Received-SPF: pass (google.com: domain of linux-kernel+bounces-86509-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Thu, 29 Feb 2024 11:03:28 +0100
From: Pavel Machek <pavel@ucw.cz>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Michal Hocko <mhocko@suse.com>, Kees Cook <keescook@chromium.org>,
	cve@kernel.org, linux-kernel@vger.kernel.org
Subject: Re: CVE-2023-52451: powerpc/pseries/memhp: Fix access beyond end of
 drmem array
Message-ID: <ZeBWcDEECqbDMqsb@duo.ucw.cz>
References: <2024022257-CVE-2023-52451-7bdb@gregkh>
 <Zdylmz28rZ-mCeiN@tiehlicka>
 <2024022639-wronged-grafted-6777@gregkh>
 <ZdytVTOgfvKBBvtn@tiehlicka>
 <202402271029.FD67395@keescook>
 <Zd8hPpP_6q_o8uQW@tiehlicka>
 <202402280906.D6D5590DB@keescook>
 <ZeA-281OudkWBhd_@tiehlicka>
 <2024022915-dissuade-grandson-ebd4@gregkh>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="589ZECv5K4/DtYSN"
Content-Disposition: inline
In-Reply-To: <2024022915-dissuade-grandson-ebd4@gregkh>


--589ZECv5K4/DtYSN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu 2024-02-29 09:35:28, Greg Kroah-Hartman wrote:
> On Thu, Feb 29, 2024 at 09:22:51AM +0100, Michal Hocko wrote:
> > On Wed 28-02-24 09:12:15, Kees Cook wrote:
> > > On Wed, Feb 28, 2024 at 01:04:14PM +0100, Michal Hocko wrote:
> > > > On Tue 27-02-24 10:35:40, Kees Cook wrote:
> > > > > On Mon, Feb 26, 2024 at 04:25:09PM +0100, Michal Hocko wrote:
> > > > [...]
> > > > > > Does that mean that any potentially incorrect input provided by=
 an admin is
> > > > > > considered CVE now?
> > > > >=20
> > > > > Yes. Have you seen what USER_NS does? There isn't a way to know h=
ow
> > > > > deployments are using Linux, and this is clearly a "weakness" as =
defined
> > > > > by CVE. It is better to be over zealous than miss things.
> > > >=20
> > > > If we are over zealous to the point when almost any fix is marked C=
VE
> > > > then the special marking simply stops making any sense IMHO.
> > >=20
> > > Perhaps, but the volume of fixes is high, and I think it's better to
> > > over estimate than under estimate -- the work needed to actually
> > > evaluate all these changes is huge: it's better to take everything fr=
om
> > > -stable.
> >=20
> > This is simply not feasible for many downstream kernels and reasons have
> > been discussed many times.
>=20
> How does taking 10 patches differ from taking 200 patches?  Your
> testing/infrastructure issues should be the same, right?

It is more work to review 200 patches than to review 10. As you would
know if you actually reviewed -stable patches or at least AUTOSEL
ones.

								Pavel
--=20
People of Russia, stop Putin before his war on Ukraine escalates.

--589ZECv5K4/DtYSN
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRPfPO7r0eAhk010v0w5/Bqldv68gUCZeBWcAAKCRAw5/Bqldv6
8uazAJwNkS7DKDojDXHxbjiWob0iiRvr7gCffQwppbhkk0+4GAih54Ow1rkZhyM=
=1Ya4
-----END PGP SIGNATURE-----

--589ZECv5K4/DtYSN--