linux-kernel - Re: [PATCH 4.14 17/89] futex: Prevent overflow by strengthen input validation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 25 Jan 2018 15:47:32 +0100
From:   Jiri Slaby <jslaby@...e.cz>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Li Jinyue <lijinyue@...wei.com>, peterz@...radead.org,
        dvhart@...radead.org,
        "torvalds@...ux-foundation.org" <torvalds@...ux-foundation.org>
Subject: Re: [PATCH 4.14 17/89] futex: Prevent overflow by strengthen input
 validation

On 01/25/2018, 03:30 PM, Thomas Gleixner wrote:
> So what's the problem?

The problem I see is that every stable kernel now requires updated
strace with their commit from yesterday to build correctly. In
particular, the new stable kernels cause rpm build failures of strace in
all our distros (based on those stable kernels). Sure, we can patch
strace in every distro every nth kernel update, but it's mere
impractical. Kernel should not break userspace, right?

BTW why was the patch applied to stable? We actually do pass
-fno-strict-overflow.

thanks,
-- 
js
suse labs