From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ipmail06.adl2.internode.on.net ([150.101.137.129]:36662 "EHLO ipmail06.adl2.internode.on.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751128AbbEDDeQ (ORCPT ); Sun, 3 May 2015 23:34:16 -0400 Date: Mon, 4 May 2015 13:34:12 +1000 From: Dave Chinner To: Sheng Yong Cc: Greg KH , stable@vger.kernel.org Subject: Re: [PATCH] xfs: remote attribute overwrite causes transaction overrun Message-ID: <20150504033412.GC21261@dastard> References: <1430272525-60351-1-git-send-email-shengyong1@huawei.com> <1430272525-60351-2-git-send-email-shengyong1@huawei.com> <20150429074316.GV15810@dastard> <55409ECD.40706@huawei.com> <20150502183610.GB31883@kroah.com> <5546CF40.1020809@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5546CF40.1020809@huawei.com> Sender: stable-owner@vger.kernel.org List-ID: On Mon, May 04, 2015 at 09:45:36AM +0800, Sheng Yong wrote: > CVE-2015-0274 is caused by commit e461fcb ("xfs: remote attribute > lookups require the value length"), which was introduced in 3.11. > It should have had nothing to do with 3.10-stable. However, when > we checked 3.10, we found that this commit was check-picked from > (maybe) the xfs tree. The patch ("xfs: remote attribute lookups > require the value length") was also included in 3.10, and its > commit is 7ae077802. So 3.10-stable is affected by the CVE. So aparently it is needed if there is any bug exposed, which I can't tell from the complete lack of information in the CVE about it. Indeed, I originally found the problem on a CONFIG_XFS_DEBUG=y kernel, which flags lots of issues that have no effect on run-time behaviour of production systems. A transaction overrun does *not* cause a production system to fail, so I'm really not sure that there is a problem that needs to be fixed here. Regardless of whether there is a bug to be fixed or not, what regression testing have you done on your backport to ensure you haven't introduced any new problems? Cheers, Dave. -- Dave Chinner david@fromorbit.com