Re: Patch "xfrm: propagate extack to all netlink doit handlers" has been added to the 5.10-stable tree

Re: Patch "xfrm: propagate extack to all netlink doit handlers" has been added to the 5.10-stable tree

[Sabrina Dubroca]

2026-09-21, 15:31:29 -0400, Sasha Levin wrote:
> This is a note to let you know that I've just added the patch titled
> 
>     xfrm: propagate extack to all netlink doit handlers
> 
> to the 5.10-stable tree which can be found at:
>     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

alongside:

xfrm: add extack to verify_sec_ctx_len
xfrm: add extack support to verify_newsa_info
xfrm: add extack to verify_one_alg, verify_auth_trunc, verify_aead
xfrm: avoid RCU warnings around the per-netns netlink socket

You're backporting all this stuff to avoid a completely trivial
conflict on the nlmsg_unicast call in the context for d1ebd9081879? :/

I'd say skip the backport if it's that much trouble, but of course
someone's LLM will come up with an "exploit" and a stupid name for the
bug. meh.

-- 
Sabrina

Re: Patch "xfrm: propagate extack to all netlink doit handlers" has been added to the 5.10-stable tree

[Sasha Levin]

> You're backporting all this stuff to avoid a completely trivial
> conflict on the nlmsg_unicast call in the context for d1ebd9081879? :/

Yes, and you are right that the conflict is trivial. The deps went in so that
d1ebd9081879 ("xfrm: fix compat ALLOCSPI request use-after-free") stays a
mechanical cherry-pick on every tree instead of a hand-resolved one.

This makes it much easier for us to maintain the trees for longer, as there are
less conflicts we will need to resolve in the future.

-- 
Thanks,
Sasha

Re: Patch "xfrm: propagate extack to all netlink doit handlers" has been added to the 5.10-stable tree

[Sabrina Dubroca]

2026-09-22, 11:39:00 -0400, Sasha Levin wrote:
> > You're backporting all this stuff to avoid a completely trivial
> > conflict on the nlmsg_unicast call in the context for d1ebd9081879? :/
> 
> Yes, and you are right that the conflict is trivial. The deps went in so that
> d1ebd9081879 ("xfrm: fix compat ALLOCSPI request use-after-free") stays a
> mechanical cherry-pick on every tree instead of a hand-resolved one.
> 
> This makes it much easier for us to maintain the trees for longer, as there are
> less conflicts we will need to resolve in the future.

I'm quite familiar with that problem. Oh well, I guess those other
patches are correct enough when applied on top of this old stuff.

-- 
Sabrina