Skip to contentSkip to conversation

Backport a Security Fix for CVE-2015-7833 to v4.1

DISCUSSION Yuki Machida 4 participants 11 messages Apr 11, 2016 – Apr 19, 2016

Subsystems (2)
Stable branch Media (V4L/DVB)
lore
Share & tools
lore

Yuki Machida

author
#0 lore raw

Hi Sasha,

I conformed that these patches for CVE-2015-7833 not applied at v4.1.21. 588afcc1c0e45358159090d95bf7b246fb67565 fa52bd506f274b7619955917abfde355e3d19ff
Could you please apply this CVE-2015-7833 fix for 4.1-stable ?

References:
https://security-tracker.debian.org/tracker/CVE-2015-7833
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=588afcc1c0e45358159090d95bf7b246fb67565f
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fa52bd506f274b7619955917abfde355e3d19ffe

Regards,
Yuki Machida

#1 lore raw

Hello,

I apologize for intercepting, but I believe commit 588afcc1 should not be accepted and reverted in the trees where it was.

Reasons:

https://patchwork.linuxtv.org/patch/32798/
or
https://www.spinics.net/lists/linux-media/msg96936.html

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Yuki Machida" <[email protected]>
To: "sasha levin" <[email protected]>
Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Sent: Monday, April 11, 2016 7:19:34 AM
Subject: Backport a Security Fix for CVE-2015-7833 to v4.1

Hi Sasha,

I conformed that these patches for CVE-2015-7833 not applied at v4.1.21. 588afcc1c0e45358159090d95bf7b246fb67565 fa52bd506f274b7619955917abfde355e3d19ff
Could you please apply this CVE-2015-7833 fix for 4.1-stable ?

References:
https://security-tracker.debian.org/tracker/CVE-2015-7833
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=588afcc1c0e45358159090d95bf7b246fb67565f
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fa52bd506f274b7619955917abfde355e3d19ffe

Regards,
Yuki Machida

author
#2 lore raw

Hi Vladis,

Quoted 8 lines

I apologize for intercepting, but I believe commit 588afcc1 should not be accepted and reverted in the trees where it was.

Reasons:

https://patchwork.linuxtv.org/patch/32798/
or
https://www.spinics.net/lists/linux-media/msg96936.html

Thank you for your reply.

If it revert commit 588afcc1 from the kernel,
It exists a Security Issue of CVE-2015-7833.
What do you think about it?

Best regards,
Yuki Machida

Quoted 37 lines · Vladis Dronov

Hello,

I apologize for intercepting, but I believe commit 588afcc1 should not be accepted and reverted in the trees where it was.

Reasons:

https://patchwork.linuxtv.org/patch/32798/
or
https://www.spinics.net/lists/linux-media/msg96936.html

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Yuki Machida" <[email protected]>
To: "sasha levin" <[email protected]>
Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Sent: Monday, April 11, 2016 7:19:34 AM
Subject: Backport a Security Fix for CVE-2015-7833 to v4.1

Hi Sasha,

I conformed that these patches for CVE-2015-7833 not applied at v4.1.21. 588afcc1c0e45358159090d95bf7b246fb67565 fa52bd506f274b7619955917abfde355e3d19ff
Could you please apply this CVE-2015-7833 fix for 4.1-stable ?

References:
https://security-tracker.debian.org/tracker/CVE-2015-7833
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=588afcc1c0e45358159090d95bf7b246fb67565f
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fa52bd506f274b7619955917abfde355e3d19ffe

Regards,
Yuki Machida

#3 lore raw

Hello, Yuki, all,

My commit fa52bd506f resolves CVE-2015-7833, as mentioned in
https://www.spinics.net/lists/linux-media/msg96936.html

Please, note a message from Hans down this thread, who agrees with my point.

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Yuki Machida" <[email protected]>
To: "Vladis Dronov" <[email protected]>
Cc: "sasha levin" <[email protected]>, [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Sent: Friday, April 15, 2016 10:31:17 AM
Subject: Re: Backport a Security Fix for CVE-2015-7833 to v4.1

Hi Vladis,

Quoted 8 lines

I apologize for intercepting, but I believe commit 588afcc1 should not be accepted and reverted in the trees where it was.

Reasons:

https://patchwork.linuxtv.org/patch/32798/
or
https://www.spinics.net/lists/linux-media/msg96936.html

Thank you for your reply.

If it revert commit 588afcc1 from the kernel,
It exists a Security Issue of CVE-2015-7833.
What do you think about it?

Best regards,
Yuki Machida

Quoted 37 lines · Vladis Dronov

Hello,

I apologize for intercepting, but I believe commit 588afcc1 should not be accepted and reverted in the trees where it was.

Reasons:

https://patchwork.linuxtv.org/patch/32798/
or
https://www.spinics.net/lists/linux-media/msg96936.html

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Yuki Machida" <[email protected]>
To: "sasha levin" <[email protected]>
Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Sent: Monday, April 11, 2016 7:19:34 AM
Subject: Backport a Security Fix for CVE-2015-7833 to v4.1

Hi Sasha,

I conformed that these patches for CVE-2015-7833 not applied at v4.1.21. 588afcc1c0e45358159090d95bf7b246fb67565 fa52bd506f274b7619955917abfde355e3d19ff
Could you please apply this CVE-2015-7833 fix for 4.1-stable ?

References:
https://security-tracker.debian.org/tracker/CVE-2015-7833
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=588afcc1c0e45358159090d95bf7b246fb67565f
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fa52bd506f274b7619955917abfde355e3d19ffe

Regards,
Yuki Machida

author
#4 lore raw

Hi Vladis,

Quoted 4 lines · Vladis Dronov

Hello, Yuki, all,

My commit fa52bd506f resolves CVE-2015-7833, as mentioned in
https://www.spinics.net/lists/linux-media/msg96936.html

I understand that commit fa52bd506f resolved security issue of CVE-2015-7833 and commit 588afcc1 is not needed for fixing of CVE-2015-7833.

Quoted 2 lines

Please, note a message from Hans down this thread, who agrees with my point.

I understand the opinion of Vladis and Hans.
Why "usbvision: revert commit 588afcc1" is not accepted in linux-media ?

Quoted 65 lines

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Yuki Machida" <[email protected]>
To: "Vladis Dronov" <[email protected]>
Cc: "sasha levin" <[email protected]>, [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Sent: Friday, April 15, 2016 10:31:17 AM
Subject: Re: Backport a Security Fix for CVE-2015-7833 to v4.1

Hi Vladis,

Quoted 8 lines

I apologize for intercepting, but I believe commit 588afcc1 should not be accepted and reverted in the trees where it was.

Reasons:

https://patchwork.linuxtv.org/patch/32798/
or
https://www.spinics.net/lists/linux-media/msg96936.html

Thank you for your reply.

If it revert commit 588afcc1 from the kernel,
It exists a Security Issue of CVE-2015-7833.
What do you think about it?

Best regards,
Yuki Machida

Quoted 34 lines · Vladis Dronov

Hello,

I apologize for intercepting, but I believe commit 588afcc1 should not be accepted and reverted in the trees where it was.

Reasons:

https://patchwork.linuxtv.org/patch/32798/
or
https://www.spinics.net/lists/linux-media/msg96936.html

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Yuki Machida" <[email protected]>
To: "sasha levin" <[email protected]>
Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Sent: Monday, April 11, 2016 7:19:34 AM
Subject: Backport a Security Fix for CVE-2015-7833 to v4.1

Hi Sasha,

I conformed that these patches for CVE-2015-7833 not applied at v4.1.21. 588afcc1c0e45358159090d95bf7b246fb67565 fa52bd506f274b7619955917abfde355e3d19ff
Could you please apply this CVE-2015-7833 fix for 4.1-stable ?

References:
https://security-tracker.debian.org/tracker/CVE-2015-7833
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=588afcc1c0e45358159090d95bf7b246fb67565f
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fa52bd506f274b7619955917abfde355e3d19ffe

Quoted 8 lines
Quoted 3 lines

Regards,
Yuki Machida

--
To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Regards,
Yuki Machida

#5 lore raw

Hello, Yuki, all,

Quoted 1 line

Why "usbvision: revert commit 588afcc1" is not accepted in linux-media ?

As mentioned in a message from Hans down this thread, it "fell through the cracks", unfortunately. (http://www.spinics.net/lists/linux-media/msg99495.html)

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Yuki Machida" <[email protected]>
To: "Vladis Dronov" <[email protected]>
Cc: "sasha levin" <[email protected]>, [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Sent: Monday, April 18, 2016 10:32:12 AM
Subject: Re: Backport a Security Fix for CVE-2015-7833 to v4.1

Hi Vladis,

Quoted 4 lines · Vladis Dronov

Hello, Yuki, all,

My commit fa52bd506f resolves CVE-2015-7833, as mentioned in
https://www.spinics.net/lists/linux-media/msg96936.html

I understand that commit fa52bd506f resolved security issue of CVE-2015-7833 and commit 588afcc1 is not needed for fixing of CVE-2015-7833.

Quoted 2 lines

Please, note a message from Hans down this thread, who agrees with my point.

I understand the opinion of Vladis and Hans.
Why "usbvision: revert commit 588afcc1" is not accepted in linux-media ?

Regards,
Yuki Machida

author
#6 lore raw

Hi Vladis,

Quoted 4 lines
Quoted 1 line

Why "usbvision: revert commit 588afcc1" is not accepted in linux-media ?

As mentioned in a message from Hans down this thread, it "fell through the cracks", unfortunately. (http://www.spinics.net/lists/linux-media/msg99495.html)

I understand.
Thank you for you reply.

Regards,
Yuki Machida

Quoted 35 lines · Vladis Dronov

Hello, Yuki, all,

Quoted 1 line

Why "usbvision: revert commit 588afcc1" is not accepted in linux-media ?

