Re: [stable request] ROSE memory-safety fixes for 7.0.y and earlier (merged out-of-tree in linux-netdev/mod-orphan)

Hi Greg,

Thanks, much appreciated.

Short answer: yes, the same series applies to 6.18.y, and the same bugs
exist in the older trees too -- but only 7.0.y and 6.18.y take the series
as-is. ROSE was removed in 7.1, so every stable line up to and including
7.0.y still carries this code and is affected.

I just test-applied this exact mbox with "git am" against the current
ROSE files of each tree:

v7.0.13 : clean, 15/15 (what I sent you)
linux-6.18.y : clean, 15/15, no conflicts -- the teardown code is
identical to 7.0.13
linux-6.12.y : applies up to patch 3, then conflicts in
rose_loopback.c (the loopback/timer code predates one
of the refactors the series builds on)
linux-6.6.y / 6.1.y / 5.15.y : same, conflict at the same patch

So for 6.18.y I can send an identical batch right away. For 6.12.y and
the older LTS lines the fixes are still needed, but they need a rebased
backport rather than a straight cherry-pick; I'm happy to prepare those
per-tree once the format is settled.

My suggestion, matching what you said: let's land this 7.0.y batch first
to work out the workflow. As soon as it's in I'll send the (identical)
6.18.y batch, and then the rebased older-tree batches one line at a time.
Whatever order is easiest on your side works for me.

Thanks again,
Bernard, F6BVP


Le sam. 20 juin 2026 =C3=A0 12:52, Greg KH <[email protected]> a =
=C3=A9crit :
>
> On Sat, Jun 20, 2026 at 12:37:16PM +0200, Bernard Pidoux wrote:
> > Hi Greg, all,
> >
> > Sorry about that -- my mail client dropped the list and Jakub from the
> > recipients on the previous message; I did not intend to take it off-lis=
t.
> > Resending the same note to everyone, with the mbox attached again.
> >
> > I have prepared a first set, attached as an mbox: 15 ROSE fixes for the
> > 7.0.y stable tree (7.0.y is the last stable line that still ships ROSE,
> > since it was removed in 7.1). They are the use-after-free, refcount and
> > teardown-race fixes I developed and merged in the linux-netdev/mod-orph=
an
> > tree, where ROSE now lives.
> >
> > As Greg asked, every patch carries a
> >
> > (cherry picked from commit <id>)
> >
> > trailer pointing at the exact git id in mod-orphan it was taken from, s=
o
> > they can be tracked across releases.
> >
> > The whole series applies cleanly with "git am" on top of v7.0.13 (no
> > conflicts, no fuzz). The 15 fixes form one coherent set -- the three
> > core UAF fixes build on the earlier refactors in the same series, so th=
ey
> > cannot be cherry-picked in isolation; this is why I send the full set a=
s
> > the first batch.
> >
> > Please let me know if you would prefer a different format (individual
> > mails via git send-email, extra trailers, etc.) and I will adjust. I am
> > happy to follow up once this batch has gone through.
>
> Great, does this series also apply to 6.18.y and/or any older trees?  Or
> should I just worry about this branch for now while we work out the
> workflow?
>
> And at first glance, this looks great.  I'll try to apply these on
> Monday and let you know how it goes.
>
> thanks,
>
> greg k-h