From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9A296C4332F for ; Mon, 28 Nov 2022 08:10:38 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 6A3CC84913; Mon, 28 Nov 2022 09:10:36 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=reject dis=none) header.from=prevas.dk Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=prevas.dk header.i=@prevas.dk header.b="gDDlcR+1"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id BF3A7851DC; Mon, 28 Nov 2022 09:10:35 +0100 (CET) Received: from EUR05-DB8-obe.outbound.protection.outlook.com (mail-db8eur05on20700.outbound.protection.outlook.com [IPv6:2a01:111:f400:7e1a::700]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 7C3C384913 for ; Mon, 28 Nov 2022 09:10:33 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=reject dis=none) header.from=prevas.dk Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=rasmus.villemoes@prevas.dk ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=T64kgAJfOmazWnGMgYiBxajxdbv5RFfy57TkCWMfbWrJu7pHie8Sq8Q/kT4TU0hnNRhXIkex0CcJ8MxOoptlr0LzHFUtVaiJEmZKPfuxGJ54FctZrEG5Zhfolm7C0AcjAiXm2tBZK3W0G89fxSikl00MIm5D7bd/9alxSBaMuSNw9tsM9Ti/VPgGMSrEP6MqMfvsiPppceSvewXsSdG7DqFAG3M9+/c5irLEXrM1ovNUp0SfmISQ/TO8Zfd0hpYopmuDed0ZEqDXcYn8/UklMZEUpVNv5x6cM3BsF4uA5DFHpUMTJB5ALJ3/6qCHYIpdfDfLNk3rE/I4cUUvxiXEgA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Rm5ZUCKxw2255nSEW/z3+8dx859hWFprclGgweiNCbo=; b=ft37Rm2CXZZ2VyeIwi1GZA0ukMhF7Y7qN4EmlfGSLAwjHjEv6ee0s7bOiJKKmCgF7ofE9/MwgPBqnh6cmG3PkG7hJtFeQjb2EYTY/4VbiYRIfBoKzVx9jjquRvqZQ5hrmcTNxuCqwGhHkLOX3c2hOctpCCOudIbjgecxCgfFKXb6l/D9iK2+ItfAM4WWsLWXUe8Rcri4A7LD1NsXjVcNDxqlkNH/2ksO/QaSCYG38Sf+l4OBYss+L9OSRUQGKIVlPtr6mTU+IMaDiL8kXQwZ66VlGASVokkK0otFZmBoVBeyh8ISSum/zHkZcONGz90YoEh+WI61yentQ42cSaBc+Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=prevas.dk; dmarc=pass action=none header.from=prevas.dk; dkim=pass header.d=prevas.dk; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=prevas.dk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Rm5ZUCKxw2255nSEW/z3+8dx859hWFprclGgweiNCbo=; b=gDDlcR+1DKNVtA9JO0bAij2HBQPWlFFiEFZ0EZXPiFQ31ITlr0h+zoGB9T1jUPXlJO+INvta8kM5MTj4PWPCNreZd86MRCwm6APkvE8Ov1xEs/RjQZNcZ7VehF2tFTeCEThURUsGA7Z9VT5KcPdsPwgH+UIqbqF4uYEcdc/aVrA= Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=prevas.dk; Received: from DU0PR10MB5266.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:34a::22) by GV1PR10MB6564.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:150:84::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5857.23; Mon, 28 Nov 2022 08:10:30 +0000 Received: from DU0PR10MB5266.EURPRD10.PROD.OUTLOOK.COM ([fe80::732f:4316:a0be:bdbc]) by DU0PR10MB5266.EURPRD10.PROD.OUTLOOK.COM ([fe80::732f:4316:a0be:bdbc%3]) with mapi id 15.20.5857.023; Mon, 28 Nov 2022 08:10:29 +0000 Message-ID: <15bd8d4a-bf5e-c6fe-e2d5-40c50c402741@prevas.dk> Date: Mon, 28 Nov 2022 09:10:25 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.2.2 Subject: Re: [PATCH 0/6] broken CVE fix (b85d130ea0ca) Content-Language: en-US, da To: Fabio Estevam , Tom Rini , Ramon Fried , Joe Hershberger Cc: u-boot@lists.denx.de, Fabio Estevam , Nicolas Bidron References: <20221014174342.3216982-1-rasmus.villemoes@prevas.dk> <4476ff8a-dbe3-df53-c98c-955e6cdad547@prevas.dk> <20221114130412.GL7282@bill-the-cat> From: Rasmus Villemoes In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-ClientProxiedBy: MM0P280CA0033.SWEP280.PROD.OUTLOOK.COM (2603:10a6:190:b::13) To DU0PR10MB5266.