Pull configfs fix from Breno Leitao:

 - Fix the build of the configfs selftest on 32-bit architectures,
   broken since the test was added in the v7.4 merge window.

   The harness casts the ASSERT_NE() operands to intmax_t, so handing it
   the pointer returned by mkdtemp() triggers gcc's pointer-to-int-cast
   warning on 32-bit, and the test builds with -Werror.

   KernelCI's 32-bit arm kselftest builds hit this.

* tag 'configfs-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux:
  selftests/configfs: fix the build on 32-bit architectures

Commit a518e63c3775 ("ovl: return EINVAL instead of EIO in case of
mismatched user_ns") changed the errno for completing an overlay
fscontext from another user namespace. Update the overlay test variant
to match binfmt_misc.

Reported-by: kernel test robot <yi1.lai@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202611020115.2281e158-lkp@intel.com
Fixes: a518e63c3775 ("ovl: return EINVAL instead of EIO in case of mismatched user_ns")
Cc: stable@vger.kernel.org
Signed-off-by: Amir Goldstein <amir73il@gmail.com>

The fixture setup checks the result of mkdtemp() with ASSERT_NE(), which
hands the pointer to the harness. The harness casts both operands to
intmax_t to print them, and on 32-bit architectures gcc warns about the
cast from a pointer to an integer of a different size. The configfs
test builds with -Werror, so it fails to build there:

  kselftest_harness.h:797:49: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast]

Compare the result against NULL inside ASSERT_TRUE(), so that the
harness only sees an int.

Fixes: a7fdcb2edd0f ("selftests/configfs: add tests for the userspace interface")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20261103141627.30838-1-sashal@kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>

Commit 3e14f079d7a0 ("selftests/fuse: add fuse symlink caching test")
registered fuse_symlink_cache_test in the fuse selftest Makefile and
.gitignore, but the test source was not part of the applied commit, so
building the fuse selftests fails:

  make[1]: *** No rule to make target 'fuse_symlink_cache_test.c', needed by '.../fuse_symlink_cache_test'.

Add fuse_symlink_cache_test.c as posted in Luis Henriques's v5
submission. The test serves a file and a symlink to it from a libfuse
low-level filesystem, resolves the symlink 100 times, and counts the
readlink requests that reach the server: one when FUSE_CAP_CACHE_SYMLINKS
is set during FUSE_INIT, and all 100 when it is not.

Fixes: 3e14f079d7a0 ("selftests/fuse: add fuse symlink caching test")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/r/202610170822.oEJ1Autq-lkp@intel.com/
Link: https://lore.kernel.org/r/20261001164916.15311-8-luis@igalia.com
Originally-by: Luis Henriques <luis@igalia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Reviewed-by: Luis Henriques <luis@igalia.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull vfs fixes from Christian Brauner:

 - writeback:

    - Update dirtied_when instead of dirtied_time_when when a wb switch
      puts an inode at the newest end of the target b_dirty list. The
      list was left out of order so move_expired_inodes() could stop
      before older inodes, and the lazytime expiration timestamp was
      reset

    - Clear the old wb's dirty-I/O state and bandwidth contribution when
      a batch of inode switches leaves its dirty lists empty. An empty
      wb stayed scheduled for periodic writeback and inflated
      bdi->tot_write_bandwidth

    - Take wb_switch_rwsem across the inode scan of
      cleanup_offline_cgwb(). The v7.3-rc5 fix that rotates scanned
      inodes let a scan racing a sync()'s queue_io() move lazytime
      inodes past the sync's cutoff, so sync() returned without
      persisting their timestamps

    - Don't kick writeback for an IOCB_DONTCACHE write on an inode that
      has no wb yet. With cgroup writeback an O_DIRECT RWF_DONTCACHE
      write to a block device dereferenced NULL

 - statmount/listmount/listns:

    - Refuse statmount() string requests with a buffer that isn't larger
      than struct statmount

    - Don't wrap around with a U64_MAX cursor in listmount() and
      listns()

    - Don't end listns() at an inactive namespace

    - Only add init_ipc_ns and init_net to the namespace trees if
      CONFIG_IPC_NS and CONFIG_NET_NS are enabled

 - iomap:

