Hi!

For 4.4 -st release, I'd suggest these steps:

- sign off the patches
- push that to linux-4.4.y-st-rc @ kernel.org
- update v4.4.org

For patches that were applied automatically, I don't think we need to
additional review. For the others, I guess you should send list to
cip-dev, and someone will take a look.

For updating 4.4-cip tree, just checkout linux-4.4.y-cip and merge
-st. Iwamatsu is doing 4.4-cip releases, so I was just asking him to
do them, he handles 4.4-cip-rebase.

Best regards,
Pavel

--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

On 01/09/2023 4:53 PM CET Pavel Machek <pavel@...> wrote:
For 4.4 -st release, I'd suggest these steps:

- sign off the patches

Done.

- push that to linux-4.4.y-st-rc @ kernel.org

Done.
What is the numbering scheme for linux-4.4.y-st, anyway? The current HEAD doesn't have a version number.

- update v4.4.org

Done.
(For those playing along, that's at https://gitlab.com/cip-project/cip-kernel/lts-commit-list/-/raw/master/v4.4.org )

For patches that were applied automatically, I don't think we need to
additional review. For the others, I guess you should send list to
cip-dev, and someone will take a look.

These are the patches I had to touch up manually:

** m | 9cb1ee33e a36e50 .+ | drm/msm/hdmi: check return value after calling platform_get_resource_byname()
** m | c132f2ba7 ddbd89 o | swiotlb: fix info leak with DMA_FROM_DEVICE
** m | fd97de9c7 901c72 o | Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
** m | 136b47994 190cc8 o | tcp: change source port randomizarion at connect() time
** m | 05a12e5c4 c579bd o | tcp: add some entropy in __inet_hash_connect()
** m | 576696ed0 b2d057 o | secure_seq: use the 64 bits of the siphash for port offset calculation
** m | 2ed413f14 9e9b70 o | tcp: use different parts of the port_offset for index and offset
** m | aa7722529 ca7af0 o | tcp: add small random increments to the source port
** m | dd82067bd e92614 o | tcp: dynamically allocate the perturb table used by source ports
** m | 3c78eea64 4c2c8f o | tcp: increase source port perturb table to 2^16
** m | a81a6b204 e81613 o | tcp: drop the hash_32() part from the index calculation
** m | ed71adaa8 17d3df o | cifs: don't send down the destination address to sendmsg for a SOCK_STREAM
** m | 6eb181a64 60deb9 o | wifi: mac80211: Fix UAF in ieee80211_scan_rx()
** m | e2b46cd57 81225b o+ | ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
** m | f8a1ac3db 544042 .+ | can: gs_usb: gs_can_open(): fix race dev->can.state condition
** m | 146357504 c292a3 o+ | nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
** m | 27c2c6d35 1b24a1 .+ | clk: iproc: Do not rely on node name for correct PLL setup
** m | bb63454b6 21a87d o | nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
** m | b63026b5e 723ac7 o | nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
** m | c4a13e588 56e696 o | ALSA: hda: Fix position reporting on Poulsbo
** m | a9043a24c d325dc o | nilfs2: fix use-after-free bug of struct nilfs_root
** m | cf3166691 620d5e .+ | wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
** m | c202cda08 668a8f o+ | drm/mipi-dsi: Detach devices when removing the host
** m | 9183a37d3 551e32 .+ | HSI: omap_ssi_port: Fix dma_map_sg error check
** m | 7b0efe753 1c78f1 .+ | media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
** m | 2319e8f80 9c6e09 o+ | ata: fix ata_id_has_devslp()
** m | e01f64a34 630624 o+ | ata: fix ata_id_has_dipm()
** m | d96732831 898ec8 o+ | dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
** m | 508a9b8a8 110024 o | openvswitch: Fix double reporting of drops in dropwatch
** m | 56761647e 3fd7bf o | can: bcm: check the result of can_send() in bcm_can_tx()
** m | 0adda6e12 c44f15 .+ | arc: iounmap() arg is volatile
** m | e1b5b0619 1f65ea .+ | media: vivid: dev->bitmap_cap wasn't freed in all cases
** m | 795afe0b9 8bdc2a o+ | net: sched: Fix use after free in red_enqueue()
** m | d81370396 d37de9 o+ | btrfs: fix ulist leaks in error paths of qgroup self tests
** m | dc30e05bb 3aff8a o+ | Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
** m | b670996ca 038ee4 o | serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
** m | 8d4ceb13d e103ba o | net: usb: qmi_wwan: add Telit 0x103a composition
** m | 89840b12c f7e942 o | btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
** m | 2f2c59506 f0a0cc o | nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
** m | 02c468589 17b57b o | arm: dts: rockchip: fix node name for hym8563 rtc
** m | 1a1d9be7b ad7f40 .+ | xen/netback: Ensure protocol headers don't fall in the non-linear area
** m | b41eab579 74e7e1 .+ | xen/netback: don't call kfree_skb() with interrupts disabled
** m | a0e661a7d c981cd o+ | mmc: sdhci: Fix voltage switch delay
** m | 4749c5cc1 45fecd .+ | gpio: amd8111: Fix PCI device reference count leak
** m | 62ae69ea7 743117 o+ | tipc: Fix potential OOB in tipc_link_proto_rcv()
** m | fbc70a04a 7dfa76 .+ | xen/netback: fix build warning
** m | cb0f2530f 16d055 o | udf: Discard preallocation before extending file with a hole
** m | eee369a46 1f3868 o | udf: Fix extending file within last block
** m | bd1c152be 94a7ad .+ | media: vivid: fix compose size exceed boundary
** m | c2fe0cac3 c2f292 o+ | wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware()
** m | 3f418ad65 39c1eb o+ | Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
** m | 52dc66bf4 415565 o+ | scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
** m | 694bd441a 04ba54 .+ | crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
** m | 2210b22c7 02cd30 .+ | cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()
** m | c3595370a 6a46bf o | binfmt_misc: fix shift-out-of-bounds in check_special_flags
** m | 548d04953 cfd3ff . | clk: st: Fix memory leak in st_of_quadfs_setup()
** m | 215d58e8c 1db1f3 o | HID: wacom: Ensure bootloader PID is usable in hidraw mode
** m | 5f578bbe1 8508fa . | ALSA: line6: correct midi status byte when receiving data from podxt
** m | 887f47cf9 341097 o | md: fix a crash in mempool_free

Everything else was either
- ignored because it doesn't apply or causes regressions, and was deemed non-essential, or
- included because it applied cleanly and doesn't cause regressions.

See v4.4.org for details.

There are also a few fixes for previous backports that need to be reviewed:

e80d1e591dbba xen/gntalloc: fix backport of "xen/gntalloc: don't use gnttab_query_foreign_access()"
baf4fff4a69b7 Revert "hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING"
a5387f2e581e5 xen/blkfront: fix backport of "xen/blkfront: don't use gnttab_query_foreign_access() for mapped status"

For updating 4.4-cip tree, just checkout linux-4.4.y-cip and merge
-st.

Will do.

CU
Uli

Hi!

- update v4.4.org

Done.
(For those playing along, that's at https://gitlab.com/cip-project/cip-kernel/lts-commit-list/-/raw/master/v4.4.org )

For patches that were applied automatically, I don't think we need to
additional review. For the others, I guess you should send list to
cip-dev, and someone will take a look.

These are the patches I had to touch up manually:

Ok, let me take a look.

Ok, I'm a bit confused. I remember working these patches, and I do not
see your sign-offs. If you checked them, I guess I don't need to go
through them at this point.

| 9cb1ee33e a36e50 .+ | drm/msm/hdmi: check return value after calling platform_get_resource_byname()
| c132f2ba7 ddbd89 o | swiotlb: fix info leak with DMA_FROM_DEVICE
| fd97de9c7 901c72 o | Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
| 136b47994 190cc8 o | tcp: change source port randomizarion at connect() time
| 05a12e5c4 c579bd o | tcp: add some entropy in __inet_hash_connect()
| 576696ed0 b2d057 o | secure_seq: use the 64 bits of the siphash for port offset calculation
| 2ed413f14 9e9b70 o | tcp: use different parts of the port_offset for index and offset
| aa7722529 ca7af0 o | tcp: add small random increments to the source port
| dd82067bd e92614 o | tcp: dynamically allocate the perturb table used by source ports
| 3c78eea64 4c2c8f o | tcp: increase source port perturb table to 2^16
| a81a6b204 e81613 o | tcp: drop the hash_32() part from the index calculation

These look okay:

a | ed71adaa8 17d3df o | cifs: don't send down the destination address to sendmsg for a SOCK_STREAM
a | 6eb181a64 60deb9 o | wifi: mac80211: Fix UAF in ieee80211_scan_rx()
a | e2b46cd57 81225b o+ | ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
a | f8a1ac3db 544042 .+ | can: gs_usb: gs_can_open(): fix race dev->can.state condition
a | 146357504 c292a3 o+ | nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
a | 27c2c6d35 1b24a1 .+ | clk: iproc: Do not rely on node name for correct PLL setup
a | bb63454b6 21a87d o | nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
a | b63026b5e 723ac7 o | nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure

Might be better to backport the dependencies... or ignore. Anyway, it
is good as it is too:

-- | c4a13e588 56e696 o | ALSA: hda: Fix position reporting on Poulsbo

These look okay:

a | a9043a24c d325dc o | nilfs2: fix use-after-free bug of struct nilfs_root
a | cf3166691 620d5e .+ | wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
a | c202cda08 668a8f o+ | drm/mipi-dsi: Detach devices when removing the host
a | 9183a37d3 551e32 .+ | HSI: omap_ssi_port: Fix dma_map_sg error check

You merged two patches here. I guess we can live with it.

-- | 7b0efe753 1c78f1 .+ | media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init

These look ok:

a | 2319e8f80 9c6e09 o+ | ata: fix ata_id_has_devslp()
a | e01f64a34 630624 o+ | ata: fix ata_id_has_dipm()
a | d96732831 898ec8 o+ | dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
a | 508a9b8a8 110024 o | openvswitch: Fix double reporting of drops in dropwatch
a | 56761647e 3fd7bf o | can: bcm: check the result of can_send() in bcm_can_tx()
a | 0adda6e12 c44f15 .+ | arc: iounmap() arg is volatile
a | e1b5b0619 1f65ea .+ | media: vivid: dev->bitmap_cap wasn't freed in all cases
a | 795afe0b9 8bdc2a o+ | net: sched: Fix use after free in red_enqueue()
a | d81370396 d37de9 o+ | btrfs: fix ulist leaks in error paths of qgroup self tests
a | dc30e05bb 3aff8a o+ | Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu

Patch "arc: iounmap() arg is volatile" is not something I'd bother
backporting.

I'll continue tommorow.

Thanks for doing this and best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

On 01/15/2023 11:09 PM CET Pavel Machek <pavel@...> wrote:
Ok, I'm a bit confused. I remember working these patches, and I do not
see your sign-offs. If you checked them, I guess I don't need to go
through them at this point.