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:34a::22) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU0PR10MB5266:EE_|GV1PR10MB6564:EE_ X-MS-Office365-Filtering-Correlation-Id: 75d8f9b2-beb1-4a04-f57a-08dad11802f5 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: bazpW/cVRUuXOXEuXBibkxwKu16m02mb2yQb+K7LixrZ7RBGPTcik1nOzKX1BaPsSaHsu8QegjOvdJYrVwnt5Sgh6mKaFSjQ1w+xhWsFt+3rB50J6n6Sm7SkRA8h1dK2fY9YFaCbYSJM1aIs6qLfRsWPBIlO2DbPEtOKseSXXPg2J3fJ28xUtjdha5LxsxzB3XY1wujACp581UL/TYfaiAOwW5QoxR6MT0XpCsPDpbPosTF2C5NBeZTBYpNFQWG1/+DbTI+0Lfk94StxwO3qZjYon0znn5RlATGGxrfWobjSe6iiiss0Jm2P2jcnPOCbcCR4IR4J3ISEukBhV/v6PwWU0YZHWrfTyYfj6YfIwrn6ii92+6dhDFgjpL70VERkX5rxg9hN7Bc30YShWgHVouQJHbX/bg6tpLbZS39fb8bVtF4XGSfkwkx98WbtZbWxnrjfRgHMZ/dNrC0/9ML9incv9CCiAXhfXKUWqBY10x4jg7blvsYH7ZaHSsa6wIkEpGIDCvJm4okylmXeXcSdGW4FJ60yXwA+BJ/XYRhItYlEVTOo830EF3moPnlowx+8r/dW7Ewg88xZ7Td+vdRTtTQWWrfpygMvyeJlZd2S/VgOhy8XJn/EoLOHw/MUu9XuyOdv15IoGvA0EF0eRh5A+M+kVxQUGrdYntB7inT4q5ygMXe+0j7oEUNVbiHx7HNIdoQvEta61pvwzYQCtczNe+TuUMDoXgemNLkdu73ryk0V+XULr10JnHuKfOPRnhmH X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DU0PR10MB5266.EURPRD10.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230022)(396003)(136003)(376002)(39840400004)(346002)(366004)(451199015)(83380400001)(86362001)(31696002)(38350700002)(38100700002)(2906002)(44832011)(4744005)(41300700001)(5660300002)(8976002)(8936002)(4326008)(52116002)(53546011)(6506007)(26005)(6512007)(6666004)(186003)(316002)(2616005)(66476007)(66556008)(66946007)(54906003)(8676002)(110136005)(6486002)(478600001)(36756003)(31686004)(45980500001)(43740500002); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?TUFIbmQ1S2VvWURvU3dYbWY2bkpiK1FSNXk4U05ueUZ2V2Fjd1k1RklQT1Zn?= =?utf-8?B?WjBZN0Q5RkJNTGhhVnJTVFYrZE02NlVsTDZEcHBTckJWaHh4SzdqMFZhSHY4?= =?utf-8?B?Y1ArSlcwZkEzbi9vVEpFUTlaakpwTFRaVGZWcDN6UXVlcWRnNWtsSHRsN2cx?= =?utf-8?B?alJRSkJjS1l2L0cyRXRZRWs1SDNVM1pENUNmREZYcE16M0RsNk9rNE5lQ0NB?= =?utf-8?B?alBac3lMenNyODB4aHAwWC83ZVFaR24xV0F0Skxsb1VOODNoZS9maWlXc1NU?= =?utf-8?B?c2ZTSmlnTmFGWWRua2FVaDNrSTB1NTc4OHZWS0luSDVNNCtWeS9PSEsrZTg4?= =?utf-8?B?TzZOTXU4Z0hpT3NsTWZHT1c1QkhEL0V4UHI1djBqWGlKT2JhOVE3TkprSkJi?= =?utf-8?B?d1dUUVc5dGtlUnl3UHZZREFlcE82VUNDOExHMVVRWXlTMXVlQlQ0enpJVzlU?= =?utf-8?B?WERwOWdHZzJENk1OckJlNHBPYUhYcmIyTlExZkJuTVdaWXE4enpvNWZ1dWdu?= =?utf-8?B?RzJaYXZrOG9hZEtzbkVQTmxXNTFQdlcrSDFYUXY0aW9wS2hBcjk2MTZ3dzZQ?= =?utf-8?B?KzBSMUNhdnlNOC9seU1KQVg4VjhUY0Q1bTV4N2FBT3pEei9zYkJsMlJacGQ5?= =?utf-8?B?VHBucmxTZFFWZUh4cnVHM0J5bjBIbFFiUDFLdFVoQWtOdUVYZmJkdUcvRm1a?= =?utf-8?B?MHRiU3Q3dTJRZGM2eURMZm13T0F5ZE10R0h5a1FiK0xQbW9KVmJNMWlDSVVW?= =?utf-8?B?NWVnSFZKa2tWLzcvaDEzanlTTjFTSXJ6Zmk5c1ByVElhRHJEM3NjbnIzdlda?