Pull USB / Thunderbolt fixes from Greg KH:
 "Here are some small USB and Thunderbolt driver fixes for 7.2-rc7 that
  resolve some reported issues. Included in here are:

   - new quirk for some broken USB devices

   - thunderbolt device fixes for reported issues

   - usb gadget driver fix

   - usb atm driver fix

   - xhci driver fixes.

   - other minor USB driver fixes

  All of these have been in linux-next this week with no reported
  issues"

* tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask
  usb: quirks: Add ShanWan gamepad to quirk list
  usb: hub: Split announce_device() to log device identity before enumeration
  usb: core: Add quirk for 255-bytes initial config read
  usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
  usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
  usb: gadget: f_ncm: Use unsigned int for ndp_index
  usb: cdnsp: fix incorrect endian conversions for APB timeout register
  thunderbolt: Initialize ->domain_released completion before it is being used
  thunderbolt: icm: Preserve USB4 proxy data-valid bit
  thunderbolt: Bound the DROM dual link port number before indexing sw->ports
  thunderbolt: Fix bandwidth group reservation indexing
  thunderbolt: stream: Unmap buffers with mapped size

Pull char / misc and documentation fixes from Greg KH:
 "Here are some small char/misc and nvmem and documentation fixes for
  7.2-rc7 to resolve some reported issues.  Included in here are:

   - updates to the documentation for the kernel threat model and
     security bugs to get the LLMs to actually follow what we have been
     asking them to do (i.e. not claim security issues for things we do
     not consider security issues.)

   - nvmem driver fixes which required a tiny "layout" driver to be
     added.

   - fastrpc driver fixes

   - mei driver fix

   - counter driver fix

   - binder driver fix

  All of these have been in linux-next this week with no reported
  problems"

* tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  docs: security-bugs: clarify some mandatory steps for AI reports
  docs: coding-assistant: explain important steps when looking for bugs
  docs: security-bugs: clarify what counts as a valid version
  docs: threat-model: move fake devices out of "non production use"
  docs: threat-model: clarify "security bug" vs "vulnerability"
  counter: microchip-tcb-capture: Fix DT channel validation
  mei: pull kvfree out of spinlock
  rust_binder: do not query current thread for all ioctls
  nvmem: layouts: Add fixed-layout driver
  nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
  misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
  misc: fastrpc: fix channel ctx ref leak when session alloc fails
  misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
  misc: fastrpc: Remove buffer from list prior to unmap operation
  misc: fastrpc: Fix initial memory allocation for Audio PD memory pool

Pull networking fixes from Jakub Kicinski:
 "Including fixes from netfilter.

  Looks like our attempt to keep the PRs smaller have only prevented
  this one from getting even bigger. In the last 9 days there were
  405 postings explicitly tagged with [PATCH net], vs 687 with [PATCH
  net-next]. 37% of posted patches being fixes is pretty crazy, and
  that's likely undercounting because LLM "researchers" more often post
  fixes without knowing to tag the patches for specific trees. I don't
  have historic data.

  In any case, we keep adjusting the criteria. The next PR will be
  smaller.

  Current release - regressions:

   - net: defer netdev KOBJ_ADD uevent until the device is published,
     previously rtnl_lock would serialize the accesses vs publishing

   - net: explicitly cancel work to avoid races with ref tracker exit

   - qrtr: ns: raise lookup limit to 128

   - eth: hns3: fix speed configuration residue after driver reload

  Previous releases - regressions:

   - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss(), regressed
     flows with MSS and scaling_ratio variability

   - Revert "net: thunderbolt: Enable end-to-end flow control also in
     transmit", broke some platforms (no packets coming thru)

   - eth: stmmac: resume PHY before hardware setup when opening the
     interface

  Previous releases - always broken:

   - another pile of fixes for less common protocols (SCTP, TLS, SMC
     etc.)

   - close a couple of AF_PACKET bugs and ways it can build skbs
     problematic for the rest of the stack

   - bridge: mrp: fix uninitialised bytes on the wire

   - net: devmem: prevent net-iov / page mixing, avoid crashes

   - eth: atlantic: free RX pages of consumed but not refilled buffers"

* tag 'net-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (116 commits)
  igc: fix netdev not re-attached after resume if interface is down
  tls: don't abort the connection on signal-interrupted sends
  net: avoid theoretical races with ref drain
  net: Defer netdev KOBJ_ADD uevent until the device is published
  MAINTAINERS: dpll: zl3073x: replace Prathosh Satish with Min Li
  sctp: clear control chunk transport if it is being removed
  net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
  s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
  packet: use consistent hard_header_len in TX_RING send path
  packet: use consistent hard_header_len in non-ring send paths
  net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
  bnge: Fix resource leak in bnge_init_nic() error path
  ptp: ocp: Fix board ID over-read
  tls: rx: restore msg_iter before TLS 1.3 optimistic retry
  selftests: tls: add a test for splicing onto a full plaintext record
  tls: don't leave a full plaintext sk_msg ring unpushed
  xdp: reject clones that overrun skb_shared_info tailroom
  mptcp: reclaim forward-allocated memory on RX path errors
  mptcp: fastopen: only mark MPTFO subflows with SYN data
  mptcp: pm: fix memory leak from alloc-during-teardown race
  ...

