Request for review for 4.19-st21, 4.19-cip137

Request for review for 4.19-st21, 4.19-cip137

[Ulrich Hecht]

Hi!

Here are the adapted backports for the upcoming 4.19 kernel release. There's a total of 95; 1 written by me, 2 by Qwen-3.8-27B and 92 by Qwen-3.8-Flash-Next. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8" and "Assisted-by: SLTR:qwen-3.8-flash-next", respectively.)

As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc

0f9dd2fd36dc88 ipv4: validate checksum_start before completing checksum
1aef1ed67bf592 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
1772d2f27fe10f net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
994be280b21cd2 net/sched: reject IDR error pointers when deleting actions
2548133fd1bde9 drm/nouveau: Fix gem reference leak in validate_init()
893066ca3560ef drm/nouveau: fix double-free in nvif_vmm_dtor
a91fd56ecf47a4 gpio: zynq: fix runtime PM leak on request error path
b78ecf68a5560d ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
28db7b5b3dfc9c ipv6: do not let ipv6_find_hdr() return an offset past the packet end
59c0dbc48ea5e9 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
7582eb829827dd drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
5fc852076e0f08 drm/virtio: fix object leak when drm_gem_handle_create() fails
a27a4884b8c4af ipvs: revalidate ihl before icmp_send
88588102ee3ad2 bpf: Fix out-of-bounds read of rtt_min in sock_ops
b9027a1c10a535 i2c: at91: release DMA channels on remove and probe error
3975c809ff001e net/sched: hhf: cap hh_flows_limit at change time
e37dae2a4576c5 net: lock the socket in sock_gettstamp()
e1333865998044 tcp: do not let tcp_rmem be set below 4096
ffc922c95d046b drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
cbf63e3778be51 netfilter: flowtable: hold reference on ct until flow is released
2f3223465d9893 dma-coherent: report a failed reserved memory assignment
cbb22c9ad14604 iomap: iomap: fix memory corruption when recording errors during writeback
e081a6b8380337 fou: Fix use-after-free in fou_create()
15dca0467fbc1b i2c: smbus: reject oversized block transfers in the common path
ad002df2ef4324 ipv4: fib: bound automatic table ID allocation
36d5575a8baded net: mpls: clear inner_protocol when the last label is popped
0eceef464ddb41 cpufreq: initialize policy rwsem before sysfs publication
7a85d5bf37497f cpufreq: zero-initialize policy cpumask before sysfs publication
f33862037392e3 macvlan: inherit needed_headroom and needed_tailroom from lowerdev
8c7a3c69bd6c75 drm/amd/display: set new_stream to NULL after release
fab55095a265ba net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
7dbaf7cbcc17f2 bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
c991dca2b3c361 net/sched: act_api: budget all shared attributes in notify skbs
7d08f3c8750eb2 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
efc263c2c0b10b wifi: libertas: reject short monitor TX frames
b32f72a205795a xen/front-pgdir-shbuf: free grant reference head on errors
cba01a9b47aaf1 net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
7a599b7230d280 wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
e6c0bfb715a6d7 ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
f6c6a70da060ea rds: filter RDS_INFO_* getsockopt by caller's netns
98f4c9eafa9d27 scsi: pm8001: Reject firmware update in fatal error state
f0a0787eb48b2a thunderbolt: Set tb->root_switch to NULL when domain is stopped
6fe4d16722f049 NFSv4/pnfs: key the data server cache on the NFS version
af43e84cb9da3b NFS: Always clear an invalid mapping when attempting a buffered write
5b5b707281db3c lwt_bpf: Restore reserved headroom after xmit program
05fef2249c1be1 firmware_loader: do not queue completed sysfs fallback requests
81db1e6ec46877 ocfs2: synchronize heartbeat callbacks with o2net teardown
7383d078e76942 remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
3d73e501fdc537 perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
1b1ebee1d17f8b tty: clear cdev pointer after cdev_add() failure
af6929005c4a3a serial: amba-pl011: unprepare console clock on unregister
6434896a882257 wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
65d7661a2a2887 locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
9590d724daf3f2 remoteproc: Prevent crash handling to race with rproc_del()
1d2cfeed814ebf power: supply: sbs-battery: Use a per-device serial number buffer
f535e3674afd1c RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
d7b349ebdfdafc ASoC: meson: Keep link pointers valid on realloc failure
d38f463c73bccc tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
3f78220d000d94 xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
1b1bd4efd7d8a1 iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
05c7c199894226 soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
4939afd8061ba8 HID: roccat: bound device-supplied profile index
3c1c45a994001e bpf: Enforce expected_attach_type for tailcall compatibility
efff42e7625928 tcp: clear sock_ops cb flags before force-closing a child socket
e8453ec6b7f770 xhci: fix lost bounce buffers on TDs spanning several ring segments
8eb84d0751f98b drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
f0e7e4f141ca70 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
aec9df1263875c batman-adv: dat: avoid unaligned fault in IP extraction
53a94e6cc49ffe mtd: rawnand: validate ONFI extended parameter page sections
c8846b93ddcb6e HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
a8a753f7fc41b0 scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
303a77ac1be15b selinux: reject an unclaimed class value in security_get_classes()
4fae216b4a1760 tcp: fix potential race in tcp_v6_syn_recv_sock()
393c2ca46a3b27 fsnotify: Fix stale object mask after concurrent mark updates
83cb9c25f3391f openvswitch: Fix CT limit teardown use-after-free
aeca4496f07b9b netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
aea3fa3f950c8c net: cap advertised IP tunnel headroom
ce12d5b2bdee84 net: openvswitch: fix flow mask use-after-free on flow deletion
f139bc5bef5bc9 power: supply: max17040: synchronize work cancellation on suspend
7c74c8f9a71e98 sctp: fix stream->outcnt underflow on duplicate RECONF responses
7869f195dfe0a9 SUNRPC: harden gss_unwrap_resp_priv length checks
d93d0c0458686d SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
f57c93fdce94d3 SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
d10d5ffbde1f9b sunrpc: route to a populated pool in svc_pool_for_cpu()
b86a2634b755b9 nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
3af3a1546df5c8 ALSA: aloop: Fix racy access at PCM trigger
3a1fe75c4db943 mm/swap: reject swapon() on filesystem-level encrypted files
4084800d553361 selinux: switch two allocations to use kzalloc_objs()
b29f321b90465e ipv6: mcast: Fix use-after-free when processing MLD queries
68018695bfef2c xfs: bounds-check buffer log item's dirty bitmap
fe55a808ff6078 KVM: arm64: Retry fault if vma_lookup() results become invalid
9ef244c1264489 inet: frags: publish queues before arming timer
9779b445f542b2 packet: synchronize pressure clearing with ring reconfiguration
86ce0c431c5480 net/sched: reject overly deep qdisc hierarchies
13115d704fea78 serial: amba-pl011: synchronize DMA teardown

Thanks for having a look!

CU
Uli

Re: Request for review for 4.19-st21, 4.19-cip137

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 1578 bytes --]

Hi!

> 
> Here are the adapted backports for the upcoming 4.19 kernel release. There's a total of 95; 1 written by me, 2 by Qwen-3.8-27B and 92 by Qwen-3.8-Flash-Next. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8" and "Assisted-by: SLTR:qwen-3.8-flash-next", respectively.)
> 
> As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc
>

These look ok to me:

Reviewed-by: Pavel Machek <pavel@nabladev.com>

a this is not easy to validate > 0f9dd2fd36dc88 ipv4: validate checksum_start before completing checksum
a > 1aef1ed67bf592 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
a > 1772d2f27fe10f net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
a > 994be280b21cd2 net/sched: reject IDR error pointers when deleting actions
a > 2548133fd1bde9 drm/nouveau: Fix gem reference leak in validate_init()
a > 893066ca3560ef drm/nouveau: fix double-free in nvif_vmm_dtor
> a91fd56ecf47a4 gpio: zynq: fix runtime PM leak on request error path

So this is common pattern and quite a common mistake. As it only
happens in error paths, we may want to simply ignore this one.

If we wanted this fixed, we should probably introduce
pm_runtime_resume_and_get(). We already have two users of the
non-existing function in the tree, so two compile errors waiting to happen.

drivers/irqchip/irq-gic-pm.c:   ret = pm_runtime_resume_and_get(dev);
sound/ac97/bus.c:       ret = pm_runtime_resume_and_get(dev);

Best regards,
								Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: Request for review for 4.19-st21, 4.19-cip137

[Ulrich Hecht]

> On 11/02/2026 12:36 PM CET Pavel Machek <pavel@nabladev.com> wrote:
> These look ok to me:
> 
> Reviewed-by: Pavel Machek <pavel@nabladev.com>

Thanks. Here's a last-minute addition:

09c9317a392321 ipv4: free inet_opt and ireq_opt after an RCU grace period

> > a91fd56ecf47a4 gpio: zynq: fix runtime PM leak on request error path
> 
> So this is common pattern and quite a common mistake. As it only
> happens in error paths, we may want to simply ignore this one.

ATM the triage rule "fixes a minor resource leak, for instance during initialization or deinitialization of a device" is listed under "backported at the maintainer's discretion" (which in practice means it goes in unless it looks like a regression risk to me). I guess I can move that to "must not be backported".

CU
Uli

Re: Request for review for 4.19-st21, 4.19-cip137

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 313 bytes --]

Hi!

> > These look ok to me:
> > 
> > Reviewed-by: Pavel Machek <pavel@nabladev.com>
> 
> Thanks. Here's a last-minute addition:

> 09c9317a392321 ipv4: free inet_opt and ireq_opt after an RCU grace
>  period

Thanks, that's CVE-2026-98432 afaict. That's good to have.

Best regards,
							Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: Request for review for 4.19-st21, 4.19-cip137

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 2471 bytes --]

Hi!

> Here are the adapted backports for the upcoming 4.19 kernel release. There's a total of 95; 1 written by me, 2 by Qwen-3.8-27B and 92 by Qwen-3.8-Flash-Next. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8" and "Assisted-by: SLTR:qwen-3.8-flash-next", respectively.)
> 
> As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc
>

Some patches are ok, Reviewed-by: Pavel Machek
<pavel@nabladev.com>. There are some comments below.

e37dae2a4576c5, for example. That was an obvious two-liner, but it is
quite significant locking redone after backport. I'm afraid this
should get specific testing.

cbf63e3778be51 is example of different problem. That rmmod path is
likely seriously broken in 4.19-st20. That's why it got redesign in
mainline. It is still broken in 4.19-st21, that barrier won't fix it
with nf_flow_table_module_exit() missing. Nobody should unload modules
in production, and this risks regressions.

b9027a1c10a535 got minor comment.

Best regards,
								Pavel


a > b78ecf68a5560d ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
a > 28db7b5b3dfc9c ipv6: do not let ipv6_find_hdr() return an offset past the packet end
a > 59c0dbc48ea5e9 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
> 7582eb829827dd drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
> 5fc852076e0f08 drm/virtio: fix object leak when drm_gem_handle_create() fails
a > a27a4884b8c4af ipvs: revalidate ihl before icmp_send
a > 88588102ee3ad2 bpf: Fix out-of-bounds read of rtt_min in sock_ops
!! it probably does not matter, but we should do release consistently
before or after pm. I guess before. > b9027a1c10a535 i2c: at91: release DMA channels on remove and probe error
a just a robustness against CAP_NET_ADMIN > 3975c809ff001e net/sched: hhf: cap hh_flows_limit at change time
!! dunno, two liner becomes quite complex > e37dae2a4576c5 net: lock the socket in sock_gettstamp()
a> e1333865998044 tcp: do not let tcp_rmem be set below 4096
> ffc922c95d046b drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
!! are you sure this is applicable? > cbf63e3778be51 netfilter: flowtable: hold reference on ct until flow is released
a > 2f3223465d9893 dma-coherent: report a failed reserved memory assignment
a > cbb22c9ad14604 iomap: iomap: fix memory corruption when recording errors during writeback

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [cip-dev] Request for review for 4.19-st21, 4.19-cip137

[Ulrich Hecht]

> On 11/06/2026 11:03 AM CET Pavel Machek via cip-dev <pavel=nabladev.com@lists.cip-project.org> wrote:
> > Here are the adapted backports for the upcoming 4.19 kernel release. There's a total of 95; 1 written by me, 2 by Qwen-3.8-27B and 92 by Qwen-3.8-Flash-Next. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8" and "Assisted-by: SLTR:qwen-3.8-flash-next", respectively.)
> > 
> > As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc
> >
> 
> Some patches are ok, Reviewed-by: Pavel Machek
> <pavel@nabladev.com>. There are some comments below.
> 
> e37dae2a4576c5, for example. That was an obvious two-liner, but it is
> quite significant locking redone after backport. I'm afraid this
> should get specific testing.

The reasoning is as follows:
```
unlike 5.10 (where SIOCGSTAMP moved to the lockless `.gettstamp` op, which 4.19 lacks), three 4.19 ioctl handlers hold the socket lock around the stamp calls and would self-deadlock with the new inner `lock_sock()`: `ax25_ioctl` (lock over whole switch), `nr_ioctl` (lock per case), `qrtr_ioctl` (lock over whole switch). These callers must be adjusted, mirroring upstream's eventual direction. All other callers (inet, inet6, packet, rose, x25, can, bluetooth, atm, appletalk, ieee802154, compat) run lockless
```

As it happens, none of the affected handlers are enabled in any CIP configs, so technically we could also a) drop the additional fixes, or b) leave them in without testing because it doesn't matter anyway.

