Question on page length clamping in hash walk fix and syscall crashes

Question on page length clamping in hash walk fix and syscall crashes

[Xavier Roche]

Hi folks,

We stumble upon an issue while using an AF_ALG socket to compute a hash 
(crc32) directly in the kernel (using splice magic)

The issue has been fixed AFAICS by Herbert Xu in 
cc440a5b68873b7b98c3130d09a69a1b13acb0b7 in a rather isolated patch (three 
lines diff)

I could validate that the patch does indeed fix the issue we were having.

This bug seems to be more than a computation issue, as we experienced 
weird crashes in random syscall when it is triggered (ie. unpatched), 
such as fork, or futex-related primitives (!).

The issue can be reproduced with this standalone program:
https://bitbucket.org/scality/xavier-sandbox-public/raw/HEAD/kernel/issues/splicertest.c

Most up-to-date stable distro are using the buggy version (Centos 7: 
3.10.0, Ubuntu trusty: 3.13.0, Fedora 22: 4.3.6, etc.)

Question: is the weird behavior observed (crashes inside kernel) 
"normal" w.r.t this issue, and how cherry-pick policy is organized w.r.t 
older kernel releases (LTS only ?)

[ Typically the bug does not appear in 3.14.70, 3.16.0, 3.19.0 or 4.2.0 ]

And sorry in advance if this question has already been answered, but I 
could not find any clear hint.