Re: CVE-2024-27406: lib/Kconfig.debug: TEST_IOV_ITER depends on MMU

Re: CVE-2024-27406: lib/Kconfig.debug: TEST_IOV_ITER depends on MMU

[Michal Koutný]

[-- Attachment #1: Type: text/plain, Size: 471 bytes --]

On Fri, May 17, 2024 at 01:40:41PM GMT, Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> BUG: failure at mm/nommu.c:318/vmap()!
> Kernel panic - not syncing: BUG!
> 
> The test calls vmap() directly, but vmap() is not supported on nommu
> systems, causing the crash.  TEST_IOV_ITER therefore needs to depend on
> MMU.

This is fixing mising assumption of a testing module.
The BUG is deserved AFAIU. The CVE should be reverted IMO.


Thanks,
Michal

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: CVE-2024-27406: lib/Kconfig.debug: TEST_IOV_ITER depends on MMU

[Greg Kroah-Hartman]

On Fri, May 17, 2024 at 07:42:14PM +0200, Michal Koutný wrote:
> On Fri, May 17, 2024 at 01:40:41PM GMT, Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> > BUG: failure at mm/nommu.c:318/vmap()!
> > Kernel panic - not syncing: BUG!
> > 
> > The test calls vmap() directly, but vmap() is not supported on nommu
> > systems, causing the crash.  TEST_IOV_ITER therefore needs to depend on
> > MMU.
> 
> This is fixing mising assumption of a testing module.
> The BUG is deserved AFAIU. The CVE should be reverted IMO.

Many people/distros run the built-in unit tests at boot time, and having
crashes is not a good idea.  So if you don't enable this option, great,
this CVE isn't relevent, but if you do, it's an in-kernel crash which is
not good, and this is the fix for that.

So I don't think this CVE should be rejected, sorry.

thanks,

greg k-h