Pull generic phy driver fixes from Vinod Koul:

 - Qualcomm repeater override properties, qmp pcie bindings fix for
   clocks and initialization sequence for firmware power down case

 - Marvell comphy bindings clock and child node constraints

 - Tegra xusb device reference leaks fix

 - TI omap usb device ref leak on unbind and RGMII IS settings fix

* tag 'phy-fix-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
  phy: qcom: qmp-pcie: Fix PHY initialization when powered down by firmware
  phy: ti: gmii-sel: Always write the RGMII ID setting
  dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Update pcie phy bindings
  phy: ti-pipe3: fix device leak at unbind
  phy: ti: omap-usb2: fix device leak at unbind
  phy: tegra: xusb: fix device and OF node leak at probe
  dt-bindings: phy: marvell,comphy-cp110: Fix clock and child node constraints
  phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties

Pull dmaengine fixes from Vinod Koul:

 - Intel idxd fixes for idxd_free() handling, refcount underflow on
   module unload, double free in idxd_setup_wqs()

 - Qualcomm bam dma missing properties and handing for channels with ees

 - dw device reference leak in rzn1_dmamux_route_allocate()

* tag 'dmaengine-fix-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
  dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate
  dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
  dmaengine: idxd: Fix double free in idxd_setup_wqs()
  dmaengine: idxd: Fix refcount underflow on module unload
  dmaengine: idxd: Remove improper idxd_free
  dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
  dt-bindings: dma: qcom: bam-dma: Add missing required properties

Pull tty/serial fixes from Greg KH:
 "Here are some small tty and serial driver fixes for 6.17-rc6 that
  resolve some reported problems. Included in here are:

   - 8250 driver dt bindings fixes

   - broadcom serial driver binding fixes

   - hvc_console bugfix

   - xilinx serial driver bugfix

   - sc16is7xx serial driver bugfix

  All of these have been in linux-next for the past week with no
  reported issues"

* tag 'tty-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: xilinx_uartps: read reg size from DTS
  tty: hvc_console: Call hvc_kick in hvc_write unconditionally
  dt-bindings: serial: 8250: allow "main" and "uart" as clock names
  dt-bindings: serial: 8250: move a constraint
  dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
  serial: sc16is7xx: fix bug in flow control levels init

Pull USB fixes from Greg KH:
 "Here are some small USB driver fixes and new device ids for 6.17-rc6.
  Included in here are:

   - new usb-serial driver device ids

   - dummy-hcd locking bugfix for rt-enabled systems (which is crazy,
     but people have odd testing requirements at times...)

   - xhci driver bugfixes for reported issues

   - typec driver bugfix

   - midi2 gadget driver bugfixes

   - usb core sysfs file regression fix from -rc1

  All of these, except for the last usb sysfs file fix, have been in
  linux-next with no reported issues. The sysfs fix was added to the
  tree on Friday, and is "obviously correct" and should not have any
  problems either, it just didn't have any time for linux-next to pick
  up (0-day had no problems with it)"

* tag 'usb-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: core: remove the move buf action
  usb: gadget: midi2: Fix MIDI2 IN EP max packet size
  usb: gadget: midi2: Fix missing UMP group attributes initialization
  usb: typec: tcpm: properly deliver cable vdms to altmode drivers
  USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
  xhci: fix memory leak regression when freeing xhci vdev devices depth first
  xhci: dbc: Fix full DbC transfer ring after several reconnects
  xhci: dbc: decouple endpoint allocation from initialization
  USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
  USB: serial: option: add Telit Cinterion FN990A w/audio compositions

Pull input fixes from Dmitry Torokhov:

 - a quirk to i8042 for yet another TUXEDO laptop

 - a fix to mtk-pmic-keys driver to properly handle MT6359

 - a fix to iqs7222 driver to only enable proximity interrupt
   if it is mapped to a key or a switch event

 - an update to xpad controller driver to recognize Flydigi Apex 5
   controller

 - an update to maintainers file to drop bounding entry for Melfas
   touch controller

