Request for review for 4.4-st78, 4.4-cip113

Hi!

Here are the manual backports for the upcoming 4.4 kernel release. As always they can be found in https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git/log/?h=linux-4.4.y-st-rc

6fc536e081b4e cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() a70db8dc8aa2d bcache: fix cached_dev.sb_bio use-after-free and crash d6dc394717b9d can: mcp251x: add error handling for power enable in open and resume 270f518e2aab7 batman-adv: tt: fix negative tt_buff_len
b9d56f0fa7881 batman-adv: tt: fix negative last_changeset_len
2ea84dbb4204d batman-adv: frag: disallow unicast fragment in fragment 3075eb7fe5a6a batman-adv: fix fragment reassembly length accounting 5c81177e39927 batman-adv: clear current gateway during teardown
516397de58548 net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() 2c14f681cb8ca netfilter: nf_conntrack_sip: don't use simple_strtoul a177703144795 netfilter: arp_tables: fix IEEE1394 ARP payload parsing 90d4b856cc573 netfilter: conntrack: remove sprintf usage
a5e1c4172bf7b sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks a4e3e33596f1b HID: usbhid: fix deadlock in hid_post_reset()
b2df99543367b ALSA: core: Validate compress device numbers without dynamic minors a856ea763a0c8 batman-adv: bla: put backbone reference on failed claim hash insert 420d73ca52ee2 batman-adv: bla: only purge non-released claims
283a66b993a78 batman-adv: bla: prevent use-after-free when deleting claims 1f1f946bac592 power: supply: max17042: avoid overflow when determining health 0bd353e476ab2 fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free e27540595d282 md/raid5: fix soft lockup in retry_aligned_read()
16b4cbdf426d7 lib/ts_kmp: fix integer overflow in pattern length calculation f03a0d998b054 ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() 7d2c7f0155186 gfs2: Validate i_depth for exhash directories
06c757446f45d rxrpc: reject undecryptable rxkad response tickets
f842b70abca24 wifi: brcmfmac: validate bsscfg indices in IF events

Thanks for having a look!

CU
Uli

Hi!

For now, I have not checked the batman-adv stuff. Two comments below.

a > 6fc536e081b4e cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
a > a70db8dc8aa2d bcache: fix cached_dev.sb_bio use-after-free and crash
a operation order in error handling does not match initialization > d6dc394717b9d can: mcp251x: add error handling for power enable in open and resume

a > 516397de58548 net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
a introduces stricter parsing > 2c14f681cb8ca netfilter: nf_conntrack_sip: don't use simple_strtoul a > a177703144795 netfilter: arp_tables: fix IEEE1394 ARP payload parsing
a > 90d4b856cc573 netfilter: conntrack: remove sprintf usage
a > a5e1c4172bf7b sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
a just a robustness against fairly interesting device > a4e3e33596f1b HID: usbhid: fix deadlock in hid_post_reset() a also removes a comment > b2df99543367b ALSA: core: Validate compress device numbers without dynamic minors

a just a fix for unusual dts > 1f1f946bac592 power: supply: max17042: avoid overflow when determining health
! no dec in munmap? , c/e, will we now have framebuffer refusing resize? > 0bd353e476ab2 fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free

I don't see how this works. mmap_count is increased in mmap, but I don't see corresponding decrease in munmap.

a > e27540595d282 md/raid5: fix soft lockup in retry_aligned_read()
! check_mul_overflow -- is it generic for all types? does sizeof > return size_t?...? > 16b4cbdf426d7 lib/ts_kmp: fix integer overflow in pattern length calculation

+ unsigned int prefix_tbl_len;
+ if (unlikely(check_mul_overflow(len, sizeof(*kmp->prefix_tbl),
+ &prefix_tbl_len) ||

AFAICT sizeof returns size_t, so I'd be much if prefix_tbl_len was size_t, too.

a just clang fortify workaround > f03a0d998b054 ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() a > 7d2c7f0155186 gfs2: Validate i_depth for exhash directories
a > 06c757446f45d rxrpc: reject undecryptable rxkad response tickets
a > f842b70abca24 wifi: brcmfmac: validate bsscfg indices in IF events

Best regards,
Pavel

Hi!

Thanks for the reviews.

[...]

Yup, same issue in mainline, it seems. I'll drop it.

Fair enough, but that's how it is in mainline, and unless there is something actually broken I'd prefer to keep it that way to avoid conflicts with future patches.

CU
Uli

Hi Ulrich,

Thanks for your update.

I reviewed this series, There doesn't seem to be issue.

Best regards,
Nobuhiro