linux-kernel - Re: [PATCH 4.9 086/104] arm64: kasan: avoid bad virt_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 17 Nov 2017 09:06:47 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Josh Hunt <joshhunt00@...il.com>
Cc:     "Levin, Alexander" <alexander.levin@...izon.com>,
        Julia Lawall <julia.lawall@...6.fr>,
        Laura Abbott <labbott@...hat.com>,
        Mark Rutland <mark.rutland@....com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <will.deacon@....com>
Subject: Re: [PATCH 4.9 086/104] arm64: kasan: avoid bad virt_to_pfn()

On Thu, Nov 16, 2017 at 03:24:46PM -0800, Josh Hunt wrote:
> On Thu, Nov 16, 2017 at 3:13 PM,  <alexander.levin@...izon.com> wrote:
> >
> > It's possible, but I didn't want to add a bunch of clutter to the
> > commit message. Right now it's somewhat easy to track it back to
> > automatic selection because:
> >
> >  1. I'm signed off on all of them, so I could chime in in the case
> > concerns/issues arise with a patch.
> >  2. They all have a corresponding review request email with the
> > AUTOSEL marker.
> >
> 
> I get the want to not clutter the commit logs. My comment was more
> directed to a few weeks or months after the patch has made it into a
> stable release. At that point I'm not sure the person who found the
> problem with the change would know to CC you on any correspondence, or
> even if the author of the change would know to contact you. Although I
> guess maybe they'd eventually track things down and report to stable,
> or Greg, or something else and it would eventually get back to you.

If they report it to stable@...r (as they should), it is trivial for us
to look in the logs to see where the patch came from.  It turns out that
the way Sasha formats these patches makes it obvious to me that it was
an auto-selected patch, so I can easily see that even without looking in
the email history.

So don't worry about us not being able to track things down, we are good
at that :)

thanks,

greg k-h