Re: [PATCH] net/sched: sch_qfq: prevent aggregate self-replacement

[Jamal Hadi Salim]

On Sun, Oct 25, 2026 at 5:03 AM Jamal Hadi Salim <jhs@xxxxxxxxxxxx> wrote:
>
> On Thu, Oct 22, 2026 at 5:14 AM Jamal Hadi Salim <jhs@xxxxxxxxxxxx> wrote:
> >
> > On Wed, Oct 21, 2026 at 10:56 AM David Lee <david.lee@xxxxxxxxxxxxxxx> wrote:
> > >
> > > Hi Jamal,
> > >
> > > Following up on this thread. Please let me know if you had a chance to review the attached reproducer or if you need any additional information.
> > >
> >
> > Please resend to the list - I lost track.
> > And if you follow up after like 2 months(!) you will really have to
> > retest with the new kernel and likely look at the list to see if there
> > are other fixes that cover this issue.
> >
>
> Before i try to reproduce (then proper review) please resend
> addressing the issues raised by the sashikos. They are legit.


IOW, send a v2 with the following addressed; I may have missed some
things Sven pointed out:

1. Sign-off chain: the patch is From: you but only Kyle signs off.
Read Documentation/process/submitting-patches.rst, add your own
Signed-off-by: as well (and a From: Kyle Zeng / Co-developed-by: chain
if he authored the fix). As sent, the DCO chain is broken and the DCO
check will flag it.

2. No blank lines in the trailer block, and replace the prose "Bug
found and triaged by OpenAI Security Research and validated by Trail
of Bits." with machine-parsable trailers (e.g. Reported-by: for the
finder and a Link: to the report). The "Assisted-by:" trailer is not
one of the standard tags - please drop it or convert it to a standard
one.

3. Add "Cc: stable@xxxxxxxxxxxxxxx" - the Fixes commit is from the
original QFQ Plus merge, and this UAF is reachable with CAP_NET_ADMIN
in a user+net namespace, so the stable trees will want it.

4. Use the [PATCH net] subject prefix in v2 (this is a fix for the
current tree).

The patch looks sane, as I said earlier, but there are just too many
incoming and too many fixes over the last 2 months - so i just trigger
our automated system to ensure it is reproducible first before I look
at anything (and i would like to maintain that discipline/workflow).


cheers,
jamal