linux-kernel - Re: [ 00/78] 3.3.2-stable review

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMP44s26eJ6mFHt=C+_AJCkGiDAcMq1O1HsCXPZd5-FRYkZoXQ@mail.gmail.com>
Date:	Fri, 13 Apr 2012 01:58:10 +0300
From:	Felipe Contreras <felipe.contreras@...il.com>
To:	David Miller <davem@...emloft.net>
Cc:	torvalds@...ux-foundation.org, gregkh@...uxfoundation.org,
	lists@...e.net, linux-kernel@...r.kernel.org,
	stable@...r.kernel.org, akpm@...ux-foundation.org,
	alan@...rguk.ukuu.org.uk, linux-wireless@...r.kernel.org,
	c_manoha@....qualcomm.com, ath9k-devel@...ema.h4ckr.net,
	linville@...driver.com
Subject: Re: [ 00/78] 3.3.2-stable review

On Fri, Apr 13, 2012 at 1:12 AM, David Miller <davem@...emloft.net> wrote:
> From: Felipe Contreras <felipe.contreras@...il.com>
> Date: Fri, 13 Apr 2012 01:04:42 +0300
>
>> Wrong is wrong, before or after the 3.3.1 tag, this patch is not
>> 'stable' material, and removing it does not affect upstream at all.
>
> What you don't understand is that bug fixes will get lost if you only
> fix them in -stable, it doesn't matter HOW THEY GOT into -stable.

Let's suppose that c1afdaf was never back-ported from v3.4-rc1, how
would you have fond out there was an issue with it? There's 10000
patches in v3.4-rc2, how do you expect to find issues in them?

People found out this issue on v3.4-rc1, so the fix would not have
been lost, but lets assume it would, v3.3.1 had the issue, the patch
as reverted in v3.3.2, and v3.4 still had the issue. So what? There's
already 10000 patches that would never make it to 3.3.x, and many will
have issues, which is why there would be v3.4.x.

> In fact IT HAS FUCKING HAPPENED that we didn't fix something upstream
> that got fixed in -stable a time long ago when we didn't have the
> policy we're using now which you're going so unreasonably ape-shit
> about.

I see how a *fix* on stable could get lost, but this is not a fix.

A lost fix would be like:

v3.3 (bad), v3.3.1 (good), v3.4 (bad)

But the worst-case scenario here would be:

v3.3 (good), v3.3.1 (bad), v3.3.2 (good), v3.4 (bad)

You said this has happened in the past, I challenge you to find a
single instance of this case: a patch is applied and reverted in
'stable', and the issue triggered by the patches was not fixed in the
next version.

-- 
Felipe Contreras
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/