IRC logs for #cip for Thursday, 2020-10-22

« Wednesday, 2020-10-21 Index Friday, 2020-10-23 »
*** rajm has joined #cip05:54
*** eduardas has joined #cip07:30
*** tpollard has joined #cip07:54
*** masashi910 has joined #cip08:41
*** fujita has joined #cip08:48
*** pave1 has joined #cip08:59
masashi910#startmeeting CIP IRC weekly meeting08:59
brloggerMeeting started Thu Oct 22 08:59:59 2020 UTC and is due to finish in 60 minutes.  The chair is masashi910. Information about MeetBot at http://wiki.debian.org/MeetBot.08:59
brloggerUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.08:59
brloggerThe meeting name has been set to 'cip_irc_weekly_meeting'08:59
*** brlogger changes topic to " (Meeting topic: CIP IRC weekly meeting)"09:00
masashi910#topic rollcall09:00
*** brlogger changes topic to "rollcall (Meeting topic: CIP IRC weekly meeting)"09:00
masashi910please say hi if you're around09:00
patersonchi09:00
wenshi09:00
fujitahi09:00
iwamatsuhi09:00
masashi910#topic AI review09:01
*** brlogger changes topic to "AI review (Meeting topic: CIP IRC weekly meeting)"09:01
masashi9101. Combine root filesystem with kselftest binary - iwamatsu09:01
iwamatsuno update for this.09:01
masashi910iwamatsu: Noted. Thanks.09:01
masashi9102. Check whether CVE-2019-0145, CVE-2019-0147, CVE-2019-0148 needs to be backported to 4.4 - masashi91009:01
pave1hi09:01
masashi910Pavel-san, Chen-Yu-san, thanks for your follow-up discussions on this.09:01
masashi910https://lore.kernel.org/cip-dev/20201014141355.GA16362@duo.ucw.cz/09:01
masashi910https://lore.kernel.org/cip-dev/CAGb2v66aPu3wn_0PwRsp3V=LV5aFPwxEO8Rhzsz-bCeF2PDv-g@mail.gmail.com/09:01
masashi910Do you have any suggestions how to proceed or conclude this?09:02
wensthere's another new CVE (or old, since it's from 2019) for i40e :(09:02
masashi910wens: Oh...09:02
wensI'd say just backport the commits Intel listed.09:02
iwamatsuwhat CVE number?09:02
pave1From the commits we identified, there was nothing that looked like worth backporting.09:02
wensiwamatsu: CVE-2019-014909:02
iwamatsuwens: thanks09:03
pave1Memory leaks in error paths...09:03
iwamatsuI see.09:04
masashi910pave1: Please let me confirm. Not worth backporting for CVE-2019-0145, CVE-2019-0147, CVE-2019-0148?09:04
pave1I guess I would need to take another look. But it certainly did not look urgent.09:05
pave17015ca3df965378bcef072cca9cd63ed098665b5 -- can malicious user trigger this at all?09:05
masashi910pave1: Thanks for your comments. Then, shall I keep this AI open and follow at the next IRC meeting?09:06
pave1147: references the same CVE.09:06
pave1If wens has time, perhaps we can talk after the meeting?09:06
wenssure09:07
*** hungtran has joined #cip09:07
pave1Thanks :-).09:07
masashi910pave1, wens: Thanks!09:07
masashi910So, let's move on.09:07
masashi910#topic Kernel maintenance updates09:07
*** brlogger changes topic to "Kernel maintenance updates (Meeting topic: CIP IRC weekly meeting)"09:07
wens5 new CVEs this week, including the i40e one:09:08
wens- CVE-2019-0149 [net/i40e]09:08
wens- CVE-2020-0423 [binder] - fixed in mainline09:08
wens- CVE-2020-25656 [vt_do_kdgkb_ioctl use after free]09:08
wens- CVE-2020-27152 [KVM]09:08
wens- CVE-2020-27194 [bpf verifier] - fixed in mainline and 5.8 (introduced in v5.7)09:08
iwamatsuI revewed 4.4.240.09:08
pave1Investigating CVEs, reviewing PCIe EP changes, few patches reviewed for 4.19.153.09:08
wensI haven't finished this week's merge request, so the details aren't on gitlab yet.09:09
masashi910wens: Are there any urgent patches among 5 CVEs?09:09
wensno.09:09
wensI don't believe we need to care about binder.09:09
masashi910wens: I see. Thanks.09:09
wensKVM and vt don't have fixes yet09:10
masashi910wens, iwamatsu, pave1: Thanks for your works!09:10
masashi910any other topics?09:11
masashi910309:11
wensI haven't included pave1's investigation into the Bluetooth patches either.09:11
wenshopefully I will get everything done by this weekend.09:11