    - Only mark blocks uptodate in __iomap_write_begin() after reading
      them and let __iomap_write_end() mark the zeroed blocks uptodate
      once the copy from userspace succeeded

    - Check a chunk against max_integrity_io_size() on its own before
      the bio size check

    - Only enforce block alignment for direct I/O into holes and
      unwritten extents if IOMAP_DIO_FSBLOCK_ALIGNED is set

 - backing-file:

    - Check S_APPEND and S_IMMUTABLE on the backing inode. FUSE
      passthrough opens the backing file with vfs_open() which skips
      may_open(), so anyone who may open the FUSE file for writing could
      overwrite an append-only backing file anywhere or write to an
      immutable one. Open, mmap and writes now check the backing inode
      the way may_open() and do_mmap() do

    - Always call kiocb_end_write() for a queued write

    - Let backing files inherit FMODE_NONOTIFY from the user file. The
      event fds fanotify creates for permission events on a stacked
      filesystem raised FS_OPEN_PERM on the real path from inside the
      listener's read() and deadlocked listeners with marks on both
      layers

 - pidfs:

    - Look the task up before checking for exit information in
      PIDFD_GET_INFO and start over if the task no longer owns the pid
      once all fields have been read. A caller racing release_task() got
      neither PIDFD_INFO_PID nor PIDFD_INFO_EXIT or ESRCH although the
      exit information was available, and a caller racing a sub-thread's
      exec reported that thread's tid as the pid

    - Clear the mask bits of fields that lie beyond the struct size the
      caller passed. The uapi header promises that the mask names no
      such field but a caller passing PIDFD_INFO_SIZE_VER0 got the
      coredump and supported mask bits set for fields that were never
      written

 - aio:

    - Give the aio ring a ->read_folio that fails with EIO so a fault on
      a ring whose file was truncated gets SIGBUS instead of jumping to
      NULL

    - Check nr_events against the ring size before doubling it in
      ioctx_alloc()

 - splice:

    - Only write back an implicit file position in do_splice() when the
      splice helper succeeded. splice doesn't take f_pos_lock so a
      failed splice restored a stale snapshot over a position that a
      concurrent getdents() had moved. On ext2 the next readdir then
      trusted an offset inside a directory entry

    - Retry tee() when the input pipe was emptied or the output pipe
      filled between the prep steps and link_pipe() instead of returning
      0 while the input pipe still has writers, as splice_pipe_to_pipe()
      does

 - ucount:

    - Take the reference that pins a ucounts level on the 0 -> 1
      transition before checking the rlimit

    - Read the parent ucounts before dropping the rlimit count in
      do_dec_rlimit_put_ucounts()

 - inode:

    - Rotate inodes whose page cache couldn't be dropped to the tail of
      the LRU

    - Skip inodes that another LRU walker is isolating

 - setns:

    - Set nsset->flags before anything in prepare_nsset() can fail so
      the error path drops the cred prepared for CLONE_NEWUSER. A
      failing setns() with CLONE_NEWUSER and CLONE_NEWNS leaked it
      together with its user namespace

    - Refuse setns(CLONE_NEWNS) for a task that shares its fs_struct
      again when more namespaces are requested

 - minix:

    - Restore uptodate on the pinned bitmap buffers before redirtying
      them after a failed writeback instead of tripping the warning in
      mark_buffer_dirty(), as ext2 and ext4 do for their superblock
      buffers

    - Reject rmdir() of a directory with a corrupted link count with
      EFSCORRUPTED instead of hitting the drop_nlink() warning

 - userns: Keep the exec securebits and their locks when creating or
   joining a user namespace. set_cred_user_ns() reset all securebits to
   SECUREBITS_DEFAULT so anyone who may create a user namespace could
   shed SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE with
   a single unshare(CLONE_NEWUSER)

 - fs: Honor FOP_UNSIGNED_OFFSET in sys_llseek() and in the pread64(),
   pwrite64(), preadv() and pwritev() wrappers

 - proc/kcore: Advance the vmalloc retry in read_kcore_iter() by the
   last vread_iter() copy instead of the running total

 - eventpoll: Return the error when the wakeup source for EPOLLWAKEUP
   can't be created in EPOLL_CTL_MOD instead of reporting success
   without suspend protection