As mentioned in a message from Hans down this thread, it "fell through the cracks", unfortunately. (http://www.spinics.net/lists/linux-media/msg99495.html)

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Yuki Machida" <[email protected]>
To: "Vladis Dronov" <[email protected]>
Cc: "sasha levin" <[email protected]>, [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Sent: Monday, April 18, 2016 10:32:12 AM
Subject: Re: Backport a Security Fix for CVE-2015-7833 to v4.1

Hi Vladis,

Quoted 4 lines · Vladis Dronov

Hello, Yuki, all,

My commit fa52bd506f resolves CVE-2015-7833, as mentioned in
https://www.spinics.net/lists/linux-media/msg96936.html

I understand that commit fa52bd506f resolved security issue of CVE-2015-7833 and commit 588afcc1 is not needed for fixing of CVE-2015-7833.

Quoted 2 lines

Please, note a message from Hans down this thread, who agrees with my point.

I understand the opinion of Vladis and Hans.
Why "usbvision: revert commit 588afcc1" is not accepted in linux-media ?

Regards,
Yuki Machida

author
#7 lore raw
In reply to Vladis Dronov

Hi Greg and Sasha,

Please do not accept patch of 588afcc to stable tree, because above patch has some problem.
It reported by Vladis and Hans.
https://patchwork.linuxtv.org/patch/32798/
https://www.spinics.net/lists/linux-media/msg96936.html
http://article.gmane.org/gmane.linux.kernel.stable/174202/match=cve+2015+7833

Thank you for your help.

Regards,
Yuki Machida

Quoted 80 lines · Vladis Dronov

Hello, Yuki, all,

My commit fa52bd506f resolves CVE-2015-7833, as mentioned in
https://www.spinics.net/lists/linux-media/msg96936.html

Please, note a message from Hans down this thread, who agrees with my point.

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Yuki Machida" <[email protected]>
To: "Vladis Dronov" <[email protected]>
Cc: "sasha levin" <[email protected]>, [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Sent: Friday, April 15, 2016 10:31:17 AM
Subject: Re: Backport a Security Fix for CVE-2015-7833 to v4.1

Hi Vladis,

Quoted 8 lines

I apologize for intercepting, but I believe commit 588afcc1 should not be accepted and reverted in the trees where it was.

Reasons:

https://patchwork.linuxtv.org/patch/32798/
or
https://www.spinics.net/lists/linux-media/msg96936.html

Thank you for your reply.

If it revert commit 588afcc1 from the kernel,
It exists a Security Issue of CVE-2015-7833.
What do you think about it?

Best regards,
Yuki Machida

Quoted 29 lines · Vladis Dronov

Hello,

I apologize for intercepting, but I believe commit 588afcc1 should not be accepted and reverted in the trees where it was.

Reasons:

https://patchwork.linuxtv.org/patch/32798/
or
https://www.spinics.net/lists/linux-media/msg96936.html

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Yuki Machida" <[email protected]>
To: "sasha levin" <[email protected]>
Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Sent: Monday, April 11, 2016 7:19:34 AM
Subject: Backport a Security Fix for CVE-2015-7833 to v4.1

Hi Sasha,

I conformed that these patches for CVE-2015-7833 not applied at v4.1.21. 588afcc1c0e45358159090d95bf7b246fb67565 fa52bd506f274b7619955917abfde355e3d19ff
Could you please apply this CVE-2015-7833 fix for 4.1-stable ?

Quoted 8 lines

References:
https://security-tracker.debian.org/tracker/CVE-2015-7833
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=588afcc1c0e45358159090d95bf7b246fb67565f
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fa52bd506f274b7619955917abfde355e3d19ffe

Regards,
Yuki Machida

--
To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

#9 lore raw
In reply to Vladis Dronov

Hi Vladis,

Quoted 4 lines · Vladis Dronov

Hello,

I apologize for intercepting, but I believe commit 588afcc1 should not be accepted and reverted in the trees where it was.

Your patch requesting that commit to be reverted fell through the cracks.

Having looked at it I agree that it should be reverted and I will apply it.

The main reason is really the incorrect error return which should have been a goto. But as you say reverting it is easiest since your code does the right thing.

Regards,

Hans

Quoted 37 lines

Reasons:

https://patchwork.linuxtv.org/patch/32798/
or
https://www.spinics.net/lists/linux-media/msg96936.html

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

----- Original Message -----
From: "Yuki Machida" <[email protected]>
To: "sasha levin" <[email protected]>
Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Sent: Monday, April 11, 2016 7:19:34 AM
Subject: Backport a Security Fix for CVE-2015-7833 to v4.1

Hi Sasha,

I conformed that these patches for CVE-2015-7833 not applied at v4.1.21. 588afcc1c0e45358159090d95bf7b246fb67565 fa52bd506f274b7619955917abfde355e3d19ff
Could you please apply this CVE-2015-7833 fix for 4.1-stable ?

References:
https://security-tracker.debian.org/tracker/CVE-2015-7833
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=588afcc1c0e45358159090d95bf7b246fb67565f
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fa52bd506f274b7619955917abfde355e3d19ffe

Regards,
Yuki Machida
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

#10 lore raw

Hello, Hans!

Quoted 1 line
Quoted 1 line

Having looked at it I agree that it should be reverted and I will apply it.

Thank you! I'm happy this is now somehow resolved.

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer