Request for review for 4.19-st20, 4.19-cip136

Request for review for 4.19-st20, 4.19-cip136

[Ulrich Hecht]

Hi!

Here are the "manual" backports for the upcoming 4.19 kernel release. There's a total of 68; 40 by me, and 28 by LLM. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8".)

As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc

27bcd94232ddc ipv6: mcast: Fix potential UAF in MLD delayed work
d03436150e4a9 drm/edid: fix OOB read in drm_parse_tiled_block()
4227b25379d71 drm/displayid: fix Tiled Display Topology ID size
43d3d995bf595 f2fs: validate orphan inode entry count
5021916ddfd36 ALSA: seq: close a re-opened queue timer in the destructor
6fe1ea5d01613 hwmon: (adt7470) Fix PWM auto temp state array and bounds check
c32d12e231163 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
725e862fe8b08 ieee802154: admin-gate legacy LLSEC dump operations
033fdbe334d3c xen/gntdev: fix error handling in ioctl
fdc9c5a408cfc rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
3ecdb8f5381c2 mac802154: llsec: reject frames shorter than the authentication tag
e05a9dca311e3 vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
ae8427e05bc1a firewire: net: Fix fragmented datagram reassembly
837b739d485a8 serial: 8250_mid: Disable DMA for selected platforms
c9534ae294af2 bonding: 3ad: fix mux port state on oper down
0ee0719ebd182 crypto: af_alg - Remove zero-copy support from skcipher and aead
8d4d8938c938b apparmor: mediate the implicit connect of TCP fast open sendmsg
d1ae7480a5a50 netfilter: ipset: fix refcount race between list:set GC and swap
afe5bdeae11e4 btrfs: do not trim a device which is not writeable
c819b97d60589 xfs: use null daddr for unset first bad log block
82f3412405d88 HID: appleir: fix UAF on pending key_up_timer in remove()
f6b1dda2a3508 smb: client: Fix next buffer leak in receive_encrypted_standard()
598fd8e4db9ac iio: common: st_sensors: honour channel endianness in read_axis_data
a43c58057c539 netfilter: nf_nat_sip: reload possible stale data pointer
19f32fd717473 ipvs: ensure inner headers in ICMP errors are in headroom
a777755df8ee5 netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
de57725fa7d0d rtc: ds1307: Fix off-by-one issue with wday for rx8130
27f698f798451 smb/client: preserve errors from smb2_set_sparse()
1afab31384e2e netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
80f8dca831e42 tipc: prevent snt_unacked underflow on CONN_ACK
21754c9585fc3 tipc: require net admin for TIPCv2 netlink mutators
3face51d6506e net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
be43ba6f489b6 ocfs2: rebase copied fsdlm LVB pointers in locking_state
d145312da325f net/sched: cls_bpf: prevent unbounded recursion in offload rollback
21aebfc636b9c crypto: ecc - Fix carry overflow in vli multiplication
ea5470a093f6d Bluetooth: fix UAF in bt_accept_dequeue()
5fb906176753b net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
b06d8e05be8d6 drm/dp/mst: fix buffer overflows in sideband chunk accumulation
2ee87cc535310 net: ipip: require CAP_NET_ADMIN in the device netns for changelink
798716bc98db1 rxrpc: Fix notification vs call-release vs recvmsg
483240e3761eb libceph: fix multiple unsafe decodes in decode_locker()
4338c41c423b1 scsi: scsi_debug: Negate wrapped memcmp() result
e370b6e8d1a59 vhost: reset the vring metadata cache on vring reconfiguration
7d8fc6d0208be futex: Prevent robust futex exit race some more
3d3bcb5dd85d1 Input: evdev - fix information leak in evdev_pass_values()
a3e7176697ddd mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
96c6f93b3ff66 sctp: prevent peer transport count overflow
39cf294824a31 net: bridge: stop fast-leave after deleting a port group
f0b272d10c9df mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
caba2e7b56939 ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
5298659ef682c openvswitch: fix GSO userspace truncation underflow
031a2f99d475b vxlan: require CAP_NET_ADMIN in the device netns for changelink
e7383f6dbb6b9 can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
bd5b04d67545f tipc: fix u16 MTU truncation in media and bearer MTU validation
fd119cc5d1ce0 net/sched: act_tunnel_key: Defer dst_release to RCU callback
231854d20f22b KVM: nVMX: Hide shadow VMCS right after VMCLEAR
c4bc9e59cd758 perf/x86/amd/core: Always use the NMI latency mitigation
a0aef239f4722 i2c: core: fix adapter registration race
6cff48ecf1d69 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
c7b13e80811aa nfsd: release layout stid on setlease failure
d75140d1212a2 i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
e33cc57dadde8 selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
b8c1bbd016710 net/openvswitch: check Ethernet header length in key_extract()
f965a98a469c3 net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
7bdb312c113d2 smb: client: restrict implied bcc[0] exemption to responses without data area
8f223fbe6b2d4 batman-adv: retrieve ethhdr after potential skb realloc on RX
1c72d53630aa3 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
f1f7d30dcdfaa NFS: Decrement refcounts if allocating nfs_free_stateid_data fails

Thank you!

CU
Uli

Re: Request for review for 4.19-st20, 4.19-cip136

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 485 bytes --]

Hi!

> Here are the "manual" backports for the upcoming 4.19 kernel
>  release. There's a total of 68; 40 by me, and 28 by LLM. (The latter
>  are labeled with "Assisted-by: SLTR:qwen-3.8".)

I'm not huge fan of "the more the better" here. We are not testing all
of the kernel, we are not even compile testing all of it, so bugs will
eventually creep in.

Can you clarify what role LLM had here, what goals you set for it, and
how you reviewing the stuff?

Best regards,
								Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: Request for review for 4.19-st20, 4.19-cip136

[Ulrich Hecht]

> On 09/03/2026 11:00 AM CEST Pavel Machek <pavel@nabladev.com> wrote:
> > Here are the "manual" backports for the upcoming 4.19 kernel
> >  release. There's a total of 68; 40 by me, and 28 by LLM. (The latter
> >  are labeled with "Assisted-by: SLTR:qwen-3.8".)
> 
> I'm not huge fan of "the more the better" here.

There were 1300 patches incoming this release cycle; the number of backports reflects that. If you see classes of fixes that should not be backported I can ignore those in the future. (I have sent you the prompt I'm using for triage.)

> We are not testing all
> of the kernel, we are not even compile testing all of it

I am doing the latter.

>, so bugs will
> eventually creep in.

Right now it looks to me as if this approach reduces the number of bugs. The LLM has more time to look into backports and was able to find differences in 4.x that I would have not found because of that.

> Can you clarify what role LLM had here, what goals you set for it, and
> how you reviewing the stuff?

- The added bit that produces the backports is simply "If applicable, write out a modified version of the patch that applies to the legacy code base."
- The patches marked with the Assisted-by tag have been applied by me as written by the LLM.
- I'm reviewing the auto-generated backports manually as well as using the review prompt as found in the SLTR repository.

CU
Uli

Re: Request for review for 4.19-st20, 4.19-cip136

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 1729 bytes --]

Hi!

> Here are the "manual" backports for the upcoming 4.19 kernel release. There's a total of 68; 40 by me, and 28 by LLM. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8".)
> 
> As always they can be found in
> https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc

I have some comments here. I'll try to continue review soon.

Best regards,
								Pavel
								
> 
a > 27bcd94232ddc ipv6: mcast: Fix potential UAF in MLD delayed work
!! should return -EINVAL > d03436150e4a9 drm/edid: fix OOB read in drm_parse_tiled_block()
! original patch is not great, if they want to play with sizeof, they
should have introduced a define > 4227b25379d71 drm/displayid: fix Tiled Display Topology ID size
a just a robustness against filesystem corruption > 43d3d995bf595 f2fs: validate orphan inode entry count
a > 5021916ddfd36 ALSA: seq: close a re-opened queue timer in the destructor
!! it fails to return error > 6fe1ea5d01613 hwmon: (adt7470) Fix PWM auto temp state array and bounds check
a > c32d12e231163 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
a > 725e862fe8b08 ieee802154: admin-gate legacy LLSEC dump operations
a I'd delete the /* already removed */ remark, it is not really helpful, and for consistency > 033fdbe334d3c xen/gntdev: fix error handling in ioctl
a > fdc9c5a408cfc rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
a > 3ecdb8f5381c2 mac802154: llsec: reject frames shorter than the authentication tag
!! should VMXNET3_RCD_HDR_INNER_SHIFT be 13? > e05a9dca311e3 vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
a > ae8427e05bc1a firewire: net: Fix fragmented datagram reassembly

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: Request for review for 4.19-st20, 4.19-cip136

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 3132 bytes --]

Hi!

> Here are the "manual" backports for the upcoming 4.19 kernel release. There's a total of 68; 40 by me, and 28 by LLM. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8".)
> 
> As always they can be found in
> https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc

More reviews here. The alf_alg thing is kind of scary, I was not able
to review that one relative to mainline version.