= =?utf-8?B?T1BDRVJkQ0ZqT3BBOVo0RjVHTlNNcGkvaG0yOXZPZXBiN1A3aDFMRERTdVFE?= =?utf-8?B?bDM1L2FBU3JGNjBRQWdjYmw4dit5STQ3NCtDM3dKYnRvTTBFOWh6Ky9zMjRy?= =?utf-8?B?bTQ0dXVsMjByRkE2VjRTd0Z3YkxRWlhtaHZNYVNzMGJIUmorbThDZmczRVI3?= =?utf-8?B?SHlJbmVlejNIZkROeFprYkowWjFzcnJyMURzZ1NmYUVJdFlUWHJYSndyN2Ir?= =?utf-8?B?Y2JIQ2FWRE8vSkc1cnpxalQ4cm5tOWtPZ1E3aklxeUxTZjduWmhHMWxLYWhH?= =?utf-8?B?YXlSNkJIemlTMmI5ZVZDak5RRXlsVWQ5MHhBS1J3OVRpMGZsTzNHZG5VZUEz?= =?utf-8?B?SDRsanhFWU1WV2ZJald6RStzSy9TYnp1MlVmdnlQUXFYeVZzcTdwS1ppS0lp?= =?utf-8?B?NFg4WEpTSzNKM0xteVNOM3A3UGpkV2xVVmhqRXFLVGdub1BrSnN5ZDRISVEr?= =?utf-8?B?OGRTZmlmWnJVcTFNN0pzaUZjckV1Z3BDRkkzMFZ1VUVRanJyK3BVSHY0T1BI?= =?utf-8?B?MGQyVC9raklKYUx3L3NiRm4zeWVNM0Zwck03R2lNWm1VQkJHUjRQMVYveTc3?= =?utf-8?B?aEpxanBUV0Yvc2ZweHJsUFlxMjJHVDZlbmF4b1M4K1V1RG5XTnBqTVRIRzY1?= =?utf-8?B?a0k5cTVLQU92UlRGR2JpQ21yS2NPYmV5OHpyMndJWlcvL1JjbHRTcUFPSzdm?= =?utf-8?B?NWxRRERQWXVRNWphd3VBcGkxeHp5NVdDbndkK1p5RDBQWnRiNzMvL0l6TnFu?= =?utf-8?B?eHVKTWM4a09zM0JDV0hKaDVocVllMStKZzR4bXZMd1pSMzdLcFpMSnFqVmsv?= =?utf-8?B?YlhPSktGYXUvaEZ0V2RnaWI3NlFpZnM2YVhVWXVqUldZTENYU0dNbGpTUkdm?= =?utf-8?B?aWM0L0xsaXNxaEVUUDRqb2paNktYWEl3b0hYM2Y1Y0xGYlJkd3pSbllXVExu?= =?utf-8?B?TjNBTStwSC9zdVg3YzFkcExDb2RnVjB5OVl3OXFkWGdFbTdvWXNYbDArdUFT?= =?utf-8?B?WWluaWhWREhab3Z5Tm5xZTdwc2dTcVpGQmhva3JxS2R0S0VVUjRnMXU2WTFW?= =?utf-8?B?d1VvRUFjS1ZzUzFyQ3FKZlNZZytUQTRNZVU5Wi9hK29Oai9LNFNnME5qSVpW?= =?utf-8?B?bFNvSkQrV3gzNVdhQWwxWnNRYVVJRHRtTzd2M1FVSzdGYmtGYVpTc3FUZjE3?= =?utf-8?B?Q2U3TTJSTVpyQTJCeVByYm00dGJwSERhaE56UEFPV0c5dkg4Tlp5dkljaC9q?= =?utf-8?B?dkhQUkU4UXBNYmxnSEpvSGN3OU0vRmswUTlkVHNKZGp3QVA4SW5EZiszRG45?= =?utf-8?B?QVE9PQ==?= X-OriginatorOrg: prevas.dk X-MS-Exchange-CrossTenant-Network-Message-Id: 75d8f9b2-beb1-4a04-f57a-08dad11802f5 X-MS-Exchange-CrossTenant-AuthSource: DU0PR10MB5266.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Nov 2022 08:10:29.2171 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d350cf71-778d-4780-88f5-071a4cb1ed61 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: a3hKo0GiPYa/86b69LqXJ0xUIyUmWTw8RxRLw7et3cG68hlDbsAM1ul6HjiuoBl12IUtimz9uT46+s4l4ulmZ6pOjBNMyv0Rg7oC8OByZN0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1PR10MB6564 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean On 17/11/2022 01.32, Fabio Estevam wrote: > On Mon, Nov 14, 2022 at 10:04 AM Tom Rini wrote: >> >> On Mon, Nov 14, 2022 at 10:35:51AM +0100, Rasmus Villemoes wrote: >>> On 14/10/2022 19.43, Rasmus Villemoes wrote: >>>> tl;dr: b85d130ea0ca didn't fix the CVE(s), but did break tftp of >>>> certain file sizes - which is somewhat lucky, since that's how I >>>> noticed in the first place. >>>> >>> >>> At this point it seems unlikely that any more comments or reviews will >>> come, so perhaps its time to get these (all 7) merged to master, so that >>> they will get some wider testing before the January release? >> >> Yes, I'd like to see a net PR with this and perhaps a few other mature >> things? > > Ramon, Joe? Ping. If those two CVEs and the tftp brokenness are to get fixed in 2023.01, now is the time to pull in these patches, or provide a viable alternative.