Hi!

Here are the manual backports for the upcoming 4.4-st38/4.4-cip73 release that should be reviewed, and can currently be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.4.y-st-rc :

ff1d923b1cbd mm/swapfile: add cond_resched() in get_swap_pages()
c2242a203f81 fbcon: Check font dimension limits
0697f3908a1c ipv6: ensure sane device mtu in tunnels
6e1a18831ef9 net: ravb: Fix possible hang if RIS2_QFF1 happen
e15755dd0185 EDAC/device: Respect any driver-supplied workqueue polling value
1e5047422011 net: mlx5: eliminate anonymous module_init & module_exit
8f0e3e6f2ec8 amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
30a61de78f81 usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
70ccdf253245 usb: core: hub: disable autosuspend for TI TUSB8041
9c336605666d USB: hub: Fix the broken detection of USB3 device in SMSC hub
57059c01a09d nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
93215b524bdf hvc/xen: lock console list traversal
7672af7c726f ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
e6f2bae11168 net: sched: disallow noqueue for qdisc classes
e22ac280fe43 qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure
f38b21843014 nilfs2: fix underflow in second superblock position calculations
9a977a3c8fab mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
f09f686242e2 SUNRPC: ensure the matching upcall is in-flight upon downcall
97494d49b7e0 NFSv4.x: Fail client initialisation if state manager thread can't run

That's more than I anticipated because a bunch of patches that seemed to apply cleanly had to be fixed up to actually make sense in 4.4. Nevertheless, most backports are minor adjustments to fit the 4.4 context.

The ones that need closer attention, IMO, are "ipv6: ensure sane device mtu in tunnels" and "nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()". Additional notes can be found in https://gitlab.com/cip-project/cip-kernel/lts-commit-list/-/blob/master/v4.4.org . Thanks.

CU
Uli

Hi!

Here are the manual backports for the upcoming 4.4-st38/4.4-cip73 release that should be reviewed, and can currently be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.4.y-st-rc :

I managed to review most of them.

These are ok:

a > ff1d923b1cbd mm/swapfile: add cond_resched() in get_swap_pages()
a > c2242a203f81 fbcon: Check font dimension limits
a > 0697f3908a1c ipv6: ensure sane device mtu in tunnels
a > 6e1a18831ef9 net: ravb: Fix possible hang if RIS2_QFF1 happen
a not a minimum fix> e15755dd0185 EDAC/device: Respect any driver-supplied workqueue polling value
a not really stable material > 1e5047422011 net: mlx5: eliminate anonymous module_init & module_exit
a not really stable material > 8f0e3e6f2ec8 amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
a cargo cult programming > 30a61de78f81 usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
a not really worth the work > 70ccdf253245 usb: core: hub: disable autosuspend for TI TUSB8041
a > 9c336605666d USB: hub: Fix the broken detection of USB3 device in SMSC hub
a > 93215b524bdf hvc/xen: lock console list traversal
a > e22ac280fe43 qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure
a > f38b21843014 nilfs2: fix underflow in second superblock position calculations
a just an API tweak, do we have 1/ of the series? > 9a977a3c8fab mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
a > f09f686242e2 SUNRPC: ensure the matching upcall is in-flight upon downcall
a > 97494d49b7e0 NFSv4.x: Fail client initialisation if state manager thread can't run

(comments there are really nothing you can do much, but I'd not bother
backporting 1e5047422011 and 8f0e3e6f2ec8).

I believe we should be taking this one. It is mostly theoretical bug,
backport is extensive and we really have no way of testing it:

! syscaller -> theoretical bug. This would really need testing. They
were deleting code from ack_complete. Lets... not? > 57059c01a09d nfc:
pn533: Wait for out_urb's completion in pn533_usb_send_frame()

I'd cite commit # being backported on the first one, and I'll need to
take second look at these:

! cite commit # of the patch being backported? > 7672af7c726f ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
! NL_SET_ERR_MSG? > e6f2bae11168 net: sched: disallow noqueue for qdisc classes

Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Hi!

I'd cite commit # being backported on the first one, and I'll need to
take second look at these:

I'd do "[uli: backport from df02234e6b87d2a9a82acd3198e44bdeff8488c6
to 4.4", but this one looks ok.

! cite commit # of the patch being backported? > 7672af7c726f ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF

NL_SET_ERR_MSG is there in 4.4, but nowhere in the sch_api.c, so I
believe this one is ok, too.

! NL_SET_ERR_MSG? > e6f2bae11168 net: sched: disallow noqueue for qdisc classes

Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Thanks for the reviews.

On 03/09/2023 10:35 PM CET Pavel Machek <pavel@...> wrote:
I believe we should be taking this one. It is mostly theoretical bug,
backport is extensive and we really have no way of testing it:

! syscaller -> theoretical bug. This would really need testing. They
were deleting code from ack_complete. Lets... not? > 57059c01a09d nfc:
pn533: Wait for out_urb's completion in pn533_usb_send_frame()

I have dropped this one...

I'd cite commit # being backported on the first one, and I'll need to
take second look at these:

! cite commit # of the patch being backported? > 7672af7c726f ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF

...and added the commit reference.

CU
Uli