Re: [LTP] [PATCH v6] cve: reproducer for cve-2026-64600

[Andrea Cervesato via ltp <ltp@lists.linux.it>]

Hi Petr,

> > > > +			.min_kver = "4.16",
> > > It got introduced in 4.11. Is there a reason for testing from 4.16?
> > > Or is it just the copy paste error?
> 
> > 1e369b0e199bb ("xfs: remove experimental tag for reflinks") was merged
> > in 4.16
> 
> Well, 1e369b0e199bb just remove warning from dmesg that reflinks are
> experimental. Why to hide from users that kernels from 4.11 to 4.15 are
> vulnerable? Also, Darrick marked his fix as vulnerable from 4.11 (Commit has
> "Cc: stable@vger.kernel.org # v4.11" [1]), blog publish 4.11 [2], but LTP test
> says "Test requires 4.16" => potential user of 4.11 will think "ok I'm safe".
> IMHO perfect example of hiding kernel bug, specially due the fact that oldest
> fixed kernel is v5.15.212, which backported upstream fix 2f4acd0fcd86 as
> dc11be133efc, it was not backported to still supported LTS 5.10.x (EOL 31 Dec
> 2026) because it has conflicts.

We can use 4.11 then

> [5] https://lore.kernel.org/ltp/20260401094946.GA126168@pevik/

you will have hard time updating all tests then :) from what i see, we have
just a bunch of tests using the short SHA. Anyway, I had more than a few
reviews in the past asking to keep it short, so if we want to use the long one
in order to avoid hash collisions, we also need to officially ask for it.

I will update thepatch and merge, thanks 

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp