# Stable Kernel Patches Review Status
Please list your name and review result below the patch item

  * UR:  Under Review
  * ACK: Acknowledge (if the patch is accepted)
  * TBB: To be backported (if other patches should be also backported)
  * NAK: Negative acknowledge (if the patch is rejected, please list the reason)
  * IGN: Patch was not reviewed as it is out of scope for CIP project


## v4.4.181
  - d7b7345 Linux 4.4.181
  - f1d7eeb ethtool: check the return value of get_regs_len
  - 647f72b ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
  - c9696a8 fuse: Add FOPEN_STREAM to use stream_open()
  - 3bf0c45 fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock
  - 0f5fab8 drm/gma500/cdv: Check vbt config bits when detecting lvds panels
  - e087f75 genwqe: Prevent an integer overflow in the ioctl
  - 59565e8 MIPS: pistachio: Build uImage.gz by default
  - 8061c23 fuse: fallocate: fix return with locked inode
  - cf30c19 parisc: Use implicit space register selection for loading the coherence index of I/O pdirs
  - f0d1e74 rcu: locking and unlocking need to always be at least barriers
  - 44657db pktgen: do not sleep with the thread lock held.
  - eded0b1 net: rds: fix memory leak in rds_ib_flush_mr_pool
  - 54dd5e3 net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query
  - cc47596 neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit
  - e5c6de6 ethtool: fix potential userspace buffer overflow
  - 8795708b media: uvcvideo: Fix uvc_alloc_entity() allocation alignment
  - 2b13a95 usb: gadget: fix request length error for isoc transfer
  - 8b15aae net: cdc_ncm: GetNtbFormat endian fix
  - 613b4bc Revert "x86/build: Move _etext to actual end of .text"
  - 6ad730b userfaultfd: don't pin the user memory in userfaultfd_file_create()
  - 4e06554 brcmfmac: add subtype check for event handling in data path
  - 993b68a brcmfmac: add length checks in scheduled scan result handler
  - 35bcfba brcmfmac: fix incorrect event channel deduction
  - 8c12de9 brcmfmac: revise handling events in receive path
  - 5f4688a brcmfmac: screening firmware event packet
  - 6da841e brcmfmac: Add length checks on firmware events
  - c55a2cf bnx2x: disable GSO where gso_size is too big for hardware
  - a33b6d4 net: create skb_gso_validate_mac_len()
  - c53c1a8 binder: replace "%p" with "%pK"
  - 5280efe binder: Replace "%p" with "%pK" for stable
  - 336c166 CIFS: cifs_read_allocate_pages: don't iterate through whole page array on ENOMEM
  - 360f8fe kernel/signal.c: trace_signal_deliver when signal_group_exit
  - 7a47d18 memcg: make it work on sparse non-0-node systems
  - 5db0a9c tty: max310x: Fix external crystal register setup
  - e498745 tty: serial: msm_serial: Fix XON/XOFF
  - 986addd drm/nouveau/i2c: Disable i2c bus access after ->fini()
  - bf8f6b4 ALSA: hda/realtek - Set default power save node to 0
  - 494447b Btrfs: fix race updating log root item during fsync
  - af34de0 scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs (only sdevs)
  - e85d002 scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from port_remove
  - 8282730 media: smsusb: better handle optional alignment
  - 0bce1ea media: usb: siano: Fix false-positive "uninitialized variable" warning
  - b1782be media: usb: siano: Fix general protection fault in smsusb
  - d52c0ff USB: rio500: fix memory leak in close after disconnect
  - b92be99 USB: rio500: refuse more than one device at a time
  - ee9d750 USB: Add LPM quirk for Surface Dock GigE adapter
  - 30e66d7 USB: sisusbvga: fix oops in error path of sisusb_probe
  - 018b7ea USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor
  - f5e1ec9 usb: xhci: avoid null pointer deref when bos field is NULL
  - 017e6726 xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()
  - ec70e2c include/linux/bitops.h: sanitize rotate primitives
  - fbbc4fe sparc64: Fix regression in non-hypervisor TLB flush xcall
  - 5bce46e tipc: fix modprobe tipc failed after switch order of device registration -v2
  - 416d252 Revert "tipc: fix modprobe tipc failed after switch order of device registration"
  - f1613a9 xen/pciback: Don't disable PCI_COMMAND on PCI device reset.
  - 383687e crypto: vmx - ghash: do nosimd fallback manually
  - 61ba8e9 net: mvpp2: fix bad MVPP2_TXQ_SCHED_TOKEN_CNTR_REG queue value
  - 1d33a3e bnxt_en: Fix aggregation buffer leak under OOM condition.