 - coredump: Mark do_coredump() noinline_for_stack

 - nsfs: Check the trailing bytes of a namespace file handle in bytes
   instead of words

 - netfs: Restore the per-level and per-point decoding of the debug mask

 - exportfs: Release the directory file get_name() opened with
   __fput_sync(). From nfsd's kernel threads the deferred fputs arrived
   faster than delayed_fput retired them and each pinned the directory's
   readdir state, growing unreclaimable slab by about 90 MB per second
   under a parallel tree walk

 - fs: Call ramfs_kill_sb() for a ramfs rootfs. Since rootfs can be
   unmounted as of v7.0 its struct ramfs_fs_info was leaked

 - signal: Check the blocked mask for every entry
   dequeue_synchronous_signal() looks at. The scan could select a
   blocked synchronous signal and deliver it while blocked

 - super: Convert the superblock device table from an rhltable to a
   plain hashtable under a spinlock. This fixes a bug from v7.3 where
   fs_bdev_freeze() froze a btrfs filesystem through a stale member that
   open_ctree() had already released while the freeze was waiting for
   SB_BORN

 - fork: Leave rcu_users at zero until copy_process() can't fail
   anymore. bpf_task_acquire() handed out trusted references to the new
   task from the task_alloc LSM hook and sched_ext's ops.init_task() and
   a failing fork freed the task behind them

 - xattr: Always run cap_convert_nscap() for a security.capability
   write. A zero-length setxattr() skipped it and let an unprivileged
   caller without CAP_SETFCAP or write permission on the file plant an
   empty security.capability xattr that made every execve() of the
   binary fail with EINVAL

 - namei: Skip the S_ISDIR assertion in

 - proc: Refuse to mount on entries below /proc/<pid>/net like fd/,
   fdinfo/ and map_files/. proc_net_d_revalidate() always fails so the
   first lookup by anyone with search permission ran d_invalidate() on
   the dentry and detached every mount on it, locked mounts included

 - libfs: Hold one mount reference for all pins instead of one per pin.
   The pin count is what keeps the mount alive, so the per-pin reference
   only cost a mntget() and a mntput() through
   mntput_no_expire_slowpath() for every debugfs, tracefs, securityfs or
   configfs file that comes and goes

 - iov_iter: Return 0 from iov_iter_alignment() for an empty iterator of
   any type

 - watch_queue: Give info_id its own storage instead of overlaying it
   with rcu_head

 - filelock: Take an active superblock reference while waiting for a
   delegation break. After a lazy umount closing the delegation holder
   could shut down the superblock under the waiter whose final iput()
   then ran shmem_evict_inode() on freed state

 - fs: Skip the copy_file_range() write limit checks when there is no
   data to copy

 - bpf: Allow bpf_d_path() from fentry on filp_close_sync(). Since
   close_range() became synchronous this cycle close(), close_range()
   and the closes on exec and exit no longer go through filp_close().
   fexit stays rejected since the file may be gone by then

 - fs_pin: Dequeue the wait entry unconditionally in pin_kill(). A
   spuriously woken waiter kept its on-stack entry queued, took that as
   proof that the pin was alive and used the freed acct structure when
   umount() of the accounting file raced acct(2)

 - dcache: Don't fail __d_obtain_alias() for an inode without links and
   aliases. The ESTALE check added this cycle broke open_by_handle_at()
   and nfsd file handle decoding on NFS and FUSE where i_nlink is just
   what the server last reported and the handle may well still be valid

 - selftests/ovl: Fix the mountinfo expectations of the detached layer
   test which has failed since it was added

* tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (60 commits)
  fs: don't fail __d_obtain_alias() for unlinked inodes
  ns: don't add init_ipc_ns and init_net without namespace support
  aio: avoid request count overflow in ioctx_alloc()
  selftests/ovl: fix detached layer mountinfo expectations
  bpf: Allow bpf_d_path() from filp_close_sync()
  fs: skip copy_file_range write limits when there is no data
  minix: reject rmdir of a directory with a corrupted link count
  fs_pin: do not trust the pin after a spurious wakeup in pin_kill()
  ucount: read the parent ucounts before dropping the rlimit count
  splice: retry tee() instead of returning 0 when it races
  selftests/pidfd: test that fields beyond the struct size are not reported
  pidfs: do not report fields that do not fit into the caller's struct
  fs: let backing files inherit FMODE_NONOTIFY from the user file
  splice: avoid stale f_pos writeback on error
  backing-file: always end a queued write
  filelock: keep superblock active through delegation wait
  watch_queue: keep info_id separate from rcu_head
  iomap: only follow dio alignment requirement if specified
  iov_iter: fix NULL deref in iov_iter_alignment()
  backing-file: enforce append-only and immutable backing inodes
  ...

set_layers_via_detached_mount_fds was copied from the attached-fd test
and still looks for /tmp paths. Detached open_tree() layers are recorded
by d_path() as upperdir=/upper, workdir=/work, and lowerdir+=/ and
datadir+=/ for each cloned directory. The test has failed since it was
added.

Reported-by: Disha Goel <disgoel@linux.ibm.com>
Link: https://lore.kernel.org/linux-unionfs/20260924112858.51392-2-disgoel@linux.ibm.com
Fixes: ccc829b15d48a ("selftests: add tests for using detached mount with overlayfs")
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Link: https://patch.msgid.link/20261017165103.2450042-1-amir73il@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Pull non-MM updates from Andrew Morton:

 - "ocfs2: exit recovery thread on mount error path" (Joseph Qi):

   Stop OCFS2 recovery before freeing failed-mount state and replay
   slots, closing use-after-free and double-free races. Defer
   suballocator reclaim to break a transaction-lock deadlock with
   dismount.

 - "ocfs2: validate suballoc slot and bit of metadata blocks" (Joseph
   Qi):

   Validate OCFS2 metadata suballocator slots, bits and directory index
   block locations. Reject corrupt metadata with filesystem errors
   instead of BUGs or out-of-bounds accesses.

 - "ocfs2: deal with legacy signed name hash values" (Joseph Qi):

   Restore OCFS2 lookups for non-ASCII names stored with legacy signed
   hashes. Use stored xattr hashes during bucket splits to avoid
   duplicate entries and spurious ENOSPC failures.

 - "ocfs2: stabilize dentry names in file and setattr traces" (Cen
   Zhang):

   Snapshot OCFS2 names during file and setattr tracing to prevent
   rename races using freed storage or mismatched names and lengths.
   Preserve trace formats and the locked release open-count sample.

 - "panic: fix panic_force_cpu= redirect races and NMI bypass" (Bradley
   Morgan):

   Fix panic_force_cpu races and NMI redirection so crash-kernel CPU
   selection is honored. Preserve variable arguments on failed redirects
   and use a static message buffer.

 - "fat: allocate multiple clusters in fallocate" (Matheus Alves de
   Almeida):

   Allocate FAT clusters in batches for FALLOC_FL_KEEP_SIZE and batch
   FAT updates. This removes repeated single-cluster allocation
   overhead, particularly on synchronous mounts.

 - "scripts/gdb: fix radix tree lookup and stack depot diagnostic"
   (Ting-Han Hou):

   Fix GDB radix-tree lookup and its handling of XArray sibling, retry
   and zero entries. Also repair the stack-depot diagnostic for an
   out-of-range pool index.

 - "hung_task: Improve warning budget handling and task reporting"
   (Aaron Tomlin):

   Reset the hung-task warning budget after recovery so later hangs
   remain visible. Keep the configured limit intact and emit one summary
   per scan when detailed reports exhaust the budget.

 - "bootconfig: Reject unexpected data after null character and
   cleanups" (Masami Hiramatsu):

   Reject bootconfig data after an embedded null while accepting
   trailing padding. Validate the full input in the userspace tool, and
   retain internal tree sanity checks there rather than in the kernel.

 - "kbuild: GCOV cleanups following the prefer-atomic fix" (Konstantin
   Khorenko):

   Use the actual GCOV build flags in the prefer-atomic compiler probe.
   Move flag setup into scripts/Makefile.gcov and skip the probe when
   GCOV is disabled.

 - "ocfs2: xattr bucket validation fixes" (Joseph Qi):

   Accept valid OCFS2 xattr buckets spanning 512-byte blocks, avoiding
   false read-only remounts. Reject misaligned buckets and return errors
   instead of panicking on corrupt defrag metadata.