* tag 'input-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  MAINTAINERS: Input: Drop melfas-mip4 section
  Input: mtk-pmic-keys - MT6359 has a specific release irq
  Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
  Input: iqs7222 - avoid enabling unused interrupts
  Input: xpad - add support for Flydigi Apex 5

Pull regulator fix from Mark Brown:
 "One fix for sy7636a which got confused about which device to use to
  manage the lifecycle of the power good GPIO because it's looked up
  from the parent device due to the way DT bindings work"

* tag 'regulator-fix-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: sy7636a: fix lifecycle of power good gpio

Pull pci fix from Bjorn Helgaas:

 - Fix mvebu PCI enumeration regression caused by converting to
   for_each_of_range() iterator (Klaus Kudielka)

* tag 'pci-v6.17-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  PCI: mvebu: Fix use of for_each_of_range() iterator

Pull drm fixes from Dave Airlie:
 "Weekly pull fixes for drm, mostly amdgpu and xe, with a revert for
  nouveau and some maintainers updates, and misc bits, doesn't seem too
  out of the normal.

  MAINTAINERS:
   - add rust tree to MAINTAINERS
   - fix X entries for nova/nouveau

  nova:
   - depend on 64-bit

  i915:
   - Fix size for for_each_set_bit() in abox iteration

  xe:
   - Don't touch survivability_mode on fini
   - Fixes around eviction and suspend
   - Extend Wa_13011645652 to PTL-H, WCL

  amdgpu:
   - PSP 11.x fix
   - DPCD quirk handing fix
   - DCN 3.5 PG fix
   - Audio suspend fix
   - OEM i2c clean up fix
   - Module unload memory leak fix
   - DC delay fix
   - ISP firmware fix
   - VCN fixes

  amdkfd:
   - P2P topology fix
   - APU mem limit calculation fix

  mediatek:
   - fix potential OF node use-after-free

  panthor:
   - out-of-bounds check

  nouveau:
   - revert waitqueue removal for sched teardown

* tag 'drm-fixes-2025-09-12' of https://gitlab.freedesktop.org/drm/kernel: (25 commits)
  MAINTAINERS: drm-misc: fix X: entries for nova/nouveau
  drm/mediatek: clean up driver data initialisation
  drm/mediatek: fix potential OF node use-after-free
  drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
  drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
  drm/amd/amdgpu: Declare isp firmware binary file
  drm/amd/display: use udelay rather than fsleep
  drm/amdgpu: fix a memory leak in fence cleanup when unloading
  drm/xe: Extend Wa_13011645652 to PTL-H, WCL
  drm/xe: Block exec and rebind worker while evicting for suspend / hibernate
  drm/xe: Allow the pm notifier to continue on failure
  drm/xe: Attempt to bring bos back to VRAM after eviction
  drm/xe/configfs: Don't touch survivability_mode on fini
  amd/amdkfd: correct mem limit calculation for small APUs
  drm/amdkfd: fix p2p links bug in topology
  drm/amd/display: remove oem i2c adapter on finish
  drm/amd/display: Drop dm_prepare_suspend() and dm_complete()
  drm/amd/display: Correct sequences and delays for DCN35 PG & RCG
  drm/amd/display: Disable DPCD Probe Quirk
  drm/i915/power: fix size for for_each_set_bit() in abox iteration
  ...

The buffer size of sysfs is fixed at PAGE_SIZE, and the page offset
of the buf parameter of sysfs_emit_at() must be 0, there is no need
to manually manage the buf pointer offset.

Fixes: 711d41ab4a0e ("usb: core: Use sysfs_emit_at() when showing dynamic IDs")
Reported-by: syzbot+b6445765657b5855e869@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b6445765657b5855e869
Tested-by: syzbot+b6445765657b5855e869@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Link: https://lore.kernel.org/r/tencent_B32D6D8C9450EBFEEE5ACC2C7B0E6C402D0A@qq.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Johan writes:

USB serial device ids for 6.17-rc6

Here are some new modem device ids.

Everything has been in linux-next with no reported issues.

* tag 'usb-serial-6.17-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:
  USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
  USB: serial: option: add Telit Cinterion FN990A w/audio compositions