Re: [PATCH 4.19-stable 4/5] spi: bcm2835aux: Fix use-after-free on unbind

From: Greg KH <gregkh@linuxfoundation.org>
To: Lukas Wunner <lukas@wunner.de>
Cc: Sasha Levin <sashal@kernel.org>,
	Nathan Chancellor <natechancellor@gmail.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.com>,
	Mark Brown <broonie@kernel.org>,
	Sudip Mukherjee <sudipm.mukherjee@gmail.com>,
	stable@vger.kernel.org
Subject: Re: [PATCH 4.19-stable 4/5] spi: bcm2835aux: Fix use-after-free on unbind
Date: Wed, 9 Dec 2020 10:36:55 +0100	[thread overview]
Message-ID: <X9Cat0z0YBZkXlvv@kroah.com> (raw)
In-Reply-To: <20201209083747.GA7377@wunner.de>

On Wed, Dec 09, 2020 at 09:37:47AM +0100, Lukas Wunner wrote:
> On Tue, Dec 08, 2020 at 04:17:45PM -0500, Sasha Levin wrote:
> > On Tue, Dec 08, 2020 at 06:11:45PM +0100, Lukas Wunner wrote:
> > > On Tue, Dec 08, 2020 at 08:47:39AM -0500, Sasha Levin wrote:
> > > > Could we instead have the backports exhibit the issue (like they did
> > > > upstream) and then take d853b3406903 on top?
> > > 
> > > The upstream commit e13ee6cc4781 did not apply cleanly to 4.19 and earlier,
> > > several adjustments were required.  Could I have made it so that the fixup
> > > d853b3406903 would have still been required?  Probably, but it seems a
> > > little silly to submit a known-bad patch.
> [...]
> > 2. It'll make auditing later easier. What will happen now is that after
> > this patch is merges, we'll trigger a warning saying that there's a fix
> > upstream for one of these patches, and we'll end up wasting the time (of
> > probably a few folks) figuring this out.
> 
> Would it be possible to amend the tooling such that multiple
> "[ Upstream commit ... ]" lines are supported at the top of
> the commit message, signifying that the backport patch
> subsumes all cited upstream commits?

You could, but that's extra work, which I think you are trying to avoid
when you say:

> Could the extra work for stable maintainers be avoided that way?

this :)

> I imagine there might be more cases where a "clean" backport is
> not possible, requiring multiple upstream patches to be combined.

It is quite rare.  And again, it's almost always better to just take all
of the patches involved, as individual patches, that way we "know" we
did it right, and it's easier to track and audit and review that way.

> > Note I'm not asking to submit a broken patch, but I'm asking to submit a
> > minimal backport followed by the upstream fix to that upstream bug :)
> 
> Then please apply the series sans bcm2835aux patch and I'll follow up
> with a two-patch series specifically for that driver.

Can you just resend the whole series so we know we got it correct?

thanks,

greg k-h