[kernel-sec-discuss] r5074 - active

[Ben Hutchings]

Author: benh
Date: 2017-03-14 14:21:45 +0000 (Tue, 14 Mar 2017)
New Revision: 5074

Modified:
   active/CVE-2015-8952
Log:
Update notes about mitigating CVE-2015-8952

Modified: active/CVE-2015-8952
===================================================================
--- active/CVE-2015-8952	2017-03-14 00:51:55 UTC (rev 5073)
+++ active/CVE-2015-8952	2017-03-14 14:21:45 UTC (rev 5074)
@@ -5,11 +5,12 @@
  https://bugzilla.kernel.org/show_bug.cgi?id=107301
 Notes:
  bwh> The upstream fix (rewrite of mbcache) is too intrusive to backport.
- bwh> We could try to mitigate this with cond_resched() as suggested in
- bwh> comment 1 on the bz.k.o bug report and/or add the no_mbcache mount
- bwh> option as in comment 12.  However a new mount option is an uAPI
- bwh> extension that we would have to support indefinitely even though
- bwh> it's redundant in new kernel versions.
+ bwh> We will mitigate this with cond_resched() as suggested in comment 1
+ bwh> on the bz.k.o bug report.  I don't want to add the no_mbcache mount
+ bwh> option as in comment 12 - that is a uAPI extension that we would
+ bwh> have to support indefinitely even though it's redundant in new kernel
+ bwh> versions.  An alternative would be to make ext4 avoid using mbcache
+ bwh> for ceph xattrs (I have an untested patch for this).
  bwh> The problem seems to have been introduced (or exacerbated) by commit
  bwh> 1f3e55fe02d1 in 3.15, which added a retry loop in mb_cache_entry_alloc().
 Bugs: