Fixing CVE-2017-12190 in v4.4.y

Fixing CVE-2017-12190 in v4.4.y

[Guenter Roeck]

Hi Greg,

I am looking into fixing CVE-2017-12190 in chromeos-4.4.
The fix requires two patches, 95d78c28b5a85 ("fix unbalanced
page refcounting in bio_map_user_iov") and 2b04e8f6bbb1 ("more
bio_map_user_iov() leak fixes"). I noticed that the second patch
has not been applied to linux-4.4.y. Is that due to the conflict,
or was there a conscious decision not to apply it ?

On a side note, is there a working archive for stable@vger.kernel.org ?
The one listed at vger.kernel.org (gmane) doesn't work.

Thanks,
Guenter

Re: Fixing CVE-2017-12190 in v4.4.y

[Willy Tarreau]

Hi Guenter,

On Wed, Dec 13, 2017 at 01:30:52PM -0800, Guenter Roeck wrote:
> On a side note, is there a working archive for stable@vger.kernel.org ?
> The one listed at vger.kernel.org (gmane) doesn't work.

I don't know however if you're interested I still have the archives since
2010 in mbox format. If you want just an extract of a period, let me know.

Willy

Re: Fixing CVE-2017-12190 in v4.4.y

[Guenter Roeck]

Hi Willy,

On Wed, Dec 13, 2017 at 10:55:56PM +0100, Willy Tarreau wrote:
> Hi Guenter,
> 
> On Wed, Dec 13, 2017 at 01:30:52PM -0800, Guenter Roeck wrote:
> > On a side note, is there a working archive for stable@vger.kernel.org ?
> > The one listed at vger.kernel.org (gmane) doesn't work.
> 
> I don't know however if you're interested I still have the archives since
> 2010 in mbox format. If you want just an extract of a period, let me know.
> 

I found it: http://www.spinics.net/lists/stable/

I'll send a request to update the list info to postmaster@vger.kernel.org.

Thanks,
Guenter

Re: Fixing CVE-2017-12190 in v4.4.y

[Guenter Roeck]

On Wed, Dec 13, 2017 at 01:30:52PM -0800, Guenter Roeck wrote:
> Hi Greg,
> 
> I am looking into fixing CVE-2017-12190 in chromeos-4.4.
> The fix requires two patches, 95d78c28b5a85 ("fix unbalanced
> page refcounting in bio_map_user_iov") and 2b04e8f6bbb1 ("more
> bio_map_user_iov() leak fixes"). I noticed that the second patch
> has not been applied to linux-4.4.y. Is that due to the conflict,
> or was there a conscious decision not to apply it ?
> 
> On a side note, is there a working archive for stable@vger.kernel.org ?
> The one listed at vger.kernel.org (gmane) doesn't work.
> 
Never mind, the list archive is at http://www.spinics.net/lists/stable/,
and the patch wasn't applied due to a conflict [1]. I'll prepare a patch.

Guenter

---
[1] https://www.spinics.net/lists/stable/msg193467.html