Received-SPF: pass (google.com: domain of linux-kernel+bounces-183070-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Sun, 19 May 2024 10:53:11 +0200
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Michal =?iso-8859-1?Q?Koutn=FD?= <mkoutny@suse.com>
Cc: cve@kernel.org, linux-kernel@vger.kernel.org,
	linux-cve-announce@vger.kernel.org
Subject: Re: CVE-2024-27406: lib/Kconfig.debug: TEST_IOV_ITER depends on MMU
Message-ID: <2024051947-hermit-yeast-3e15@gregkh>
References: <2024051739-CVE-2024-27406-cfc3@gregkh>
 <ot4g5zxesgwpzbgvb7yjazsgdxojktdph42qbw6pik3tvyswhj@kdo44nmnwwcq>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <ot4g5zxesgwpzbgvb7yjazsgdxojktdph42qbw6pik3tvyswhj@kdo44nmnwwcq>

On Fri, May 17, 2024 at 07:42:14PM +0200, Michal Koutn? wrote:
> On Fri, May 17, 2024 at 01:40:41PM GMT, Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> > BUG: failure at mm/nommu.c:318/vmap()!
> > Kernel panic - not syncing: BUG!
> > 
> > The test calls vmap() directly, but vmap() is not supported on nommu
> > systems, causing the crash.  TEST_IOV_ITER therefore needs to depend on
> > MMU.
> 
> This is fixing mising assumption of a testing module.
> The BUG is deserved AFAIU. The CVE should be reverted IMO.

Many people/distros run the built-in unit tests at boot time, and having
crashes is not a good idea.  So if you don't enable this option, great,
this CVE isn't relevent, but if you do, it's an in-kernel crash which is
not good, and this is the fix for that.

So I don't think this CVE should be rejected, sorry.

thanks,

greg k-h