Request for review for 4.19-st18, 4.19-cip134

Request for review for 4.19-st18, 4.19-cip134

[Ulrich Hecht]

Hi!

Here are the manual backports for the upcoming 4.19 kernel release. As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc

ac6678cb12932 batman-adv: clear current gateway during teardown
8a8f72ed32162 netfilter: ipset: stop hash:* range iteration at end
239972f582859 net/sched: netem: fix queue limit check to include reordered packets
290ca3d4cc0fe cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
d09410f835071 btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
8134eaf6adc42 tipc: fix double-free in tipc_buf_append()
02d2ac7f84d00 slip: reject VJ receive packets on instances with no rstate array
50beb65e59221 netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
602bc47c8749f crypto: ccp - copy IV using skcipher ivsize
b9d8a2d537ce9 wifi: brcmfmac: Fix error pointer dereference
041440c0902f7 bpf: fix end-of-list detection in cgroup_storage_get_next_key()
f43b5f55f017c crypto: authencesn - reject short ahash digests during instance creation
fa4149888d92f mmc: block: use single block write in retry
0ecdcd07a75d2 crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
c14d8dc588ad5 crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
3bffafe5e8975 x86/uprobes: Fix XOL allocation failure for 32-bit tasks
2008358d97f17 blk-mq: use quiesced elevator switch when reinitializing queues
e336fb23c682a scsi: ufs: core: Improve SCSI abort handling
6f7e7878e3c89 bcache: fix cached_dev.sb_bio use-after-free and crash
a33e2701e85c8 rxrpc: proc: size address buffers for %pISpc output
7a2d6e91f43a6 can: raw: fix ro->uniq use-after-free in raw_rcv()
5553ed48c310e batman-adv: hold claim backbone gateways by reference
781ff3428d09f l2tp: Drop large packets with UDP encap
b741e14915ee3 xsk: tighten UMEM headroom validation to account for tailroom and min frame
9eddb82dc26e4 wifi: brcmfmac: validate bsscfg indices in IF events
b03bfcc22433c can: mcp251x: add error handling for power enable in open and resume
133952b84ff40 net: skbuff: propagate shared-frag marker through frag-transfer helpers

Thank you!

CU
Uli

Re: Request for review for 4.19-st18, 4.19-cip134

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 2940 bytes --]

Hi!

> Here are the manual backports for the upcoming 4.19 kernel
>  release. As always they can be found in
>  https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc

Patches look mostly good to me. Some notes are below

Best regards,
											Pavel

? why the null check > ac6678cb12932 batman-adv: clear current gateway during teardown

Why the added NULL check? Mainline patch does not have it, and it will
not break anything, but I don't understand reasoning.

a > 8a8f72ed32162 netfilter: ipset: stop hash:* range iteration at end
a > 239972f582859 net/sched: netem: fix queue limit check to include reordered packets
a just a interface fix> 290ca3d4cc0fe cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
a > d09410f835071 btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
a > 8134eaf6adc42 tipc: fix double-free in tipc_buf_append()
a > 02d2ac7f84d00 slip: reject VJ receive packets on instances with no rstate array
a > 50beb65e59221 netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
a > 602bc47c8749f crypto: ccp - copy IV using skcipher ivsize
a > b9d8a2d537ce9 wifi: brcmfmac: Fix error pointer dereference
a > 041440c0902f7 bpf: fix end-of-list detection in cgroup_storage_get_next_key()
a > f43b5f55f017c crypto: authencesn - reject short ahash digests during instance creation
a just a hw bug workaround > fa4149888d92f mmc: block: use single block write in retry
a mostly a robustness > 0ecdcd07a75d2 crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed

Hmm. This is wrong. In case of argp->error, we'll return 0, even when
we have failure. AFAICT same problem exists in mainline.

a mostly a robustness > c14d8dc588ad5 crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed

Same problem here, we'll return 0 on argp->error.

a just a tracing fix > 3bffafe5e8975 x86/uprobes: Fix XOL allocation failure for 32-bit tasks
a > 2008358d97f17 blk-mq: use quiesced elevator switch when reinitializing queues
a > e336fb23c682a scsi: ufs: core: Improve SCSI abort handling
a > 6f7e7878e3c89 bcache: fix cached_dev.sb_bio use-after-free and crash
a not a minimum fix > a33e2701e85c8 rxrpc: proc: size address buffers for %pISpc output
a > 7a2d6e91f43a6 can: raw: fix ro->uniq use-after-free in raw_rcv()
a > 5553ed48c310e batman-adv: hold claim backbone gateways by reference
a > 781ff3428d09f l2tp: Drop large packets with UDP encap

Error-handling code could be shared here.

a > b741e14915ee3 xsk: tighten UMEM headroom validation to account for tailroom and min frame
a > 9eddb82dc26e4 wifi: brcmfmac: validate bsscfg indices in IF events
a > b03bfcc22433c can: mcp251x: add error handling for power enable in open and resume
a > 133952b84ff40 net: skbuff: propagate shared-frag marker through frag-transfer helpers
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: Request for review for 4.19-st18, 4.19-cip134

[Ulrich Hecht]

Thanks for the reviews!

