linux-kernel - Re: [PATCH 3.18 000/145] 3.18.49-stable review

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170418045754.GB31702@kroah.com>
Date:   Tue, 18 Apr 2017 06:57:54 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Shuah Khan <shuahkh@....samsung.com>
Cc:     linux-kernel@...r.kernel.org, torvalds@...ux-foundation.org,
        akpm@...ux-foundation.org, linux@...ck-us.net,
        patches@...nelci.org, ben.hutchings@...ethink.co.uk,
        stable@...r.kernel.org
Subject: Re: [PATCH 3.18 000/145] 3.18.49-stable review

On Mon, Apr 17, 2017 at 12:18:19PM -0600, Shuah Khan wrote:
> On 04/16/2017 04:48 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.18.49 release.
> > There are 145 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > ---------
> > Wait, what?  3.18?  Wasn't that kernel dead and forgotten and left to
> > rot on the side of the road?  Yes, it was, but unfortunately, there's a
> > few million or so devices out there in the wild that still rely on this
> > kernel.  Now, some of their manufacturers and SoC vendors might not be
> > keeping their kernels up to date very well, but some do actually care
> > about security and their users, so this release is for them.  If you
> > happen to have a vendor that does not care about their users, go
> > complain, as odds are, your device is very insecure right now...
> > 
> > Because of this strange situation, and thanks to some vendors backing
> > the effort[1], I'll keep 3.18-stable alive in a semi-active mode, doing
> > releases every once in a while to keep it up to date and working well
> > based on what is happening in other more well-maintained stable kernels
> > (hint, use 4.4 or 4.9 or newer PLEASE, if your vendor refuses to do so,
> > switch vendors, it's the only way they will learn...)  I don't know how
> > long I'll keep doing this, so if you care about 3.18, please contact me
> > to let me know the expected lifespan of your device.
> > 
> > And finally, due to the delay from the last 3.18-stable kernel release,
> > there is a large backlog of patches, this is about 1/2 of the pending
> > ones so far.  I'll be working on catching up to the rest of them over
> > the next few weeks, and then the updates should be smaller than this
> > one.
> > 
> > ok, back to your normal form-letter stable -rc release notice:
> > ---------
> > 
> > Responses should be made by Tue Apr 18 08:01:19 UTC 2017.
> > Anything received after that time might be too late.
> > 
> > The whole patch series can be found in one patch at:
> > 	kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.49-rc1.gz
> > or in the git tree and branch at:
> >   git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
> > and the diffstat can be found below.
> > 
> > thanks,
> > 
> > greg k-h
> > 
> > [1] Google's android-common-3.18 will be tracking these releases for
> >     those of you caring about a working android kernel based on 3.18, I
> >     recommend using this tree:
> > 	https://android.googlesource.com/kernel/common/+/android-3.18
> > 
> 
> Compiled and booted on my test system. I don't have old dmesg logs to
> compare. I removed 3.18 and history from my test system. I will keep
> 3.10.49 logs for the next release.

Ah, thanks for this.  Please don't feel like you have to test 3.18 on
your system if you don't want to, I know it's a very old kernel...

greg k-h