3 ms·

The problem here was Debian's distribution process. Any distro compiling linux from the releases on kernel.org was not affected.

Blikkentrekker 3y ago
So this is another bug introduced by Debian itself by patching things? I remember that there was a fairly severe one which was caused by patching OpenSSL I think? But I remember the change they made being fairly weird and no one understood why but it was easy to see that it would introduce a vulnerability.
- mordae 3y ago
  No, the issue was caused by backporting a patch A but not backporting a patch B. Sadly in this case the overall behavior after applying just A was broken when issuing direct IO writes.
- keep_reading 3y ago
  I remember when they made 2 CVEs back to back in Apache by incorrect back porting of changes
- remram 3y ago
  No, it exists in the upstream release.
asdfgasdfh 3y ago
[dead]
uselpa 3y ago
Are you sure about that (genuine question)? The linked discussion involves a Suse engineer and a request to the kernel maintainer directly, not to a Debian packager-
- burtness 3y ago
  No, its an upstream bug being discussed in the debian bug tracker
burtness 3y ago
This is a misreading of the bug. It is from upstream stable kernels before 6.5 that include commit 91562895f803 but not 936e114a245b6[1]. In this case Debian's current process is good - it's kernels track kernel.org stable releases. This debian bug is responsibly flagging "for visibility" that a serious bug has been discussed and fixed upstream. [1] https://lore.kernel.org/stable/20231205122122.dfhhoaswsfscuhc3@quack3/ https://lore.kernel.org/stable/20231205122122.dfhhoaswsfscuh...
- csdvrx 3y ago
  Do you have a link to just the 2 patches (in patch form) that could be before on a kernel tarball to revert these 2 changes?
peppermint_gum 3y ago
This is not accurate. As you can see in the changelogs, the problematic commit made it to 6.1.64 and the fix was merged in 6.1.66: "properly sync file size update after O_SYNC direct IO": https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.64 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.6... "update ki_pos a little later in iomap_dio_complete": https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.66 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.6... This post explains the relationship between the two commits: https://lore.kernel.org/stable/20231205122122.dfhhoaswsfscuhc3@quack3/ https://lore.kernel.org/stable/20231205122122.dfhhoaswsfscuh...
Roark66 3y ago
What if you build your own kernel from kernel.org, but you use Debian tools to make dpkgs? (and you use old config)?

Blikkentrekker 3y ago

So this is another bug introduced by Debian itself by patching things? I remember that there was a fairly severe one which was caused by patching OpenSSL I think? But I remember the change they made being fairly weird and no one understood why but it was easy to see that it would introduce a vulnerability.

mordae 3y ago
No, the issue was caused by backporting a patch A but not backporting a patch B. Sadly in this case the overall behavior after applying just A was broken when issuing direct IO writes.
keep_reading 3y ago
I remember when they made 2 CVEs back to back in Apache by incorrect back porting of changes
remram 3y ago
No, it exists in the upstream release.

asdfgasdfh 3y ago

[dead]

uselpa 3y ago

Are you sure about that (genuine question)? The linked discussion involves a Suse engineer and a request to the kernel maintainer directly, not to a Debian packager-

burtness 3y ago
No, its an upstream bug being discussed in the debian bug tracker

burtness 3y ago

This is a misreading of the bug. It is from upstream stable kernels before 6.5 that include commit 91562895f803 but not 936e114a245b6[1]. In this case Debian's current process is good - it's kernels track kernel.org stable releases. This debian bug is responsibly flagging "for visibility" that a serious bug has been discussed and fixed upstream. [1] https://lore.kernel.org/stable/20231205122122.dfhhoaswsfscuhc3@quack3/ https://lore.kernel.org/stable/20231205122122.dfhhoaswsfscuh...

csdvrx 3y ago
Do you have a link to just the 2 patches (in patch form) that could be before on a kernel tarball to revert these 2 changes?

peppermint_gum 3y ago

This is not accurate. As you can see in the changelogs, the problematic commit made it to 6.1.64 and the fix was merged in 6.1.66: "properly sync file size update after O_SYNC direct IO": https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.64 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.6... "update ki_pos a little later in iomap_dio_complete": https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.66 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.6... This post explains the relationship between the two commits: https://lore.kernel.org/stable/20231205122122.dfhhoaswsfscuhc3@quack3/ https://lore.kernel.org/stable/20231205122122.dfhhoaswsfscuh...

Roark66 3y ago

What if you build your own kernel from kernel.org, but you use Debian tools to make dpkgs? (and you use old config)?