 - "ocfs2: fix metadata reservation for xattr value trees" (Joseph Qi):

   Reserve enough OCFS2 metadata for new and relocated xattr value
   trees. Fix shortfalls which could cause ENOSPC, dropped entries and
   leaked clusters on fragmented filesystems; remove duplicate
   reservations.

 - "Introduce arch_do_panic" (Mete Durlu):

   Add arch_do_panic() and move s390 and sparc handling out of generic
   panic code. The architecture-specific actions now follow the
   end-of-panic marker.

 - "checkpatch: userspace improvements" (Petr Vorel):

   Improve checkpatch's userspace detection and suppress kernel-only
   checks. Recognize standard inttypes macros and add explicit
   --userspace and --no-userspace overrides.

 - "ocfs2: validate dr_fs_generation of dir index root blocks" (Joseph
   Qi):

   Check OCFS2 directory index generations and leaf block numbers.
   Reject stale or misplaced blocks instead of using metadata left by a
   previously formatted filesystem.

 - "selftests/membarrier: Skip an unregistered memory barrier test on
   Musl" (Chris Gellermann):

   Skip the unregistered membarrier test when libc has already
   registered the command. Musl does this during thread creation,
   causing false failures in the multithreaded test.

 - "init: fix array boundary bugs in boot parameter parsing"
   (Wilson Felipe Pereira):

   Fix boot argument boundary cases which leave stale arguments in
   init's command line or panic when replacing the final environment
   variable. Clear the last slot and check duplicates before the limit.

Summary of the 87 singletons in this merge:

  The OCFS2 singletons fix deadlocks between xattr updates and inline
  truncation, and during inode reclaim. Corrupt quota and extent
  metadata could also crash the kernel or corrupt memory; these paths
  now check the layout before using it. Other fixes close use-after-free
  and publication races around cluster reconfiguration, node failure,
  quota remount errors and shared refcount trees. New files now retain
  security labels from all stacked LSMs instead of silently dropping all
  but one. Valid xattr insertions also stop tripping FORTIFY on builds
  with counted arrays.

  Elsewhere, a lost wakeup could leave hardware-monitoring reads stuck
  in unkillable sleep and block further I2C traffic. That is fixed, as
  are kernel memory leaks in POSIX message-queue notifications and tmpfs
  casefold setup which could grow until memory is exhausted. A driver
  removal race which could crash the kernel is fixed too. The
  hibernation command through reboot() also stops taking the same mutex
  twice, avoiding a deadlock before suspension.

  On the boot side, bzip2 decoding now accepts valid full blocks emitted
  by lbzip2, fixing failures to boot those compressed kernels. Malformed
  bzip2 streams can no longer overflow the decode buffer, and LZ4
  initrds are checked before the decoder can read past their end. FAT
  rejects geometry which overflows the data-area calculation on 32-bit
  systems, and rolls back entries when inode setup fails, preventing
  failed creations from reappearing after remount. The x86 XOR and RAID6
  AVX paths also avoid imposing a slowdown on subsequent SSE code.

* tag 'mm-nonmm-stable-2026-10-25-14-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (134 commits)
  scripts/gdb: fix stack depot out-of-bounds diagnostic
  scripts/gdb: fix radix tree lookup pointer handling
  ocfs2/cluster: remove zero-address nodes from IP tree on teardown
  ocfs2: snapshot the dentry name while tracing file release
  ocfs2: snapshot dentry names in file and setattr traces
  ocfs2/dlm: drain join handlers before releasing module text
  MAINTAINERS: update Markus's e-mail address
  mailmap: add entries for Andrew Jones
  stackdepot: stop preallocating after the final pool
  ocfs2: drain quorum work before removing the cluster
  watchdog: force console verbose when reporting lockups
  profiling: fix sampling step on 64-bit big-endian systems
  kernel/reboot: avoid potential deadlocks during suspension
  compat: avoid double rounding in times()
  ocfs2: pin owning modules for open debugfs files
  ocfs2/cluster: initialize heartbeat regions before publishing them
  selftests/proc: proc-pid-vm: fix unused variable warning on non-x86
  ocfs2: pin refcount trees before dropping the lookup lock
  ocfs2: validate the xattr tree root of an indexed xattr block
  ocfs2/dlm: hold the lookup reference across convert AST enqueue
  ...

