I've attached the following fixes to 4.4, as an mbox:
- binder: Replace "%p" with "%pK" for stable - binder: replace "%p" with "%pK" - net: create skb_gso_validate_mac_len() - bnx2x: disable GSO where gso_size is too big for hardware - brcmfmac: Add length checks on firmware events - brcmfmac: screening firmware event packet - brcmfmac: revise handling events in receive path - brcmfmac: fix incorrect event channel deduction - brcmfmac: add length checks in scheduled scan result handler - brcmfmac: add subtype check for event handling in data path - userfaultfd: don't pin the user memory in userfaultfd_file_create() - coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping
The userfaultfd commit might not be a security fix but the next one depends on it.
Ben.