Re: Stable backport request

[Mimi Zohar <zohar@linux.ibm.com>]

Hi Greg,

On Wed, 2022-12-21 at 19:22 +0100, Greg KH wrote:
> On Wed, Dec 21, 2022 at 09:50:09AM -0500, Mimi Zohar wrote:
> > Stable team,
> > 
> > Please backport these upstream commits to stable kernels:
> > - c7423dbdbc9e ("ima: Handle -ESTALE returned by
> > ima_filter_rule_match()"
> > 
> > Dependency on:
> > - d57378d3aa4d ("ima: Simplify ima_lsm_copy_rule")
> > 
> > Known minor merge conflicts:
> > - Commit: 65603435599f ("ima: Fix trivial typos in the comments") fixed
> > "refrences" spelling, causes a merge conflict.
> > - Commit 28073eb09c5a ("ima: Fix fall-through warnings for Clang") adds
> > a "break;" before "default:", causes a merge conflict.

Up to linux-5.9.y, there are two merge conflicts - a spelling error and
a missing "break" before "default:", which are the result of the above
commits.  Otherwise the two commits apply cleanly:
 - d57378d3aa4d ("ima: Simplify ima_lsm_copy_rule")
 - c7423dbdbc9e ("ima: Handle -ESTALE returned by
ima_filter_rule_match()"

> > Simplifies backporting to linux-5.4.y:
> > - 465aee77aae8 ("ima: Free the entire rule when deleting a list of
> > rules")
> >   except for the line "kfree(entry->keyrings);" - introduced in 5.6.y.
> > - 39e5993d0d45 ("ima: Shallow copy the args_p member of
> > ima_rule_entry.lsm elements")
> > - b8867eedcf76 ("ima: Rename internal filter rule functions")
> > - f60c826d0318 ("ima: Use kmemdup rather than kmalloc+memcpy")
> 
> I'm sorry, but I'm confused.
> 
> What exact commits are needed in what order for which stable trees?

The above 4 commits are needed, in the order listed, for linux-5.4.y
before applying these two commits:
 - d57378d3aa4d ("ima: Simplify ima_lsm_copy_rule")
 - c7423dbdbc9e ("ima: Handle -ESTALE returned by
ima_filter_rule_match()"

> > A patch for kernels prior to commit b16942455193 ("ima: use the lsm
> > policy update notifier") will be posted separately.
> 
> But that commit has been backported to 4.19.y and newer stable trees,
> right?

No, b16942455193 ("ima: use the lsm policy update notifier") was
upstreamed in linux-5.3.y and has not been backported to linux-4.19.y. 
We're still determining for linux-4.19.y the best way to address the
bug that commit c7423dbdbc9e ("ima: Handle -ESTALE returned by
ima_filter_rule_match()") addresses.

> 
> confused,

I hope this clarifies things...

-- 
thanks,

Mimi