  - 7d42330 tipc: Avoid copying bytes beyond the supplied data
  - 332bff9 usbnet: fix kernel crash after disconnect
  - 16ffb5f net: stmmac: fix reset gpio free missing
  - 4f9c73a net-gro: fix use-after-free read in napi_gro_frags()
  - 5cbaa13 llc: fix skb leak in llc_build_and_send_ui_pkt()
  - 36a7222 ipv6: Consider sk_bound_dev_if when binding a raw socket to an address
  - 9fbf1ac ASoC: davinci-mcasp: Fix clang warning without CONFIG_PM
  - 0984cb7 spi: Fix zero length xfer bug
  - 854415f spi: rspi: Fix sequencer reset during initialization
  - c927451 spi : spi-topcliff-pch: Fix to handle empty DMA buffers
  - 445c074 scsi: lpfc: Fix SLI3 commands being issued on SLI4 devices
  - 3a5d113 media: saa7146: avoid high stack usage with clang
  - 5a96cf1 media: go7007: avoid clang frame overflow warning with KASAN
  - 0e9f080 media: m88ds3103: serialize reset messages in m88ds3103_set_frontend
  - 9effa38 scsi: qla4xxx: avoid freeing unallocated dma memory
  - 95f0bb0 usb: core: Add PM runtime calls to usb_hcd_platform_shutdown
  - 1909121 rcutorture: Fix cleanup path for invalid torture_type strings
  - 1081d04 tty: ipwireless: fix missing checks for ioremap
  - c05b2ed virtio_console: initialize vtermno value for ports
  - 348ec7b media: wl128x: prevent two potential buffer overflows
  - 557ae68 spi: tegra114: reset controller on probe
  - 5e75d5e cxgb3/l2t: Fix undefined behaviour
  - dc2a886 ASoC: fsl_utils: fix a leaked reference by adding missing of_node_put
  - 971e4a2 ASoC: eukrea-tlv320: fix a leaked reference by adding missing of_node_put
  - 5db3c5a HID: core: move Usage Page concatenation to Main item
  - cb7872f chardev: add additional check for minor range overlap
  - 5680f59 x86/ia32: Fix ia32_restore_sigcontext() AC leak
  - 94032b2 arm64: cpu_ops: fix a leaked reference by adding missing of_node_put
  - 04f45a5 scsi: ufs: Avoid configuring regulator with undefined voltage range
  - 60bcfed scsi: ufs: Fix regulator load and icc-level configuration
  - 0a597d2 brcmfmac: fix race during disconnect when USB completion is in progress
  - f95ab00 brcmfmac: convert dev_init_lock mutex to completion
  - db74ef8 b43: shut up clang -Wuninitialized variable warning
  - 951fbf9 brcmfmac: fix missing checks for kmemdup
  - 1d3ee4d rtlwifi: fix a potential NULL pointer dereference
  - 6d7b052 iio: common: ssp_sensors: Initialize calculated_time in ssp_common_process_data
  - e98ef67 iio: hmc5843: fix potential NULL pointer dereferences
  - a86d061 iio: ad_sigma_delta: Properly handle SPI bus locking vs CS assertion
  - 4400dcd x86/build: Keep local relocations with ld.lld
  - 75ffb58 cpufreq: pmac32: fix possible object reference leak
  - 3d04160 cpufreq/pasemi: fix possible object reference leak
  - 4d02f33 cpufreq: ppc_cbe: fix possible object reference leak
  - 6be9235 s390: cio: fix cio_irb declaration
  - 65e3cb0 extcon: arizona: Disable mic detect if running when driver is removed
  - db7eb20 PM / core: Propagate dev->power.wakeup_path when no callbacks
  - 066a286 mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support
  - 6a783be mmc: sdhci-of-esdhc: add erratum eSDHC5 support
  - 8b0e6af mmc_spi: add a status check for spi_sync_locked
  - a30e90a scsi: libsas: Do discovery on empty PHY to update PHY info
  - 915defa hwmon: (f71805f) Use request_muxed_region for Super-IO accesses
  - 0eb8a47 hwmon: (pc87427) Use request_muxed_region for Super-IO accesses
  - 79deb6a hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses
  - 92b4d16 hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses
  - e3e5837 hwmon: (vt1211) Use request_muxed_region for Super-IO accesses
  - 488920a RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure
  - 2ff310e i40e: don't allow changes to HW VLAN stripping on active port VLANs
  - bc791e8 x86/irq/64: Limit IST stack overflow check to #DB stack
  - 3557f08 USB: core: Don't unbind interfaces following device reset failure
  - 6f5e198 sched/core: Handle overflow in cpu_shares_write_u64