> On 06/22/2026 4:03 PM CEST Pavel Machek <pavel@nabladev.com> wrote:
> ? why the null check > ac6678cb12932 batman-adv: clear current gateway during teardown
> 
> Why the added NULL check? Mainline patch does not have it, and it will
> not break anything, but I don't understand reasoning.

In mainline batadv_gw_node_put() does this check, but in 4.19 the caller is still expected to do it.
(Found by LLM.)

> a > 8a8f72ed32162 netfilter: ipset: stop hash:* range iteration at end
> a > 239972f582859 net/sched: netem: fix queue limit check to include reordered packets
> a just a interface fix> 290ca3d4cc0fe cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
> a > d09410f835071 btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
> a > 8134eaf6adc42 tipc: fix double-free in tipc_buf_append()
> a > 02d2ac7f84d00 slip: reject VJ receive packets on instances with no rstate array
> a > 50beb65e59221 netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
> a > 602bc47c8749f crypto: ccp - copy IV using skcipher ivsize
> a > b9d8a2d537ce9 wifi: brcmfmac: Fix error pointer dereference
> a > 041440c0902f7 bpf: fix end-of-list detection in cgroup_storage_get_next_key()
> a > f43b5f55f017c crypto: authencesn - reject short ahash digests during instance creation
> a just a hw bug workaround > fa4149888d92f mmc: block: use single block write in retry
> a mostly a robustness > 0ecdcd07a75d2 crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
> 
> Hmm. This is wrong. In case of argp->error, we'll return 0, even when
> we have failure. AFAICT same problem exists in mainline.
> 
> a mostly a robustness > c14d8dc588ad5 crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
> 
> Same problem here, we'll return 0 on argp->error.

Looks like it. Since this is not a backport problem, and the code with the change is AFAICT less bad than the code without the change, I'm inclined to leave the patches as they are and assume that fixes will come from upstream if this turns out to be a real issue.

CU
Uli

RE: Request for review for 4.19-st18, 4.19-cip134

[nobuhiro.iwamatsu.x90]

Hi Uli,

Thanks for your update.
I reviewed this update, other than issue Pavel pointed out,
Everything seems to be fine.

Best regards,
  Nobuhiro

> -----Original Message-----
> From: Ulrich Hecht <uli@fpond.eu>
> Sent: Friday, June 19, 2026 11:21 PM
> To: cip-dev@lists.cip-project.org; pavel@nabladev.com; iwamatsu nobuhiro(岩松 信洋 □ＤＩＴＣ○ＣＰＴ)
> <nobuhiro.iwamatsu.x90@mail.toshiba>
> Subject: Request for review for 4.19-st18, 4.19-cip134
> 
> Hi!
> 
> Here are the manual backports for the upcoming 4.19 kernel release. As always they can be found in
> https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc
> 
> ac6678cb12932 batman-adv: clear current gateway during teardown
> 8a8f72ed32162 netfilter: ipset: stop hash:* range iteration at end
> 239972f582859 net/sched: netem: fix queue limit check to include reordered packets 290ca3d4cc0fe cdrom, scsi: sr:
> propagate read-only status to block layer via set_disk_ro()
> d09410f835071 btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
> 8134eaf6adc42 tipc: fix double-free in tipc_buf_append()
> 02d2ac7f84d00 slip: reject VJ receive packets on instances with no rstate array
> 50beb65e59221 netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check 602bc47c8749f crypto: ccp - copy IV
> using skcipher ivsize
> b9d8a2d537ce9 wifi: brcmfmac: Fix error pointer dereference
> 041440c0902f7 bpf: fix end-of-list detection in cgroup_storage_get_next_key() f43b5f55f017c crypto: authencesn - reject
> short ahash digests during instance creation fa4149888d92f mmc: block: use single block write in retry
> 0ecdcd07a75d2 crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
> c14d8dc588ad5 crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
> 3bffafe5e8975 x86/uprobes: Fix XOL allocation failure for 32-bit tasks
> 2008358d97f17 blk-mq: use quiesced elevator switch when reinitializing queues e336fb23c682a scsi: ufs: core: Improve
> SCSI abort handling
> 6f7e7878e3c89 bcache: fix cached_dev.sb_bio use-after-free and crash
> a33e2701e85c8 rxrpc: proc: size address buffers for %pISpc output
> 7a2d6e91f43a6 can: raw: fix ro->uniq use-after-free in raw_rcv() 5553ed48c310e batman-adv: hold claim backbone
> gateways by reference 781ff3428d09f l2tp: Drop large packets with UDP encap
> b741e14915ee3 xsk: tighten UMEM headroom validation to account for tailroom and min frame
> 9eddb82dc26e4 wifi: brcmfmac: validate bsscfg indices in IF events b03bfcc22433c can: mcp251x: add error handling for
> power enable in open and resume
> 133952b84ff40 net: skbuff: propagate shared-frag marker through frag-transfer helpers
> 
> Thank you!
> 
> CU
> Uli