On Thu, Aug 16, 2018 at 03:19:12PM +0800, maowenan wrote: > On 2018/8/16 14:52, Michal Kubecek wrote: > > > > My point is that backporting all this into stable 4.4 is quite intrusive > > so that if we can achieve similar results with a simple fix of an > > obvious omission, it would be preferrable. > > There are five patches in mainline to fix this CVE, only two patches > have no effect on stable 4.4, the important reason is 4.4 use simple > queue but mainline use RB tree. > > I have tried my best to use easy way to fix this with dropping packets > 12.5%(or other value) based on simple queue, but the result is not > very well, so the RB tree is needed and tested result is my desire. > > If we only back port two patches but they don't fix the issue, I think > they don't make any sense. There is an obvious omission in one of the two patches and Takashi's patch fixes it. If his follow-up fix (applied on top of what is in stable 4.4 now) addresses the problem, I would certainly prefer using it over backporting the whole series. Michal Kubecek
