Re: [PATCH 6.18.y 1/2] hsr: Implement more robust duplicate discard for PRP

[Felix Maurer <fmaurer@redhat.com>]

On Mon, Jun 01, 2026 at 09:52:22AM +0200, Sebastian Andrzej Siewior wrote:
> On 2026-05-29 19:24:05 [-0400], Sasha Levin wrote:
> > From: Felix Maurer <fmaurer@redhat.com>
> >
> > [ Upstream commit 415e6367512bf8faca93eaaf46fbe23d841b4509 ]
> >
> …
> > Reported-by: Steffen Lindner <steffen.lindner@de.abb.com>
> > Signed-off-by: Felix Maurer <fmaurer@redhat.com>
> > Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> > Tested-by: Steffen Lindner <steffen.lindner@de.abb.com>
> > Link: https://patch.msgid.link/8ce15a996099df2df5b700969a39e7df400e8dbb.1770299429.git.fmaurer@redhat.com
> > Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> > Stable-dep-of: aaec7096f996 ("net: hsr: defer node table free until after RCU readers")
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
>
> This is sort of big. It should not introduce any regressions and if so
> we need to fix them anyway so early exposer might be good. However
> aaec7096f9961 ("net: hsr: defer node table free until after RCU
> readers") should be backported down to v5.10-stable so I wonder if
> taking this huge patch is economic for this two liner fix going down the
> road.

I agree, taking the big commit above down to v5.10 probably isn't a good
idea, just for this fix. It should be easy to build a small version of
415e6367512b ("hsr: Implement more robust duplicate discard for PRP")
that just has the changes needed to apply (a slightly modified version
of) aaec7096f996 ("net: hsr: defer node table free until after RCU
readers"), i.e., the changes that introduce list_del() and thereby fix
that the nodes were just freed before 415e6367512b and not removed from
the list at all (which would be another UAF). That should apply to 6.18
and probably to most releases below as well.

I don't really know the guidelines around the stable trees. Do we want
such (heavily modfied) patches so that others can be applied?

Thanks,
   Felix