependencies
   - Meson: Request IRQ with clock enabled in axg-fifo
   - Codec fixes for cs35l41, cs_dsp, wm_adsp, wm8904, ES8389, tas2770,
     sn624x, and aw88399

  Misc:
   - FireWire: Fix inverted streaming speed in firewire-tascam
   - PCI: Check SCB creation failures in legacy cs46xx driver"

* tag 'sound-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (72 commits)
  ALSA: hda/realtek: Add quirk for Acer Predator PHN16-71
  ALSA: hda/realtek: Use inverted mute LED quirk for HP ZBook 8 G2a
  ALSA: hda: cs35l41: Add support for HP OmniBook 7 Laptop 16-ay0xxx
  ALSA: usx2y: Guard the playback copy
  ALSA: usx2y: Require a buffer of two URBs
  ALSA: hda: cs35l56: Stop cs_dsp before calling cs_dsp_power_down()
  ALSA: doc: cs35l56: Update calibration write failure message info
  ALSA: hda: cs35l56: Fix mixed cleanup and goto in cs35l56_hda_fw_load()
  ALSA: hda/tegra: Add Tegra268 HDMI/DP codec ID
  ALSA: hda/realtek: Fix pop noise on ASUS PRIME B650M-K
  ALSA: hda/realtek: Fix DAC binding for Legion Pro 7 16ARX8H variant
  ALSA: hda/realtek: Fix DAC binding for Lenovo Legion Pro 7 16ARX8H
  ALSA: caiaq: free the EP4 URB when input setup fails
  ALSA: line6: Reject capture buffers smaller than two packets
  ALSA: pcm: Allow HW_REFINE queries with mapped buffers
  ALSA: hda/ca0132: Restore AE-5 audio registers after LED strip send
  ALSA: hda/tas2781: Only accept CRC-less V1 data if all entries are valid
  ALSA: hda/realtek: Enable mute and mic-mute LEDs on HP ENVY 17-cr0xxx
  ALSA: usb-audio: Add quirk for Yamaha ZG02
  ALSA: pcm: Prevent O_APPEND open on OSS streams
  ...

Pull iommu fixes from Joerg Roedel:
 "AMD IOMMU:

   - Move PerfOpt management into the IOMMU domain attachment paths,
     enabling it automatically for supported integrated GPUs in identity
     mode and clearing it before switching to translated or blocked
     domains

   - Fix a boot panic in the GPU identity-mapping quirk when a GPU has
     no upstream PCI bridge

   - Clear the IOMMU SNP enable flag when RMP table initialization
     fails, preventing subsequent initialization from assuming SNP setup
     succeeded

   - Check IVRS subtable types before parsing memory definitions,
     avoiding bogus PCI segments caused by misinterpreting IVHD entries
     under QEMU

   - Remove an obsolete warning on device release that incorrectly fires
     for devices required to remain attached to an identity domain"

* tag 'iommu-fixes-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
  iommu/amd: Fix NULL pointer dereference for GPUs without upstream bridge
  iommu/amd: remove obsolete domain pointer warning on release
  iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions
  iommu/amd: Clear amd_iommu_snp_en if snp_rmptable_init() fails
  iommu/amd: Enable PerfOpt automatically for integrated GPUs

Pull block fixes from Jens Axboe:

 - NVMe fixes via Keith:
    - nvme-tcp use-after-free in nvme_tcp_free_ctrl() on a failed
      connect, and the nvme-rdma counterpart of the NULL queue->ctrl on
      reconnect
    - nvmet-rdma iWARP disconnect and device removal fixes
    - nvmet-tcp: ask for the TLS record type on every receive, and bound
      the connections accepted per work run so a connect flood can't
      hold up port removal; nvmet-auth keep the old keys if the new ones
      fail to decode; nvme-loop delete the controller if a reset fails
    - nvmet-auth reject incomplete DHCHAP messages, and a keep-alive
      timeout overflow
    - nvmet locking and bounds fixes for tbkas reconnects and the
      traddr/trsvcid configfs writes, don't leak stale memory in the ANA
      log page, and cache the passthru reference across queue_response
    - Wait for SRCU readers before splicing the namespace list, with a
      new list_splice_init_srcu() helper, and drop an extra grace period
      in nvmet_ns_disable()
    - Unregister when pr_register() is given a zero new key, and don't
      drop the cdev reference twice on cdev_device_add() failure
    - Quirks for the ADATA XPG GAMMIX S70 BLADE and KIOXIA XG10d
    - Various smaller fixes and cleanups

 - blk-mq: end the request if getting a keyslot fails, which left the
   in-flight count and zone write plug stuck, reset the queue state on
   scheduler teardown so requests don't stall in software queues, and
   fix an out-of-bounds read in blk_mq_free_rqs() after a failed
   nr_hw_queues update

 - Only serialize elevator switches of the same queue

 - dma-buf bio fixes: don't use the bvec fast path for them, and only
   fail the ones that need block layer PI