  - 9812286 sched/core: Check quota and period overflow at usec to nsec conversion
  - 9d4961a powerpc/numa: improve control of topology updates
  - 8207721 media: pvrusb2: Prevent a buffer overflow
  - ca86559 media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable()
  - a8e0739 audit: fix a memory leak bug
  - ff3038f media: ov2659: make S_FMT succeed even if requested format doesn't match
  - 2d97a3a media: au0828: stop video streaming only when last user stops
  - 115ccd9 media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper
  - 1433d7a media: coda: clear error return value before picture run
  - 5cadb7a dmaengine: at_xdmac: remove BUG_ON macro in tasklet
  - af8b5d7 pinctrl: pistachio: fix leaked of_node references
  - 74dd38a HID: logitech-hidpp: use RAP instead of FAP to get the protocol version
  - 9bffc62 mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions
  - ae6b1f7 x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault()
  - b059848 smpboot: Place the __percpu annotation correctly
  - 28d8827 x86/build: Move _etext to actual end of .text
  - d3eb2ca bcache: avoid clang -Wunintialized warning
  - 7bf3463 bcache: add failure check to run_cache_set() for journal replay
  - d454704 bcache: fix failure in journal relplay
  - 5789884 bcache: return error immediately in bch_journal_replay()
  - 50d25ca net: cw1200: fix a NULL pointer dereference
  - af2fb02 mwifiex: prevent an array overflow
  - 4b24af0 ASoC: fsl_sai: Update is_slave_mode with correct value
  - c104535 mac80211/cfg80211: update bss channel on channel switch
  - a3c50ef dmaengine: pl330: _stop: clear interrupt status
  - 958848a w1: fix the resume command API
  - e416358 rtc: 88pm860x: prevent use-after-free on device remove
  - a898d15 brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler()
  - 5e1a879 spi: pxa2xx: fix SCR (divisor) calculation
  - 3d521a6 ASoC: imx: fix fiq dependencies
  - af283ab powerpc/boot: Fix missing check of lseek() return value
  - dba0320 mmc: core: Verify SD bus width
  - 333e830 cxgb4: Fix error path in cxgb4_init_module
  - 6948c6b gfs2: Fix lru_count going negative
  - 635c71d tools include: Adopt linux/bits.h
  - ed2faf4 perf tools: No need to include bitops.h in util.h
  - a1f254d at76c50x-usb: Don't register led_trigger if usb_register_driver failed
  - f5e4337 ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
  - e39af96 media: vivid: use vfree() instead of kfree() for dev->bitmap_cap
  - a04e71a media: cpia2: Fix use-after-free in cpia2_exit
  - 28eeeb8 fbdev: fix WARNING in __alloc_pages_nodemask bug
  - bf8474c hugetlb: use same fault hash key for shared and private mappings
  - 6bc1539 fbdev: fix divide error in fb_var_to_videomode
  - 5c9a203 btrfs: sysfs: don't leak memory when failing add fsid
  - 0fa8871 Btrfs: fix race between ranged fsync and writeback of adjacent ranges
  - 2f5ac0b gfs2: Fix sign extension bug in gfs2_update_stats
  - 8aae5e9 crypto: vmx - CTR: always increment IV as quadword
  - 582bb52 Revert "scsi: sd: Keep disk read-only when re-reading partition"
  - bd020b3 bio: fix improper use of smp_mb__before_atomic()
  - 603212b KVM: x86: fix return value for reserved EFER
  - 75d63b1 ext4: do not delete unlinked inode from orphan list on failed truncate
  - 3194368 fbdev: sm712fb: fix memory frequency by avoiding a switch/case fallthrough
  - 7d64186 btrfs: Honour FITRIM range constraints during free space trim
  - 57e84e4 md/raid: raid5 preserve the writeback action after the parity check
  - 9013f48 Revert "Don't jump to compute_result state from check_result state"
  - 0c57364 perf bench numa: Add define for RUSAGE_THREAD if not present
  - 66ee750 ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour
  - fc0208b power: supply: sysfs: prevent endless uevent loop with CONFIG_POWER_SUPPLY_DEBUG
  - dd37fa4 KVM: arm/arm64: Ensure vcpu target is unset on reset failure
  - fe4f461 xfrm4: Fix uninitialized memory read in _decode_session4
  - cd08487 vti4: ipip tunnel deregistration fixes.
