* Re: Request for review for 4.4-st80, 4.4-cip115 (sit down for this one)
2026-09-22 15:51 Request for review for 4.4-st80, 4.4-cip115 (sit down for this one) Ulrich Hecht
@ 2026-09-24 11:53 ` Pavel Machek
2026-09-24 11:59 ` [cip-dev] " Ulrich Hecht
2026-10-01 11:55 ` Pavel Machek
` (2 subsequent siblings)
3 siblings, 1 reply; 6+ messages in thread
From: Pavel Machek @ 2026-09-24 11:53 UTC (permalink / raw)
To: Ulrich Hecht
Cc: cip-dev@lists.cip-project.org, pavel@nabladev.com,
nobuhiro.iwamatsu.x90@mail.toshiba
[-- Attachment #1: Type: text/plain, Size: 2456 bytes --]
Hi!
> Here are the manual backports for the upcoming 4.4 kernel release. As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.4.y-st-rc
>
> There's a total of 87; 13 by me, and 74 by LLM. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8".)
> Total manual backport ratio is 21%, slightly down from 22% for st79.
>
> Speak up if you find a class of patches in here that we should not
> consider for backporting in the future.
It seems commit ids no longer match what is in the tree.
First third of patches looks good, I believe one will cause
compilation fail.
Best regards,
Pavel
a an API change, hopefully noone depends on that bug > d482fcdcb9cf5 net: ipip: require CAP_NET_ADMIN in the device netns for changelink
a an API change, hopefully noone depends on that bug > 9447834f71856 net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
a an API change, hopefully noone depends on that bug> 66b209be16611 net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
a > f5d2ad74edde2 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
a just a robustness against fs corruption > 4acc604700f7f ocfs2: reject non-inline dinodes with i_size and zero i_clusters
This will need to be del_timer_sync(), AFAICT.
!! timer_delete_sync does not exist in 4.4 > 33b3774667584 wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
a just a WARN removal > 15fd6b8ab4e3f net: remove WARN_ON_ONCE() from sk_mc_loop()
a > f50d09ccb2a3c net: openvswitch: fix skb leak on flow key update failure during recirculation
a just a robustness against out-of-tree users > f0bb3b226b24d audit: fix potential integer overflow in audit_log_n_string()
a just a preparation > 1e58c90011532 skbuff: introduce skb_pull_data
a > 8a27878187716 tipc: prevent snt_unacked underflow on CONN_ACK
a > 9681717544d1f ipv6: mcast: Fix potential UAF in MLD delayed work
a > e3b1657d6d49f vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
a > ab0f8bfb5b96d xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
a > 1ee9bb33f50c5 btrfs: do not trim a device which is not writeable
a > 210f49c16babe HID: appleir: fix UAF on pending key_up_timer in remove()
a > f762e427204a5 netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
a > 104e962c0778d Bluetooth: fix UAF in bt_accept_dequeue()
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: Request for review for 4.4-st80, 4.4-cip115 (sit down for this one)
2026-09-22 15:51 Request for review for 4.4-st80, 4.4-cip115 (sit down for this one) Ulrich Hecht
2026-09-24 11:53 ` Pavel Machek
@ 2026-10-01 11:55 ` Pavel Machek
2026-10-01 23:44 ` nobuhiro.iwamatsu.x90
2026-10-05 17:18 ` Pavel Machek
3 siblings, 0 replies; 6+ messages in thread
From: Pavel Machek @ 2026-10-01 11:55 UTC (permalink / raw)
To: Ulrich Hecht
Cc: cip-dev@lists.cip-project.org, pavel@nabladev.com,
nobuhiro.iwamatsu.x90@mail.toshiba
[-- Attachment #1: Type: text/plain, Size: 3473 bytes --]
Hi!
> Here are the manual backports for the upcoming 4.4 kernel release. As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.4.y-st-rc
>
> There's a total of 87; 13 by me, and 74 by LLM. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8".)
> Total manual backport ratio is 21%, slightly down from 22% for st79.
>
> Speak up if you find a class of patches in here that we should not consider for backporting in the future.
>
Some remarks below, but these look good.
Best regards,
Pavel
a > 160be80dcaa57 i2c: core: fix adapter registration race
a just a API fix > 023c8f3acebcc net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
a > b8b285996937e smb: client: restrict implied bcc[0] exemption to responses without data area
a > 62b9455b524a2 ftrace: Add global mutex to serialize trace_parser access
a > 18e1b6863f2a2 wifi: ath6kl: fix use-after-free in aggr_reset_state()
a turns a bug into a WARN > c5d53c4091d2c libceph: Avoid using invalid osd indices from primary_temp
a mostly a robustness against strange hw > 02be6f188f65b thunderbolt: Bound the DROM dual link port number before indexing sw->ports
a > 06b62f64d461a tipc: read le->link under the node lock in tipc_node_link_down()
a > 231cd04749bc8 ipv6: prevent in6_dev_get() from resurrecting inet6_dev
a patch is now very different > 5b8317d3c81a7 serial: 8250_dma: Clear stale RX state on shutdown
a > 00114c782ae76 net/sched: cls_route: fix fastmap use-after-free on filter
! we are not doing nfs_sb_deactive or nfs_put_client in error path, but neither does mainline > f2bc9e8652686 nfs4: take a reference on the nfs_client when running FREE_STATEID
a > 334d24ff159be Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
a just a robustness against bad hw > 483db7203c062 can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
a > c58ecae06d669 sctp: reject stale cookies with mismatched verification tags
a > a913bd184e356 net: sxgbe: check descriptor ring allocation failures
a > f6fa91ea743e3 libceph: Fix multiplication overflow in decode_new_up_state_weight()
a > 2952ef3847619 can: bcm: add missing device refcount for CAN filter removal
Okay, but code in bcm_rx_setup() is now quite strange.
- op->rx_reg_dev = dev;
+ /* keep a reference so that a later
+ * unregister can safely reach the device even
+ * if a concurrent NETDEV_UNREGISTER has
+ * already unlisted it by ifindex
+ */
+ if (!err) {
+ op->rx_reg_dev = dev;
+ dev_hold(dev);
+ }
dev_put(dev);
Minimal fix would be
op->rx_reg_dev = dev;
- dev_put(dev);
+ if (err) dev_put(dev);
a > f4fa2f7f36f2e sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
a just a robustness against bad firmware > 0c6142e6d67bb wifi: mwifiex: bound uAP association event IEs to the event buffer
a > 41cfceccec572 net/packet: avoid fanout hook re-registration after unregister
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread* RE: Request for review for 4.4-st80, 4.4-cip115 (sit down for this one)
2026-09-22 15:51 Request for review for 4.4-st80, 4.4-cip115 (sit down for this one) Ulrich Hecht
2026-09-24 11:53 ` Pavel Machek
2026-10-01 11:55 ` Pavel Machek
@ 2026-10-01 23:44 ` nobuhiro.iwamatsu.x90
2026-10-05 17:18 ` Pavel Machek
3 siblings, 0 replies; 6+ messages in thread
From: nobuhiro.iwamatsu.x90 @ 2026-10-01 23:44 UTC (permalink / raw)
To: uli, cip-dev, pavel
Hi Uli,
> -----Original Message-----
> From: Ulrich Hecht <uli@fpond.eu>
> Sent: Wednesday, September 23, 2026 12:52 AM
> To: cip-dev@lists.cip-project.org; pavel@nabladev.com; iwamatsu nobuhiro(岩
> 松 信洋 □ＤＩＴＣ○ＣＰＴ) <nobuhiro.iwamatsu.x90@mail.toshiba>
> Subject: Request for review for 4.4-st80, 4.4-cip115 (sit down for this one)
>
> Hi!
>
> Here are the manual backports for the upcoming 4.4 kernel release. As always
> they can be found in
> https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linu
> x-4.4.y-st-rc
>
> There's a total of 87; 13 by me, and 74 by LLM. (The latter are labeled with
> "Assisted-by: SLTR:qwen-3.8".) Total manual backport ratio is 21%, slightly
> down from 22% for st79.
>
> Speak up if you find a class of patches in here that we should not consider for
> backporting in the future.