Antonio Quartulli says:

====================
Included fixes:

* use rcu_dereference_bh() instead of rcu_access_pointer() where the
  pointer is actually dereferenced
* ensure TCP global variables are initialized before they can be
  accessed via netlink (e.g. when attaching a TCP socket)
* actually disable IPv4 redirects on multipeer interfaces (the
  previous attempt was a no-op and did not survive netns moves)
* hash a floated peer by its transport identity only, consistently
  with the add and lookup paths
* zero the sockaddr padding before learning a floated endpoint so it
  does not leak into the by_transp_addr hash key
* ensure the socket is owned by ovpn before dereferencing
  sk_user_data
* rehash a peer in the by_transp_addr table when its remote endpoint
  is updated via CMD_PEER_SET
* avoid re-adding to the hashtables a peer that was concurrently
  removed (use-after-free)
* limit keepalive values to one day to avoid overflowing the
  delayed-work delay on 32-bit systems
* add the missing rtnl_link_ops->get_size callback so link messages
  account for the nested mode attribute

* tag 'ovpn-net-20260730' of https://github.com/OpenVPN/ovpn-net-next:
  ovpn: fix incorrect use of rcu_access_pointer()
  ovpn: ensure TCP vars are initialized first
  ovpn: disable IPv4 redirects on MP interfaces
  ovpn: hash floated peer by transport identity only
  ovpn: zero-initialize sockaddr before learning a floated endpoint
  ovpn: ensure socket is owned by ovpn before deref sk_user_data
  ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET
  ovpn: skip rehash for peers already removed from by_id
  ovpn: limit keepalive values to one day
  ovpn: add missing rtnl_link_ops->get_size callback
====================

Link: https://patch.msgid.link/20260730094624.4102963-1-antonio@openvpn.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

The security team is still seeing a lot of reports lacking a full patch
and showing missing contents and formatting issues. Since AI assistants
tend to be better than humans at following instructions, let's defer to
coding-assistants.rst to follow mandatory steps, and insist on the plain
text format, as well as asking for recipient addresses and an e-mail
client setup hint to be mentioned early in the report for the reporter.

Also add a link to https://github.com/masoncl/kres.git which contains
way more advanced and detailed steps for those willing to go further.

Tested with Opus-5 and Qwen3.6-27B-Architect-Polaris2-Fable-B-F451, both
of which proceeded according to instructions.

Cc: Greg KH <greg@kroah.com>
Cc: Chris Mason <clm@meta.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Link: https://patch.msgid.link/20260802203540.3453-6-w@1wt.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Due to the increasing capabilities of available AI models, it's becoming
common to see them used to find bugs anywhere. Unfortunately the quality
of reports (especially when they're believed to be security relevant) is
still lacking a lot.

Let's add a section dedicated to bug finding, explaining the few
mandatory steps (noting commit ID, writing the fix from the session that
found the bug, building and testing, etc). This was tested both against
Qwen3.6-27B-Architect-Polaris2-Fable-B-F451 running under Hermes, and
Opus-5, and both followed the instructions to the letter, verifying
their results and checking threat-model.rst to decline the vulnerability
aspect. At least in the current form it's expected to improve the
situation a little bit.

Cc: Greg KH <greg@kroah.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Link: https://patch.msgid.link/20260802203540.3453-5-w@1wt.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Too often we're getting reports saying "still valid in latest mainline"
with no indication of when this was verified, making this indication
pointless. Let's clarify it and insist on having a version or commit ID,
and that the version must necessarily be for a kernel.org kernel and not
a distro one.

Cc: Greg KH <greg@kroah.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Link: https://patch.msgid.link/20260802203540.3453-4-w@1wt.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

When originally writing the "fake USB device" entry, it was difficult
to find a suitable section for it and it ended up in "non production
use" but that doesn't fit particularly well. Actually it's very similar
to crafted filesystems, it's a matter of spec violation. Both drivers
and FS are written against a spec, and what the threat model doesn't
cover is out-of-spec use. So let's move the entry there and rename the
crafted FS entry to "Non-conforming devices and media" instead.

Overall it looks more consistent.

The spec was tested agains Qwen3.6-27B-Architect-Polaris2-Fable-B-F451,
Opus-5 and Gemini by reading the threat-model file, then reading a tens
of FS and driver fixes, and they were now all properly classified as
regular bugs, except two that Gemini and Opus rightfully classified as
vulns (Qwen didn't spot the security potential but that's out of our
scope).

Cc: Greg KH <greg@kroah.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Link: https://patch.msgid.link/20260802203540.3453-3-w@1wt.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Throwing an LLM (Opus 5) at a file looking for random bugs after having
read the threat model made it ignore certain bugs it found because "the
threat model said they must be ignored". When asked why, the LLM
rightfully reported the ambiguous wording used at a few places:
"is not a security bug", which can also be read as "is not a bug",
despite the rest of the document. That is particularly true when the
LLM decides to look for info using grep.

This change replaces "security bug" with "vulnerability" at a few places
in order to remove this identified ambiguity, and uses "bugs" instead of
issues in two such sentences to insist that what is described remains a
bug.

Cc: Greg KH <greg@kroah.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Link: https://patch.msgid.link/20260802203540.3453-2-w@1wt.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull cgroup fixes from Tejun Heo:

 - A pressure trigger's poll timer could be re-armed while the last
   trigger was being torn down and then fire after the cgroup was freed.

   Tie the timer to the cgroup's lifetime and shut it down when the
   cgroup is freed.

 - Writing to a pressure file forked a worker kthread while holding the
   cgroup mutex, creating lock dependencies from the mutex to the whole
   fork path. A pressure write racing a sched_ext scheduler enable,
   which blocks forks before grabbing the mutex, deadlocked.

   Fork the worker with the mutex dropped.

 - Documentation fix for io.latency behavior on non-rotational devices.

* tag 'cgroup-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  Docs/admin-guide/cgroup-v2: document io.latency rotational vs non-rotational behavior
  sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
  sched/psi: Create the psimon kthread outside of cgroup_mutex