Best regards,
								Pavel

> 
a marking definitely unused code "maybe unused" is kind of
interesting; but mailine has similar trick > 837b739d485a8 serial: 8250_mid: Disable DMA for selected platforms
a > c9534ae294af2 bonding: 3ad: fix mux port state on oper down
! this is now completely different from mainline, and pretty non
trivial; I don't know how to review this one  > 0ee0719ebd182 crypto: af_alg - Remove zero-copy support from skcipher and aead
a > 8d4d8938c938b apparmor: mediate the implicit connect of TCP fast open sendmsg
a > d1ae7480a5a50 netfilter: ipset: fix refcount race between list:set GC and swap
a > afe5bdeae11e4 btrfs: do not trim a device which is not writeable
a > c819b97d60589 xfs: use null daddr for unset first bad log block
a > 82f3412405d88 HID: appleir: fix UAF on pending key_up_timer in remove()
a > f6b1dda2a3508 smb: client: Fix next buffer leak in receive_encrypted_standard()
a st_sensors_get_unaligned_be24() is strange, it playes some tricks
with s32 casts and shifts data back and forth > 598fd8e4db9ac iio: common: st_sensors: honour channel endianness in read_axis_data
a we dropped WARN_ON, I guess that's ok > a43c58057c539 netfilter: nf_nat_sip: reload possible stale data pointer
a > 19f32fd717473 ipvs: ensure inner headers in ICMP errors are in headroom
a > a777755df8ee5 netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
a > de57725fa7d0d rtc: ds1307: Fix off-by-one issue with wday for rx8130
a > 27f698f798451 smb/client: preserve errors from smb2_set_sparse()
a > 1afab31384e2e netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
a > 80f8dca831e42 tipc: prevent snt_unacked underflow on CONN_ACK
a > 21754c9585fc3 tipc: require net admin for TIPCv2 netlink mutators
a > 3face51d6506e net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
a > be43ba6f489b6 ocfs2: rebase copied fsdlm LVB pointers in locking_state
a > d145312da325f net/sched: cls_bpf: prevent unbounded recursion in offload rollback
a > 21aebfc636b9c crypto: ecc - Fix carry overflow in vli multiplication
a > ea5470a093f6d Bluetooth: fix UAF in bt_accept_dequeue()
a > 5fb906176753b net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
a just a robustness against bad hw > b06d8e05be8d6 drm/dp/mst: fix buffer overflows in sideband chunk accumulation
a just an api fix > 2ee87cc535310 net: ipip: require CAP_NET_ADMIN in the device netns for changelink
a > 798716bc98db1 rxrpc: Fix notification vs call-release vs recvmsg
a > 483240e3761eb libceph: fix multiple unsafe decodes in decode_locker()
a > 4338c41c423b1 scsi: scsi_debug: Negate wrapped memcmp() result

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: Request for review for 4.19-st20, 4.19-cip136

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 1622 bytes --]

Hi!

> Here are the "manual" backports for the upcoming 4.19 kernel release. There's a total of 68; 40 by me, and 28 by LLM. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8".)
> 
> As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc
>

The openvswitch patch is not easy to review, rest looks okay.

Thanks and best regards,
								Pavel

a > e370b6e8d1a59 vhost: reset the vring metadata cache on vring reconfiguration
a this makes me a bit nervous > 7d8fc6d0208be futex: Prevent robust futex exit race some more
a > 3d3bcb5dd85d1 Input: evdev - fix information leak in evdev_pass_values()
a > a3e7176697ddd mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
a > 96c6f93b3ff66 sctp: prevent peer transport count overflow
a > 39cf294824a31 net: bridge: stop fast-leave after deleting a port group
a > f0b272d10c9df mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
a > caba2e7b56939 ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
! changing meaning of variable while keeping name is pretty anti-social > 5298659ef682c openvswitch: fix GSO userspace truncation underflow
a just a API fix > 031a2f99d475b vxlan: require CAP_NET_ADMIN in the device netns for changelink
a > e7383f6dbb6b9 can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
a quite different from upstream fix > bd5b04d67545f tipc: fix u16 MTU truncation in media and bearer MTU validation
a > fd119cc5d1ce0 net/sched: act_tunnel_key: Defer dst_release to RCU callback


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [cip-dev] Request for review for 4.19-st20, 4.19-cip136

[Ulrich Hecht]

> On 09/03/2026 1:59 PM CEST Pavel Machek via lists.cip-project.org <pavel=nabladev.com@lists.cip-project.org> wrote:
> I have some comments here. I'll try to continue review soon.

Thanks, this is very helpful!

> a > 27bcd94232ddc ipv6: mcast: Fix potential UAF in MLD delayed work
> !! should return -EINVAL > d03436150e4a9 drm/edid: fix OOB read in drm_parse_tiled_block()

The argument that the LLM brings forward is that returning -EINVAL would abort parsing of the DisplayID extension and thus any valid blocks that may exist down the line will be ignored. I'm not an expert on DRM, but I think the fact that in upstream drm_parse_tiled_block() doesn't even have a return value anymore supports that view.

> !! it fails to return error > 6fe1ea5d01613 hwmon: (adt7470) Fix PWM auto temp state array and bounds check

I would not consider that wrong. The 4.19 code does not check for or propagate any errors here, and adding that is beyond the scope of a minimum viable fix.