>
> d482fcdcb9cf5 net: ipip: require CAP_NET_ADMIN in the device netns for
> changelink
> 9447834f71856 net: ip6_tunnel: require CAP_NET_ADMIN in the device netns
> for changelink
> 66b209be16611 net: ip_vti: require CAP_NET_ADMIN in the device netns for
> changelink
> f5d2ad74edde2 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
> 4acc604700f7f ocfs2: reject non-inline dinodes with i_size and zero i_clusters
> 33b3774667584 wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
> 15fd6b8ab4e3f net: remove WARN_ON_ONCE() from sk_mc_loop()
> f50d09ccb2a3c net: openvswitch: fix skb leak on flow key update failure during
> recirculation f0bb3b226b24d audit: fix potential integer overflow in
> audit_log_n_string()
> 1e58c90011532 skbuff: introduce skb_pull_data
> 8a27878187716 tipc: prevent snt_unacked underflow on CONN_ACK
> 9681717544d1f ipv6: mcast: Fix potential UAF in MLD delayed work
> e3b1657d6d49f vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve
> packets ab0f8bfb5b96d xfrm: defensively unhash xfrm_state lists in
> __xfrm_state_delete
> 1ee9bb33f50c5 btrfs: do not trim a device which is not writeable
> 210f49c16babe HID: appleir: fix UAF on pending key_up_timer in remove()
> f762e427204a5 netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
> 104e962c0778d Bluetooth: fix UAF in bt_accept_dequeue()
> 160be80dcaa57 i2c: core: fix adapter registration race 023c8f3acebcc net:
> ip_gre: require CAP_NET_ADMIN in the device netns for changelink
> b8b285996937e smb: client: restrict implied bcc[0] exemption to responses
> without data area
> 62b9455b524a2 ftrace: Add global mutex to serialize trace_parser access
> 18e1b6863f2a2 wifi: ath6kl: fix use-after-free in aggr_reset_state()
> c5d53c4091d2c libceph: Avoid using invalid osd indices from primary_temp
> 02be6f188f65b thunderbolt: Bound the DROM dual link port number before
> indexing sw->ports 06b62f64d461a tipc: read le->link under the node lock in
> tipc_node_link_down()
> 231cd04749bc8 ipv6: prevent in6_dev_get() from resurrecting inet6_dev
> 5b8317d3c81a7 serial: 8250_dma: Clear stale RX state on shutdown
> 00114c782ae76 net/sched: cls_route: fix fastmap use-after-free on filter
> f2bc9e8652686 nfs4: take a reference on the nfs_client when running
> FREE_STATEID 334d24ff159be Bluetooth: SCO: Fix use-after-free in
> sco_recv_frame() due to missing sock_hold
> 483db7203c062 can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate
> received command extents
> c58ecae06d669 sctp: reject stale cookies with mismatched verification tags
> a913bd184e356 net: sxgbe: check descriptor ring allocation failures
> f6fa91ea743e3 libceph: Fix multiplication overflow in
> decode_new_up_state_weight()
> 2952ef3847619 can: bcm: add missing device refcount for CAN filter removal
> f4fa2f7f36f2e sctp: fix auth_chunk_list capacity check in
> sctp_auth_ep_add_chunkid 0c6142e6d67bb wifi: mwifiex: bound uAP
> association event IEs to the event buffer
> 41cfceccec572 net/packet: avoid fanout hook re-registration after unregister
> 96efe281a700d sctp: fix auth_hmacs array size in struct sctp_cookie
> 13cf40380ac7b KVM: x86/mmu: Fix use-after-free on vendor module reload
> 2f8e39207d985 crypto: qat - fix restarting state leak on allocation failure
> c57604391687e usb: free iso schedules on failed submit
> 72cc582c593d3 Bluetooth: btrtl: validate firmware patch bounds
> 2e6bd3beccff5 ipvs: use parsed transport offset in SCTP state lookup
> 6dfae728844cc batman-adv: ensure minimal ethernet header on TX
> 115ac4f85cafb dm era: fix out-of-bounds memory access for non-zero start
> sector
> daf3aeba89057 sctp: validate STALE_COOKIE cause length before reading
> staleness e24980505e80e batman-adv: dat: fix tie-break for candidate
> selection 67cccfa82ee2a batman-adv: dat: ensure accessible eth_hdr proto
> field
> 28454e9b9d7b7 netfilter: xt_nat: reject unsupported target families
> 725269d86933c netfilter: nf_conntrack_reasm: guard mac_header adjustment
> after IPv6 defrag
> b20eb35fc03f3 xfrm: validate selector family and prefixlen during match
> a37ab55bcf26c sctp: validate embedded address parameter length
> dc3d23e8a71fe firmware_loader: Fix recursive lock in
> device_cache_fw_images()
> 8c3821a3e30e0 ocfs2: kill osb->system_file_mutex lock
> cf6f717ba97b8 ipv6: addrconf: bail out of dad_failure when state is no longer
> POSTDAD
> 10b4440285691 udf: validate free block extents against the partition length
> 5235e88344349 USB: ldusb: fix use-after-free on disconnect race
> e1dcc7378c58b cpufreq: Fix hotplug-suspend race during reboot
> 93f92255a8e24 usb: xhci: Fix sleep in atomic context in xhci_free_streams()
> 1c587a9ffd883 Bluetooth: btusb: fix use-after-free on registration failure
> bb63ea73d42fe mtd: slram: remove failed entries from the device list
> eb25e1a785e08 iio: event: Fix event FIFO reset race
> 7d9de25de4e61 ALSA: seq: close a re-opened queue timer in the destructor
> df2f30604a58a hwmon: (adt7470) Fix PWM auto temp state array and bounds
> check e90f5905b969e writeback: fix race between cgroup_writeback_umount()
> and inode_switch_wbs()
> 78d577bbaf103 ieee802154: admin-gate legacy LLSEC dump operations
> e185d2261c3b2 xen/gntdev: fix error handling in ioctl
> bd1df96ef03b3 mac802154: llsec: reject frames shorter than the authentication
> tag 4a213e8e0342d firewire: net: Fix fragmented datagram reassembly
> 92f8246ac2e21 serial: 8250_mid: Disable DMA for selected platforms
> 862c9946f58f7 bonding: 3ad: fix mux port state on oper down
> df557ee6a8f64 netfilter: ipset: fix refcount race between list:set GC and swap
> 73525985f4cfa netfilter: nf_nat_sip: reload possible stale data pointer
> 9e91b03227707 ipvs: ensure inner headers in ICMP errors are in headroom
> 955e245507a80 netfilter: ip6tables: mark malformed IPv6 extension headers for
> hotdrop 043f0aeb2318a ocfs2: rebase copied fsdlm LVB pointers in
> locking_state
> 1c660ae5d6008 drm/dp/mst: fix buffer overflows in sideband chunk
> accumulation ac92976c6b8cf scsi: scsi_debug: Negate wrapped memcmp()
> result cb8aaf7b5039b sctp: prevent peer transport count overflow
> f23deabbc8ed5 net: bridge: stop fast-leave after deleting a port group
> d48d2e30cb848 ipv6: fib6: fix NULL deref in fib6_walk_continue() on
> multi-batch dump
> ba4b6df2bd287 nfsd: release layout stid on setlease failure
> 488ea75b7f8e2 i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
> 2c52f137c35f5 batman-adv: retrieve ethhdr after potential skb realloc on RX
> 6f4ce31e13833 libceph: reject zero bucket types in crush_decode
>
I reviewed this update, looks good to me.