| 9cb1ee33e a36e50 .+ | drm/msm/hdmi: check return value after calling platform_get_resource_byname()
| c132f2ba7 ddbd89 o | swiotlb: fix info leak with DMA_FROM_DEVICE
| fd97de9c7 901c72 o | Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
| 136b47994 190cc8 o | tcp: change source port randomizarion at connect() time
| 05a12e5c4 c579bd o | tcp: add some entropy in __inet_hash_connect()
| 576696ed0 b2d057 o | secure_seq: use the 64 bits of the siphash for port offset calculation
| 2ed413f14 9e9b70 o | tcp: use different parts of the port_offset for index and offset
| aa7722529 ca7af0 o | tcp: add small random increments to the source port
| dd82067bd e92614 o | tcp: dynamically allocate the perturb table used by source ports
| 3c78eea64 4c2c8f o | tcp: increase source port perturb table to 2^16
| a81a6b204 e81613 o | tcp: drop the hash_32() part from the index calculation

That's a cut-and-paste error on my side, these are in the current release already.

I'll continue tommorow.

Thanks!

CU
Uli

Hi!

Thank you. I reviewed these, and they seem ok. I'd not bother
backporting patches marked (), but they should not harm.

a | b670996ca 038ee4 o | serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
() a | 8d4ceb13d e103ba o | net: usb: qmi_wwan: add Telit 0x103a composition
a | 89840b12c f7e942 o | btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
a | 2f2c59506 f0a0cc o | nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
a | 02c468589 17b57b o | arm: dts: rockchip: fix node name for hym8563 rtc
a | 1a1d9be7b ad7f40 .+ | xen/netback: Ensure protocol headers don't fall in the non-linear area
a | b41eab579 74e7e1 .+ | xen/netback: don't call kfree_skb() with interrupts disabled
a | a0e661a7d c981cd o+ | mmc: sdhci: Fix voltage switch delay
a | 4749c5cc1 45fecd .+ | gpio: amd8111: Fix PCI device reference count leak
a | 62ae69ea7 743117 o+ | tipc: Fix potential OOB in tipc_link_proto_rcv()
a | fbc70a04a 7dfa76 .+ | xen/netback: fix build warning
a | cb0f2530f 16d055 o | udf: Discard preallocation before extending file with a hole
a | eee369a46 1f3868 o | udf: Fix extending file within last block
a | bd1c152be 94a7ad .+ | media: vivid: fix compose size exceed boundary
() a | c2fe0cac3 c2f292 o+ | wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware()
a | 3f418ad65 39c1eb o+ | Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
a | 52dc66bf4 415565 o+ | scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
() a | 694bd441a 04ba54 .+ | crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
a | 2210b22c7 02cd30 .+ | cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()
a | c3595370a 6a46bf o | binfmt_misc: fix shift-out-of-bounds in check_special_flags
a | 548d04953 cfd3ff . | clk: st: Fix memory leak in st_of_quadfs_setup()
() a | 215d58e8c 1db1f3 o | HID: wacom: Ensure bootloader PID is usable in hidraw mode
() a | 5f578bbe1 8508fa . | ALSA: line6: correct midi status byte when receiving data from podxt
a | 887f47cf9 341097 o | md: fix a crash in mempool_free

There are also a few fixes for previous backports that need to be reviewed:

And these look okay to me, too.

a > e80d1e591dbba xen/gntalloc: fix backport of "xen/gntalloc: don't use gnttab_query_foreign_access()"
a > baf4fff4a69b7 Revert "hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING"
a > a5387f2e581e5 xen/blkfront: fix backport of "xen/blkfront: don't use gnttab_query_foreign_access() for mapped status"

Thanks and best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

On 01/17/2023 9:50 PM CET Pavel Machek <pavel@...> wrote:
And these look okay to me, too.

Thank you very much. I have since included the few remaining patches from the final 4.9.377 release. There is one trivial backport in it that I'm mentioning here for the record:

** m | 0588b12c4 6b0d04 o+ | media: dvb-core: Fix double free in dvb_register_device()

I have also added a fix for CVE-2023-0047 that is in 4.9.291, but for reasons unknown to me wasn't backported to 4.4 before we took over:

39bdf0444b238 mm, oom: do not trigger out_of_memory from the #PF

CU
Uli