 - Reject GPT entries with starting_lba > ending_lba

 - Return the soft block size for compat BLKBSZGET, report the correct
   discard alignment in sysfs, and account the flush sequence latency
   only once in iocost

 - virtio_blk fixes: synchronous quiesce in freeze, freeze the virtqueue
   layout at probe time, clamp max_segments to the ring size, and fix
   zone append sector reporting in batched completion

 - null_blk zone fixes and a cache state reset

 - zloop fixes

 - ublk DEL_DEV_ASYNC permission check, and 32-bit selftest build

* tag 'block-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (52 commits)
  nvmet: cache passthru reference in __nvmet_req_complete()
  nvmet: drop the redundant auth check in nvmet_parse_io_cmd()
  nvmet: bound the traddr and trsvcid configfs writes
  nvmet: take subsys->lock when forcing reconnects for tbkas
  nvme: wait for SRCU readers before splicing the namespace list
  srcu: Add list_splice_init_srcu()
  nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d
  nvmet: don't return memory contents beyond valid data when reading ANA log page
  nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE
  nvmet: drop the extra RCU grace period in nvmet_ns_disable()
  nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()
  ublk: add missing DEL_DEV_ASYNC to unprivileged permission check
  selftests: ublk: fix the build and file offsets on 32-bit
  nvmet-rdma: disconnect a queue on device removal
  nvmet-rdma: queue the release work under the mutex
  nvmet-rdma: take a device off the list last
  nvmet-tcp: limit the connections accepted per work run
  nvmet-rdma: disconnect only established queues
  nvmet-auth: keep the old keys if the new ones fail
  nvmet-tcp: ask for the TLS record type on every receive
  ...

Pull io_uring fixes from Jens Axboe:

 - Only wait for in-flight requests on ring release if the closing task
   actually uses the ring.

 - SQPOLL fixes: do the return-to-userspace work in the SQPOLL thread,
   as memory.high reclaim and blkcg throttling otherwise only ran at
   thread exit, and don't set the stop bit on thread exit, which tripped
   a WARN_ON_ONCE() in the ring teardown.

 - Don't poll a writer for a read side hangup or for urgent data, as a
   half-closed peer or unread OOB data kept the async poll of a send
   ready on every re-arm.

 - Cancel all matching poll requests in one pass for CANCEL_ALL rather
   than restarting the hash walk per request.

 - Hold uring_lock across the put_user() for the index-alloc file
   install.

 - Don't arm an hrtimer and schedule for a wait whose timeout has
   already expired.

 - Add a feature flag for the dma-buf registered buffer support.

 - selftests 32-bit cast fix

* tag 'io_uring-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: only wait for in-flight requests if the closing task uses the ring
  io_uring: add feature flag for dma-buf support
  io_uring/wait: don't sleep on an already expired timeout
  io_uring/rsrc: hold uring_lock across index-alloc put_user
  selftests/io_uring: cast optval through uintptr_t in mini_liburing.h
  io_uring/poll: don't poll a writer for urgent data
  io_uring/poll: don't poll a writer for a read side hangup
  io_uring/poll: cancel all matching requests in one pass
  io_uring/cancel: count all requests that a CANCEL_ALL cancels
  io_uring/sqpoll: do the return-to-userspace work in the SQPOLL thread
  io_uring/sqpoll: don't set IO_SQ_THREAD_SHOULD_STOP on thread exit

Pull udf, ext2, isofs and quota fixes from Jan Kara:
 - Some disk format validation improvements for udf
 - Fix isofs handling of dates before 1900
 - Fix ext2 inadvertedly syncing buffer on every directory modification
 - Fix ext2 O_DSYNC handling for direct IO
 - A couple of smaller ext2 fixes
 - Fix tmpfs quotas for root filesystem
 - Unify my email addresses in MAINTAINERS file

* tag 'fs_for_v7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  udf: Fix incorrect error code in udf_current_aext()
  udf: Simplify udf_table_prealloc_blocks()
  udf: don't use eloc after the end of the unallocated space table
  udf: fix preallocation discarding before an empty allocation extent
  udf: check the unallocated space table when it is loaded
  udf: don't let the extent type hide an exhausted free-space table extent
  ext2: preserve IOMAP_F_DIRTY for extending direct writes
  udf, ext2, quota, jbd2: Unify email addresses in MAINTAINERS
  isofs: handle Rock Ridge long-form dates before 1900
  ext2: only flush DIRSYNC directories on every change
  ext2: preserve completed DIO bytes when buffered fallback fails
  ext2: take invalidate_lock in ext2_write_failed()
  ext2: Make sbi an proper alias for EXT2_SB(sb) in ext2_fill_super()
  udf: Validate extended attribute space is large enough
  quota: initialize dquot cache before mounting rootfs
  udf: validate vat20->lengthHeader and VAT inode size in udf_load_vat()