linux-kernel - Re: Linux 4.9.256

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 8 Feb 2021 17:50:21 +0200
From:   Avi Kivity <avi@...lladb.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org, akpm@...ux-foundation.org,
        torvalds@...ux-foundation.org, stable@...r.kernel.org
Cc:     lwn@....net, jslaby@...e.cz
Subject: Re: Linux 4.9.256

On 05/02/2021 16.26, Greg Kroah-Hartman wrote:
> I'm announcing the release of the 4.9.256 kernel.
>
> This, and the 4.4.256 release are a little bit "different" than normal.
>
> This contains only 1 patch, just the version bump from .255 to .256 which ends
> up causing the userspace-visable LINUX_VERSION_CODE to behave a bit differently
> than normal due to the "overflow".
>
> With this release, KERNEL_VERSION(4, 9, 256) is the same as KERNEL_VERSION(4, 10, 0).


I think this is a bad idea. Many kernel features can only be discovered 
by checking the kernel version. If a feature was introduced in 4.10, 
then an application can be tricked into thinking a 4.9 kernel has it.


IMO, better to stop LINUX_VERSION_CODE at 255 and introduce a 
LINUX_VERSION_CODE_IMPROVED that has more bits for patchlevel.


> Nothing in the kernel build itself breaks with this change, but given that this
> is a userspace visible change, and some crazy tools (like glibc and gcc) have
> logic that checks the kernel version for different reasons, I wanted to do this
> release as an "empty" release to ensure that everything still works properly.


Even if glibc and gcc work, other programs may not.


I have two such cases. They don't depend on 4.9, but they're examples of 
features that are not discoverable by other means.



> So, this is a YOU MUST UPGRADE requirement of a release.  If you rely on the
> 4.9.y kernel, please throw this release into your test builds and rebuild the
> world and let us know if anything breaks, or if all is well.
>
> Go forth and do full system rebuilds!  Yocto and Gentoo are great for this, as
> will systems that use buildroot.
>
> I'll try to hold off on doing a "real" 4.9.y release for a 9eek to give
> everyone a chance to test this out and get back to me.  The pending patches in
> the 4.9.y queue are pretty serious, so I am loath to wait longer than that,
> consider yourself warned...
>
> The updated 4.9.y git tree can be found at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y
> and can be browsed at the normal kernel.org git web browser:
> 	https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
>
> thanks,
>
> greg k-h
>
> ------------
>
>   Makefile |    2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> Greg Kroah-Hartman (1):
>        Linux 4.9.256
>
>