Re: [PATCH net] rxrpc: Fix rxrpc_sock UAF caused by missing poke in rxrpc_abort_eproto()

[Juan Agustin Niccolini <juanagusnicco@gmail.com>]

> If you believe none of the issues are legitimate, please reply to each
> issue of Medium severity or higher and explain why the AI is wrong.
> If any of them are legitimate and you plan to respin, please let patchwork
> know by including "pw-bot: cr" as a separate line at the end of your reply
> (one such reply per series is enough).
>
> - [Critical] The patch only makes the stranded-call UAF a race.
> - [High] rxrpc: race on call->_state in rxrpc_abort_eproto() outside I/O
>   thread

#2 is a real issue but wildly exaggerated.  #1 is real.  Neither was
caused by my patch, and I was already aware of both.

#1, the "critical" one, was found by my LLMs on October 29 and raised
with the maintainers and security@kernel.org on a private thread, along
with its patch and reproducer.  The reproducer triggers a UAF on
mainline without touching any of the code paths my patch touches,
which shows it was not introduced by it.  I will send that patch to
netdev now, since Sashiko has made the issue public.

#2 is a race that is nanoseconds wide, cannot be meaningfully widened
on non-RT kernels, and yields nothing exploitable if won; its severity
is low at best.

My patch did not cause either issue, nor did it make them worse than
they already are.  It is compatible with the patch that addresses #1.
Note that the issue my patch fixes is significantly worse, since that
UAF is deterministic and has a reliable LPE exploit.  I recommend
addressing it soon; the patch has been available since October 11.

Best,
Agustin