  - 8fd94b6 xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module
  - 86040d7 xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink
  - daea416 dm delay: fix a crash when invalid device is specified
  - 5660047 PCI: Mark Atheros AR9462 to avoid bus reset
  - 0dc2ad0 fbdev: sm712fb: fix crashes and garbled display during DPMS modesetting
  - 4673eae fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix garbled display
  - c996722 fbdev: sm712fb: fix support for 1024x768-16 mode
  - ebfadb5 fbdev: sm712fb: fix crashes during framebuffer writes by correctly mapping VRAM
  - c92bde5 fbdev: sm712fb: fix boot screen glitch when sm712fb replaces VGA
  - 0d5cd17 fbdev: sm712fb: fix white screen of death on reboot, don't set CR3B-CR3F
  - ca5ce8d fbdev: sm712fb: fix VRAM detection, don't set SR70/71/74/75
  - 6c2fb5b fbdev: sm712fb: fix brightness control on reboot, don't set SR30
  - dbc86a9 perf intel-pt: Fix sample timestamp wrt non-taken branches
  - eedc9a2 perf intel-pt: Fix improved sample timestamp
  - f5da0ae perf intel-pt: Fix instructions sampling rate
  - a5b2e4b memory: tegra: Fix integer overflow on tick value calculation
  - 1198804 tracing: Fix partial reading of trace event's id file
  - a7929c9 ceph: flush dirty inodes before proceeding with remount
  - 3c99cd9 iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114
  - 40857ab fuse: honor RLIMIT_FSIZE in fuse_file_fallocate
  - 7372495 fuse: fix writepages on 32bit
  - 12060f4 clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider
  - 4676a07 NFS4: Fix v4.0 client state corruption when mount
  - e8623e7 media: ov6650: Fix sensor possibly not detected on probe
  - dffc9e5 cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
  - b8ab0c4 of: fix clang -Wunsequenced for be32_to_cpu()
  - 2a98d34 intel_th: msu: Fix single mode with IOMMU
  - bc06577 md: add mddev->pers to avoid potential NULL pointer dereference
  - ade291d stm class: Fix channel free in stm output free path
  - 65d1463 tipc: fix modprobe tipc failed after switch order of device registration
  - ff69bb4 tipc: switch order of device registration to fix a crash
  - 2ff783f ppp: deflate: Fix possible crash in deflate_init
  - dd20e0c net/mlx4_core: Change the error print to info print
  - b2f72a4 net: avoid weird emergency message
  - 70064f7 KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes
  - 5e9bc16 ALSA: hda/realtek - Fix for Lenovo B50-70 inverted internal microphone bug
  - 98529ec ext4: zero out the unused memory region in the extent tree block
  - 9ff6372 fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount
  - bfce20e writeback: synchronize sync(2) against cgroup writeback membership switches
  - cd04237 crypto: arm/aes-neonbs - don't access already-freed walk.iv
  - b70e97a crypto: salsa20 - don't access already-freed walk.iv
  - 6dc48d0 crypto: chacha20poly1305 - set cra_name correctly
  - b820553 crypto: gcm - fix incompatibility between "gcm" and "gcm_base"
  - de087dd crypto: gcm - Fix error return code in crypto_gcm_create_common()
  - 064d0c5 ipmi:ssif: compare block number correctly for multi-part return messages
  - bef039b bcache: never set KEY_PTRS of journal key to 0 in journal_reclaim()
  - 5651075 bcache: fix a race between cache register and cacheset unregister
  - 686e435 Btrfs: do not start a transaction at iterate_extent_inodes()
  - b268b6e ext4: fix ext4_show_options for file systems w/o journal
  - f3b9c26 ext4: actually request zeroing of inode table after grow
  - e5100e7 tty/vt: fix write/write race in ioctl(KDSKBSENT) handler
  - 592a36c mfd: da9063: Fix OTP control register names to match datasheets for DA9063/63L
  - e3a74fb ocfs2: fix ocfs2 read inode data panic in ocfs2_iget
  - b614485 mm/mincore.c: make mincore() more conservative
  - 80cc516 ASoC: RT5677-SPI: Disable 16Bit SPI Transfers
  - e6bf706 ASoC: max98090: Fix restore of DAPM Muxes
  - 2a8188c ALSA: hda/realtek - EAPD turn on later
  - 1bbb08c ALSA: hda/hdmi - Consider eld_valid when reporting jack event
  - 2d89563 ALSA: usb-audio: Fix a memory leak bug
  - b1c1888 crypto: x86/crct10dif-pcl - fix use via crypto_shash_digest()
  - 2ee7c23 crypto: crct10dif-generic - fix use via crypto_shash_digest()
  - 2ee0dd3 crypto: vmx - fix copy-paste error in CTR mode
  - f7dee08 ARM: exynos: Fix a leaked reference by adding missing of_node_put
  - ce814dc x86/speculation/mds: Improve CPU buffer clear documentation
  - 4d68e2b x86/speculation/mds: Revert CPU buffer clear on double fault exit