> !! should VMXNET3_RCD_HDR_INNER_SHIFT be 13? > e05a9dca311e3 vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

It should. Looking into it I found that because the LLM only had access to one branch (4.19), when it had to find out what that value is and couldn't, it made an educated guess. One tiny complete tool rewrite later, and with access to both branches, that mistake is gone. (Fixed it in the tree, too.)

I have also added instructions to the prompt to separate established facts (things determined by looking at actual code) from assumptions made by the LLM, which should help identify fails like this one.

CU
Uli

Re: [cip-dev] Request for review for 4.19-st20, 4.19-cip136

[Ulrich Hecht]

> On 09/07/2026 1:04 PM CEST Pavel Machek via lists.cip-project.org <pavel=nabladev.com@lists.cip-project.org> wrote:
> More reviews here.

Thank you!

> ! this is now completely different from mainline, and pretty non
> trivial; I don't know how to review this one  > 0ee0719ebd182 crypto: af_alg - Remove zero-copy support from skcipher and aead

It's almost identical to the 5.10 patch, with the only change being that ITER_SOURCE is replaced by "WRITE | ITER_BVEC" because 4.19 predates "iov_iter: Separate type from direction and use accessor functions".

This entire kernel tree is based on the assumption that 5.10 patches are (at least conceptually) correct for 5.10, and with the code being completely identical in 4.19 I'm inclined to believe that in this case the 5.10 patch is correct for 4.19 as well.

CU
Uli

Re: Request for review for 4.19-st20, 4.19-cip136

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 2003 bytes --]

Hi!

> Here are the "manual" backports for the upcoming 4.19 kernel release. There's a total of 68; 40 by me, and 28 by LLM. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8".)
> 
> As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc
>

Reviewed-by: Pavel Machek <pavel@nabladev.com>

Most of the patches look good to me, some questions are below.

Thanks and sorry that it took so long.

Best regards,
								Pavel

a > 231854d20f22b KVM: nVMX: Hide shadow VMCS right after VMCLEAR
a > c4bc9e59cd758 perf/x86/amd/core: Always use the NMI latency mitigation
a > a0aef239f4722 i2c: core: fix adapter registration race
a just a API fix > 6cff48ecf1d69 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
a > c7b13e80811aa nfsd: release layout stid on setlease failure
a > d75140d1212a2 i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
a > e33cc57dadde8 selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
a > b8c1bbd016710 net/openvswitch: check Ethernet header length in key_extract()
a > f965a98a469c3 net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
a original patch could use function reordering > 7bdb312c113d2 smb: client: restrict implied bcc[0] exemption to responses without data area
a > 8f223fbe6b2d4 batman-adv: retrieve ethhdr after potential skb realloc on RX

I guess I'm confused here. This one is not correct on its own, as it
creates non-balanced situation. Is the 1c72d53630aa3 fixing it up?
Where does 1c72d53630aa3 come from? Will it cause bisect problems?

!! > 1c72d53630aa3 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

This one does not have "upstream commit" annotation, and I could not
find where it comes from. I checked 6.12-cip version, and it looks
very different from this.

!! no upstream annotation > f1f7d30dcdfaa NFS: Decrement refcounts if allocating nfs_free_stateid_data fails



[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [cip-dev] Request for review for 4.19-st20, 4.19-cip136

[Ulrich Hecht]

> On 09/10/2026 9:32 PM CEST Pavel Machek via lists.cip-project.org <pavel=nabladev.com@lists.cip-project.org> wrote:
> Reviewed-by: Pavel Machek <pavel@nabladev.com>

Thanks again.

> Most of the patches look good to me, some questions are below.
> 
> Thanks and sorry that it took so long.

It was a lot...

> I guess I'm confused here. This one is not correct on its own, as it
> creates non-balanced situation. Is the 1c72d53630aa3 fixing it up?
> Where does 1c72d53630aa3 come from? Will it cause bisect problems?
> 
> !! > 1c72d53630aa3 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
> 
> This one does not have "upstream commit" annotation, and I could not
> find where it comes from. I checked 6.12-cip version, and it looks
> very different from this.

According to my notes the chain of bugs is as follows:

- "nfs4: take a reference on the nfs_client when running FREE_STATEID" is broken.
- It is fixed by "NFS: Decrement refcounts if allocating nfs_free_stateid_data fails" (which I have cherry-picked from mainline and forgot to annotate).
- The latter contains parts of the 5.10 version of "NFS: Pin the 'struct nfs_server' during a FREE_STATEID call" which are therefore omitted in the backport.

> !! no upstream annotation > f1f7d30dcdfaa NFS: Decrement refcounts if allocating nfs_free_stateid_data fails

Fixed.

CU
Uli