Re: [PATCH v6] cve: reproducer for cve-2026-64600

Hi Andrea,

> Hi Petr,

> > > > > +			.min_kver = "4.16",
> > > > It got introduced in 4.11. Is there a reason for testing from 4.16?
> > > > Or is it just the copy paste error?

> > > 1e369b0e199bb ("xfs: remove experimental tag for reflinks") was merged
> > > in 4.16

> > Well, 1e369b0e199bb just remove warning from dmesg that reflinks are
> > experimental. Why to hide from users that kernels from 4.11 to 4.15 are
> > vulnerable? Also, Darrick marked his fix as vulnerable from 4.11 (Commit has
> > "Cc: [email protected] # v4.11" [1]), blog publish 4.11 [2], but LTP test
> > says "Test requires 4.16" => potential user of 4.11 will think "ok I'm safe".
> > IMHO perfect example of hiding kernel bug, specially due the fact that oldest
> > fixed kernel is v5.15.212, which backported upstream fix 2f4acd0fcd86 as
> > dc11be133efc, it was not backported to still supported LTS 5.10.x (EOL 31 Dec
> > 2026) because it has conflicts.

> We can use 4.11 then

Thank you!

> > [5] https://lore.kernel.org/ltp/20260401094946.GA126168@pevik/

> you will have hard time updating all tests then :) from what i see, we have
> just a bunch of tests using the short SHA. Anyway, I had more than a few
> reviews in the past asking to keep it short, so if we want to use the long one
> in order to avoid hash collisions, we also need to officially ask for it.

I'll just after some time rerun the script to update them in a single batch
(script is part of the commit message, anybody can run it).

I also updated the examples in the docs. I wonder if it should be more
documented.

> I will update thepatch and merge, thanks 

Thank you!

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp