On Tue 17-04-18 14:36:44, Sasha Levin wrote:
On Tue, Apr 17, 2018 at 04:22:46PM +0200, Michal Hocko wrote:
On Tue 17-04-18 13:39:33, Sasha Levin wrote: [...]
But mm/ commits don't come only from these people. Here's a concrete example we can discuss:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
I would be really careful. Because that reqiures to audit all callers to be compliant with the change. This is just _too_ easy to backport without noticing a failure. Now consider the other side. Is there any real bug report backing this? This behavior was like that for quite some time but I do not remember any actual bug report and the changelog doesn't mention one either. It is about theoretical problem.
https://lkml.org/lkml/2018/3/19/430
There's even a fun little reproducer that allowed me to confirm it's an issue (at least) on 4.15.
Heck, it might even qualify as a CVE.
So if this was to be merged to stable then the changelog should contain a big fat warning about the existing users and how they should be checked.
So what I'm asking is why *wasn't* it sent to stable? Yes, it requires additional work backporting this, but what I'm saying is that this didn't happen at all.
Do not ask me. I wasn't involved. But I would _guess_ that the original bug is not all that serious because it requires some specific privileges and it is quite unlikely that somebody privileged would want to shoot its feet. But this is just my wild guess.
Anyway, I am pretty sure that if the triggering BUG was serious enough then it would be much safer to remove it for stable backports.