Pull fuse updates from Miklos Szeredi:

 - Add dax backing and extent map support for famfs (John Groves,
   Miklos)

 - Support large folios (Joanne)

 - Add selftests and documentation of caching behavior (Luis Henriques)

 - Add FUSE_SYNCFS request (Jimmy Zuber)

 - Convert readdir cache to use folios (Tal Zussman)

 - Lots of bug fixes

* tag 'fuse-update-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (53 commits)
  fuse: handle extent map files in fuse_passthrough_fadvise()
  fuse: resolve extent maps in O(1) when possible
  fuse: add support for striped backing
  fuse: add extent map I/O support
  fuse: add extent map data structure
  fuse: add support for opening dax device as backing
  fuse: support opening 64 bit backing ID
  fuse: support 64 bit, server allocated backing ID
  fuse: add helpers for EIO return value with kernel message
  dax: use READ_ONCE() in dax_holder()
  dax: add fsdev_dax_from_file()
  fuse: fix copy_file_range reply handling race
  virtiofs: validate fixed-output response length
  fuse: don't d_drop() before d_splice_alias()
  virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree
  fuse: validate folio state before pipe_buf_try_steal() in fuse_try_move_folio()
  fuse: rename fuse_direct_io() to fuse_do_direct_io()
  fuse: Forward vfs_fadvise to backing_file in passthrough mode
  selftests/fuse: add the missing FUSE_HAS_SYNCFS privilege test
  fuse: don't launder folios of a bad inode
  ...

Pull Char/Misc/IIO/others driver updates from Greg KH:
 "Here is the big set of char/misc/android/iio and other small driver
  subsystem patches for 7.4-rc1. Loads of stuff in here, larger than
  normal. Highlights include:

   - removal of the C binder code, the rust version is stable and will
     be used going forward in a few billion devices. Great job by those
     developers

   - loads and loads of IIO driver updates and feature additions

   - speakup driver fixes and updates

   - mhi driver updates

   - mei driver updates

   - xillybus driver fixes

   - comedi driver fixes

   - lots of coresight driver updates

   - Interconnect driver updates

   - nvmem driver updates and fixes

   - slimbus driver updates and fixes

   - spmi driver updates and fixes

   - lots of tiny misc and char driver fixes based on people scanning
     for things

  All of these have been in linux-next for a while with no reported
  issues, other than a merge conflict with one of the rust tree files,
  which should be simple to resolve"

* tag 'char-misc-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (446 commits)
  rust_binder: wake epoll on self-work queued to poll thread
  rust_binder: avoid overflow in get_node_debug_info()
  MAINTAINERS: Add Abel as SPMI co-maintainer
  spmi: mtk-pmif: Fix clock reference leak in mtk_spmi_bus_probe()
  iio: adc: qcom-spmi-iadc: Remove regmap R/W wrapper functions
  iio: adc: qcom-spmi-iadc: Migrate to devm_spmi_subdevice_alloc_and_add()
  misc: qcom-coincell: Migrate to devm_spmi_subdevice_alloc_and_add()
  phy: qualcomm: eusb2-repeater: Migrate to devm_spmi_subdevice_alloc_and_add()
  power: reset: qcom-pon: Migrate to devm_spmi_subdevice_alloc_and_add()
  nvmem: qcom-spmi-sdam: Migrate to devm_spmi_subdevice_alloc_and_add()
  spmi: Add helper to get a parent SPMI device
  spmi: Implement spmi_subdevice_alloc_and_add() and devm variant
  spmi: Remove unneeded goto in spmi_device_add() error path
  spmi: Print error status with %pe format
  spmi: Remove redundant dev_name() print in spmi_device_add()
  spmi: Fix potential use-after-free by grabbing of_node reference
  spmi: mtk-pmif: Add workaround for FSM lockup/error in read operation
  MAINTAINERS: Add Qualcomm SPMI controller entry
  spmi: pmic-arb: return 0 in spmi_pmic_arb_register_buses() on success
  comedi: addi_apci_3xxx: fix subdevice count underallocation
  ...

Pass the largest possible mount id as the cursor and check that
listmount() returns no entries instead of starting over at the first
mount.

Link: https://patch.msgid.link/20261021-work-mount-statmount_listns_fixes-v1-4-8917a4c1bd14@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>