Re: wild pointer access in rsvp classifer in the Linux kernel <= v6.2

[Kyle Zeng <zengyhkyle@gmail.com>]

On Sat, Sep 16, 2023 at 01:41:33PM +0200, Greg KH wrote:
> On Wed, Sep 13, 2023 at 05:04:16PM -0700, Kyle Zeng wrote:
> > On Wed, Sep 13, 2023 at 10:12:55AM +0200, Greg KH wrote:
> > > On Mon, Sep 11, 2023 at 07:51:38PM -0700, Kyle Zeng wrote:
> > > > On Fri, Sep 08, 2023 at 07:17:12AM +0100, Greg KH wrote:
> > > > > Great, can you use 'git bisect' to track down the commit that fiexes
> > > > > this so we can add it to the stable trees?
> > > > Sorry for the late reply. I think the fix was to completely retire the
> > > > rsvp classifier and the commit is:
> > > > 
> > > > 265b4da82dbf5df04bee5a5d46b7474b1aaf326a (net/sched: Retire rsvp classifier)
> > > 
> > > Great, so if we apply this change, all will work properly again?  How
> > > far back should this be backported to?
> > > 
> > > thanks,
> > > 
> > > greg k-h
> > 
> > > Great, so if we apply this change, all will work properly again?
> > Yes, after applying the patch (which is to retire the rsvp classifier),
> > it is no longer possible to trigger the crash.
> > However, you might want to decide whether it is OK to retire the
> > classifier in stable releases.
> > 
> > > How far back should this be backported to?
> > I tested all the stable releases today, namely, v6.1.y, v5.15.y,
> > v5.10.y, v5.4.y, v4.19.y, and v4.14.y. They are all affected by this
> > bug. I think the best approach is to apply the patch to all the stable
> > trees.
> 
> Great, can you provide backported patches to those trees so that we can
> queue this up for them?
> 
> thanks,
> 
> greg k-h

I backported the patch to all the mentioned affected versions and I used
my poc code to make sure that the crash is no longer triggerable after
applying the patch.

The patches are sent separately with [PATCH <version>] tags.

Thanks,
Kyle Zeng