> cbf63e3778be51 is example of different problem. That rmmod path is
> likely seriously broken in 4.19-st20. That's why it got redesign in
> mainline. It is still broken in 4.19-st21, that barrier won't fix it
> with nf_flow_table_module_exit() missing. Nobody should unload modules
> in production, and this risks regressions.

OK, there's at least two things I don't understand here:
1. Why is nf_flow_table_module_exit() missing? The patch adds it.
2. How does that risk a regression if the path doesn't work anyway and is not supposed to be used in production?

CU
Uli

Re: Request for review for 4.19-st21, 4.19-cip137

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 6596 bytes --]

Hi!

> Here are the adapted backports for the upcoming 4.19 kernel release. There's a total of 95; 1 written by me, 2 by Qwen-3.8-27B and 92 by Qwen-3.8-Flash-Next. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8" and "Assisted-by: SLTR:qwen-3.8-flash-next", respectively.)
> 
> As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc

As usual, lines marked with "^a" are patches I reviewed. Reviewed-by:
Pavel Machek <pavel@nabladev.com>

I believe f6c6a70da060ea is a bit too complex for us.

Best regards,
								Pavel


a I would not change comment in the backport > 15dca0467fbc1b i2c: smbus: reject oversized block transfers in the common path
a > ad002df2ef4324 ipv4: fib: bound automatic table ID allocation
a > 36d5575a8baded net: mpls: clear inner_protocol when the last label is popped
a > 0eceef464ddb41 cpufreq: initialize policy rwsem before sysfs publication
a > 7a85d5bf37497f cpufreq: zero-initialize policy cpumask before sysfs publication
> f33862037392e3 macvlan: inherit needed_headroom and needed_tailroom from lowerdev
> 8c7a3c69bd6c75 drm/amd/display: set new_stream to NULL after release
a > fab55095a265ba net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
a > 7dbaf7cbcc17f2 bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
a > c991dca2b3c361 net/sched: act_api: budget all shared attributes in notify skbs
> 7d08f3c8750eb2 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
a > efc263c2c0b10b wifi: libertas: reject short monitor TX frames
> b32f72a205795a xen/front-pgdir-shbuf: free grant reference head on errors
a just a robustness > cba01a9b47aaf1 net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
a > 7a599b7230d280 wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
a > e6c0bfb715a6d7 ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
!! just a network namespacing, quite complex > f6c6a70da060ea rds: filter RDS_INFO_* getsockopt by caller's netns
> 98f4c9eafa9d27 scsi: pm8001: Reject firmware update in fatal error state
> f0a0787eb48b2a thunderbolt: Set tb->root_switch to NULL when domain is stopped
> 6fe4d16722f049 NFSv4/pnfs: key the data server cache on the NFS version
> af43e84cb9da3b NFS: Always clear an invalid mapping when attempting a buffered write
a > 5b5b707281db3c lwt_bpf: Restore reserved headroom after xmit program
a this is subtle way to return with retval = 0; I guess that's okay > 05fef2249c1be1 firmware_loader: do not queue completed sysfs fallback requests
> 81db1e6ec46877 ocfs2: synchronize heartbeat callbacks with o2net teardown
> 7383d078e76942 remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
> 3d73e501fdc537 perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
a > 1b1ebee1d17f8b tty: clear cdev pointer after cdev_add() failure
a > af6929005c4a3a serial: amba-pl011: unprepare console clock on unregister
a > 6434896a882257 wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
a > 65d7661a2a2887 locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
> 9590d724daf3f2 remoteproc: Prevent crash handling to race with rproc_del()
a two sbs batteries are pretty unusual config > 1d2cfeed814ebf power: supply: sbs-battery: Use a per-device serial number buffer
> f535e3674afd1c RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
> d7b349ebdfdafc ASoC: meson: Keep link pointers valid on realloc failure
> d38f463c73bccc tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
> 3f78220d000d94 xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
> 1b1bd4efd7d8a1 iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
> 05c7c199894226 soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
> 4939afd8061ba8 HID: roccat: bound device-supplied profile index
> 3c1c45a994001e bpf: Enforce expected_attach_type for tailcall compatibility
> efff42e7625928 tcp: clear sock_ops cb flags before force-closing a child socket
> e8453ec6b7f770 xhci: fix lost bounce buffers on TDs spanning several ring segments
> 8eb84d0751f98b drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
> f0e7e4f141ca70 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
> aec9df1263875c batman-adv: dat: avoid unaligned fault in IP extraction
> 53a94e6cc49ffe mtd: rawnand: validate ONFI extended parameter page sections
> c8846b93ddcb6e HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
> a8a753f7fc41b0 scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
> 303a77ac1be15b selinux: reject an unclaimed class value in security_get_classes()
> 4fae216b4a1760 tcp: fix potential race in tcp_v6_syn_recv_sock()
> 393c2ca46a3b27 fsnotify: Fix stale object mask after concurrent mark updates
> 83cb9c25f3391f openvswitch: Fix CT limit teardown use-after-free
> aeca4496f07b9b netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
> aea3fa3f950c8c net: cap advertised IP tunnel headroom
> ce12d5b2bdee84 net: openvswitch: fix flow mask use-after-free on flow deletion
> f139bc5bef5bc9 power: supply: max17040: synchronize work cancellation on suspend
> 7c74c8f9a71e98 sctp: fix stream->outcnt underflow on duplicate RECONF responses
> 7869f195dfe0a9 SUNRPC: harden gss_unwrap_resp_priv length checks
> d93d0c0458686d SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
> f57c93fdce94d3 SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
> d10d5ffbde1f9b sunrpc: route to a populated pool in svc_pool_for_cpu()
> b86a2634b755b9 nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
> 3af3a1546df5c8 ALSA: aloop: Fix racy access at PCM trigger
> 3a1fe75c4db943 mm/swap: reject swapon() on filesystem-level encrypted files
> 4084800d553361 selinux: switch two allocations to use kzalloc_objs()
> b29f321b90465e ipv6: mcast: Fix use-after-free when processing MLD queries
> 68018695bfef2c xfs: bounds-check buffer log item's dirty bitmap
> fe55a808ff6078 KVM: arm64: Retry fault if vma_lookup() results become invalid
> 9ef244c1264489 inet: frags: publish queues before arming timer
> 9779b445f542b2 packet: synchronize pressure clearing with ring reconfiguration
> 86ce0c431c5480 net/sched: reject overly deep qdisc hierarchies
> 13115d704fea78 serial: amba-pl011: synchronize DMA teardown
> 
> Thanks for having a look!
> 
> CU
> Uli

-- 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: Request for review for 4.19-st21, 4.19-cip137

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 1884 bytes --]

Hi!

> Here are the adapted backports for the upcoming 4.19 kernel release. There's a total of 95; 1 written by me, 2 by Qwen-3.8-27B and 92 by Qwen-3.8-Flash-Next. (The latter are labeled with "Assisted-by: SLTR:qwen-3.8" and "Assisted-by: SLTR:qwen-3.8-flash-next", respectively.)
> 
> As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.19.y-st-rc

I was able to review few more commits.

Reviewed-by: Pavel Machek <pavel@nabladev.com> .

Best regards,
								Pavel

a mostly theoretical, GFP_KERNEL allocations do not fail > d7b349ebdfdafc ASoC: meson: Keep link pointers valid on realloc failure
a just a config tweak > d38f463c73bccc tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
a > 1b1bd4efd7d8a1 iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
a just a of refcount leak > 05c7c199894226 soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
a > 53a94e6cc49ffe mtd: rawnand: validate ONFI extended parameter page sections
a just a robustness > 303a77ac1be15b selinux: reject an unclaimed class value in security_get_classes()
a > 4fae216b4a1760 tcp: fix potential race in tcp_v6_syn_recv_sock()
a not quite trivial, just a interface fix > 393c2ca46a3b27 fsnotify: Fix stale object mask after concurrent mark updates
a > aea3fa3f950c8c net: cap advertised IP tunnel headroom
a > ce12d5b2bdee84 net: openvswitch: fix flow mask use-after-free on flow deletion
a > f139bc5bef5bc9 power: supply: max17040: synchronize work cancellation on suspend
a > 7c74c8f9a71e98 sctp: fix stream->outcnt underflow on duplicate RECONF responses
a just a api change, may break someone's setup > 3a1fe75c4db943 mm/swap: reject swapon() on filesystem-level encrypted files
a just a robustness > 4084800d553361 selinux: switch two allocations to use kzalloc_objs()

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: Request for review for 4.19-st21, 4.19-cip137

[Ulrich Hecht]

> On 11/10/2026 10:27 PM CET Pavel Machek <pavel@nabladev.com> wrote:
> I believe f6c6a70da060ea is a bit too complex for us.
> !! just a network namespacing, quite complex > f6c6a70da060ea rds: filter RDS_INFO_* getsockopt by caller's netns

Dropped.

CU
Uli