Re: hardened-sources wrt CVE-2014-3153 and CVE-2014-0196

В Sat, 07 Jun 2014 09:07:23 -0400
"Anthony G. Basile" <[email protected]> пишет:

> Hi everyone,
> 
> This is one of those rare situations where there are enough serious
> bugs against the kernel that we may have to rapid stabilize 
> hardened-sources-3.2.59-r5 and 3.14.5-r2.  These are currently marked
> ~ because I need feedback from users.  So please try to upgrade to
> either one (3.2 is preferred for mission critical) and give me
> feedback.  The only caution is do not enable KSTACKOVERFLOW, a new
> option which is know to cause panics, eg virtio iface.

Hello,

3.14.5-r2 with KSTACKOVERFLOW disabled works fine on several tested
systems.

3.14.5-r2 with KSTACKOVERFLOW enabled:
- old Pentium D based system works fine;
- KVM VMs with realtek network interface works fine;
- on modern Opteron 43xx based system I see many errors in dmesg:
  "kernel: AMD-Vi: Completion-Wait loop timed out" and experience
  slowdowns;
- KVM VMs with virtio network interface completely crashes without any
  error messages

-- 
Alexander Tsoy