Reviewed-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90@mail.toshiba>
Best regards,
Nobuhiro
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Request for review for 4.4-st80, 4.4-cip115 (sit down for this one)
2026-09-22 15:51 Request for review for 4.4-st80, 4.4-cip115 (sit down for this one) Ulrich Hecht
` (2 preceding siblings ...)
2026-10-01 23:44 ` nobuhiro.iwamatsu.x90
@ 2026-10-05 17:18 ` Pavel Machek
3 siblings, 0 replies; 6+ messages in thread
From: Pavel Machek @ 2026-10-05 17:18 UTC (permalink / raw)
To: Ulrich Hecht
Cc: cip-dev@lists.cip-project.org, pavel@nabladev.com,
nobuhiro.iwamatsu.x90@mail.toshiba
[-- Attachment #1: Type: text/plain, Size: 2649 bytes --]
Hi!
> Here are the manual backports for the upcoming 4.4 kernel release. As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.4.y-st-rc
>
> There's a total of 87; 13 by me, and 74 by LLM. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8".)
> Total manual backport ratio is 21%, slightly down from 22% for st79.
>
> Speak up if you find a class of patches in here that we should not consider for backporting in the future.
>
These look ok to me.
Best regards,
Pavel
a > 96efe281a700d sctp: fix auth_hmacs array size in struct sctp_cookie
a > 13cf40380ac7b KVM: x86/mmu: Fix use-after-free on vendor module reload
a > 2f8e39207d985 crypto: qat - fix restarting state leak on allocation failure
a theoretical bug, untested > c57604391687e usb: free iso schedules on failed submit
a just a robustness against bad firmware > 72cc582c593d3 Bluetooth: btrtl: validate firmware patch bounds
a > 2e6bd3beccff5 ipvs: use parsed transport offset in SCTP state lookup
> 6dfae728844cc batman-adv: ensure minimal ethernet header on TX
a > 115ac4f85cafb dm era: fix out-of-bounds memory access for non-zero start sector
a > daf3aeba89057 sctp: validate STALE_COOKIE cause length before reading staleness
> e24980505e80e batman-adv: dat: fix tie-break for candidate selection
> 67cccfa82ee2a batman-adv: dat: ensure accessible eth_hdr proto field
a just a robustness > 28454e9b9d7b7 netfilter: xt_nat: reject unsupported target families
We don't have 9dbba7e694ec "ebtables emulation must reject non-bridge"...
a > 725269d86933c netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
a > b20eb35fc03f3 xfrm: validate selector family and prefixlen during match
a > a37ab55bcf26c sctp: validate embedded address parameter length
a > dc3d23e8a71fe firmware_loader: Fix recursive lock in device_cache_fw_images()
a > 8c3821a3e30e0 ocfs2: kill osb->system_file_mutex lock
a > cf6f717ba97b8 ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
a just a robustness against corrupted fs > 10b4440285691 udf: validate free block extents against the partition length
a > 5235e88344349 USB: ldusb: fix use-after-free on disconnect race
a > e1dcc7378c58b cpufreq: Fix hotplug-suspend race during reboot
a > 93f92255a8e24 usb: xhci: Fix sleep in atomic context in xhci_free_streams()
a > 1c587a9ffd883 Bluetooth: btusb: fix use-after-free on registration failure
a just a robustness > bb63ea73d42fe mtd: slram: remove failed entries from the device list
a > eb25e1a785e08 iio: event: Fix event FIFO reset race
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread