Pull hardening updates from Kees Cook:

 - Provide kmalloc_obj*-style API for devm_kmalloc()

 - Improve seq_buf API for saner C String handling with several bug
   fixes along the way (Kees Cook, Bill Wendling)

 - Overflow helper readability improvements (Bill Wendling)

 - Unexport native_write_cr4() (Dennis Chen)

 - um: fix CONFIG_GCOV for built-in code (Johannes Berg)

 - Improve stackinit test coverage (Justin Stitt)

 - KMSAN: fix memset() when using fortify-source, again (Arnd Bergmann)

 - lkdtm: use kmalloc() instead of __get_free_page (Mahad Ibrahim)

 - signalfd: don't dequeue the forced fatal signals (Oleg Nesterov)

 - Fix randstruct to recognize new container_of() behavior

 - coccinelle: kmalloc_obj: Convert multi-byte integral allocations too

 - Fix a couple remaining allocation return type mismatches

* tag 'hardening-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (29 commits)
  overflow: Match arithmetic in both parts of __builtin_choose_expr
  lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()
  extcon: realtek: Remove const from type_c_cfg allocation type
  coresight: cti: Add const to con_groups allocation type
  docs: core-api: Document the seq_buf API
  nvdimm: ndtest: Return the string length from flags_show()
  powerpc/papr_scm: Return the string length from the sysfs show functions
  seq_buf: Add seq_buf_init_append()
  bpf: Remove dead newline stripping from format_disasm_line()
  seq_buf: Add seq_buf_terminate()
  seq_buf: Add seq_buf_strlen()
  seq_buf: Clear what a writer did not claim when a seq_buf overflows
  seq_buf: Copy what fits when seq_buf_puts() and seq_buf_putmem() overflow
  scsi: lpfc: Print rx monitor records straight into the seq_buf
  seq_buf: Do not pop from an overflowed seq_buf
  seq_buf: Do not print an empty line from an overflowed seq_buf_do_printk()
  .get_maintainer.ignore: Add Kees Cook
  devres: Provide kmalloc_obj*-style API for devm_kmalloc
  mm: Move default_gfp() into gfp_types.h
  kunit/stackinit: Clean up XFAIL under instrumentation
  ...

Pull HID fixes from Jiri Kosina:

 - new device IDs/quirks (Logitech G502X, Elecom M-XT4DRBK, Steelseries
   Arctis 7, Asus Rog Z13 Folio, Lenovo Yoga Slim Gen 11)

 - fixes for various code issues found by LLMs

* tag 'hid-for-linus-2026092202' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  selftests/hid: add unnumbered variant to the hid_bpf tests
  HID: bpf: fix __hid_bpf_hw_check_params report length
  selftests/hid: add define for commonly used buf size
  HID: amd_sfh: Validate PCI BAR size before mapping
  HID: elecom: fix bus type for M-XGL20DLBK
  HID: elecom: Add support for ELECOM M-XT4DRBK (018E)
  HID: corsair-void: Fix firmware event packet description
  HID: i2c-hid: Add i2c-hid-quirk-bad-input-size quirk for 0911:5288 device
  HID: hid-oxp: use cancel_delayed_work_sync() in remove
  HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard
  HID: roccat: fix locking in roccat_connect() and roccat_disconnect()
  HID: steelseries: Add support for Arctis 7 (2018)
  HID: logitech-hidpp: Add support for G502 X Lightspeed USB mouse
  HID: fix semantic patch and improve its performance
  HID: alps: fix use-after-free on input2 registration failure
  HID: alps: unregister DualPoint Stick input device on remove
  HID: winwing: fix use-after-free in force feedback teardown
  HID: multitouch: Add report ID mismatch quirk for ASUS ROG Z13 Folio
  HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
  HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard

Currently the kmalloc_obj conversion rules leave alone every allocation
sized to an integral type, or assigned to a pointer to one, so that byte
buffers keep being allocated with a byte count. That also leaves alone
arrays of multi-byte integers, such as

	vals = kcalloc(n, sizeof(u32), GFP_KERNEL);

which count objects like any other array. At the same time the signed
types (s8 through s64 and their variants) were not in the list at all.
But these multi-byte types are better handled through the full
kmalloc_obj-style allocation, as they are, in fact, typed and aren't
just a byte string, so they would benefit from type checking.

Split INTEGRAL into BYTE_TYPES and MULTIBYTE_TYPES:

 - Allocations sized by a byte type or a string literal, or assigned to
   a pointer to a byte type, are still left alone.
 - Allocations sized by a multi-byte type are converted when they are
   assigned to a pointer, or a pointer to const, of that same type.
   Other allocations sized by a multi-byte type are left alone, as their
   target may be a pointer to an array.
 - Allocations of other types assigned to a pointer to a multi-byte type
   are still left alone.
 - Arrays of pointers to integral types sized by type, such as
   sizeof(char *), are still left alone, now including the signed
   types, as their target may be a pointer to an array of pointers, like
   "const char *(*fmts)[]". Sized as sizeof(*target), they are converted
   like any other array.

List the signed types and the other spellings of the standard integer
types (short int, unsigned, long long int, and so on), so that a
declaration and a sizeof() that spell the same type differently still
match.

Assisted-by: LLM coccinelle
Link: https://patch.msgid.link/20260914223748.i.971-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>

Replace "expression" with "identifier" in the declaration of hdev.
This is necessary because hdev is used as the name of a function
parameter.

Move the two uses of @p2 to the relevant function names.

Convert <... ...>, meaning that the contained pattern is optional,
to use ..., when any, and exists.  This requires that the function
contain calls to hid_hw_start, etc, which reduces the set of files
that are considered for matching against this pattern.

Reported-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
Signed-off-by: Jiri Kosina <jkosina@suse.com>

Update the report and org mode messages to reflect the new
function names.

Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>

dev_put_track() and dev_hold_track() were renamed to netdev_put() and
netdev_hold() by commit d62607c3fe45 ("net: rename reference+tracking
helpers").

So update the names.

Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>

atomic_long_dec_and_lock() has never existed. So drop it from the rules.

No functional change.

Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>

vmalloc_exec() was removed by commit 7a0e27b2a0ce ("mm: remove
vmalloc_exec").

So drop it from the rules.

No functional change.

Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>

pci_pool_alloc() and pci_pool_zalloc() were removed by commit
88dee3b0efe4 ("PCI: Remove unused pci_pool wrappers").

So drop the pci_pool_alloc rules.

No functional change.

Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>

- kmem_alloc() was removed by commit f078d4ea8276
  ("xfs: convert kmem_alloc() to kmalloc()")

- kmem_zalloc() was removed by commit 10634530f7ba
  ("xfs: convert kmem_zalloc() to kzalloc()")

So drop the kmem_alloc rules.

No functional change.

Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>