pave1wens: AFAICT, Bluetooth is now solved.09:12
wenspave1: thanks. I will make sure they are documented properly, instead of the big mess it is right now.09:12
masashi910wens, pave1: Thanks for additional info and works.09:13
masashi910Any other topics?09:13
masashi910309:13
masashi910209:14
masashi910109:14
masashi910#topic Kernel testing09:14
*** brlogger changes topic to "Kernel testing (Meeting topic: CIP IRC weekly meeting)"09:14
patersoncHello09:14
patersoncNot much done since last week.09:14
patersoncI recorded a presentation for ELC-E with Kudo-san. That's probably about it.09:14
masashi910patersonc: Thanks!09:15
pave1I wanted to follow up to zoom meeting...09:15
masashi910pave1: please/09:15
pave1I submit kernel for testing, then I look for the green tick marks.09:15
pave1...on gitlab.09:16
pave1But I should be really going deeper into the test results to see what really failed, right?09:16
patersoncYea09:17
pave1Are there some long term plans to fix that?09:17
patersoncYea. I plan to start using KernelCI's front end09:17
pave1Great, thanks.09:17
masashi910Thanks for the discussion. Any other topics?09:18
masashi910309:18
masashi910209:18
masashi910109:18
masashi910#topic CIP Security09:18
*** brlogger changes topic to "CIP Security (Meeting topic: CIP IRC weekly meeting)"09:18
masashi910Today, Yoshida-san is not here.09:18
masashi910As was reported, the WG started the discussion with the certification body.09:18
masashi910We are discussing both IEC62443-4-1 (process requirements) and -4-2 (feature requirements).09:18
patersoncFor example pave1: from the test run you ran yesterday, you can see results like this for each individual test job: https://lava.ciplatform.org/results/6820209:19
masashi910When the requirements become clear, they will be shared with each team how to deal with them.09:19
patersoncpave1: And then at a lower level: https://lava.ciplatform.org/results/68202/0_spectre-meltdown-checker-test09:19
masashi910ok, let's move on.09:21
masashi910#topic AOB09:21
*** brlogger changes topic to "AOB (Meeting topic: CIP IRC weekly meeting)"09:21
masashi910I would like to propose to skip the IRC meeting next week because of ELCE2020.09:21
masashi910Any objections?09:21
masashi910309:22
masashi910209:22
masashi910109:22
masashi910Thanks, then there is no IRC meeting next week.09:22
masashi910Are there any business to discuss?09:22
masashi910If no, let's close the meeting today.09:22
masashi910#endmeeting09:23
brloggerMeeting ended Thu Oct 22 09:23:00 2020 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)09:23
brloggerMinutes:        https://irclogs.baserock.org/meetings/cip/2020/10/cip.2020-10-22-08.59.html09:23
brloggerMinutes (text): https://irclogs.baserock.org/meetings/cip/2020/10/cip.2020-10-22-08.59.txt09:23
brloggerLog:            https://irclogs.baserock.org/meetings/cip/2020/10/cip.2020-10-22-08.59.log.html09:23
*** brlogger changes topic to "Civil Infrastructure Platform Project. Find the logs at https://irclogs.baserock.org/cip/"09:23
masashi910Thank you, and stay safe!09:23
pave1Thank you!09:23
wensThank you!09:23
pave1patersonc: Yes, I have dim understanding that something exists at lower level.09:23
iwamatsuthank you09:23
pave1patersonc: But it would be really good to propagate failures from test to gitlab, because they are hard to see at the lower levels.09:24
pave1wens: I see that currently merges to cip-kernel-sec are approved, etc... which adds a delay.09:25
pave1wens: Would it be possible to direct pushes, so we can colaborate in the repository?09:25
wenspave1: I don't have push access to cip-kernel-sec09:25
pave1wens: Who can I talk to to get you one?09:26
pave1wens: Because repository that is delayed like this... is not too useful.09:26
pave1With the Bluetooth stuff... it looks like fixes are queued in -stable, so we should not need to do anything there.09:27
wensnot sure who has admin access, maybe szlin would know.09:28
iwamatsuwens: I can add permisson, maybe09:28
pave1iwamatsu: That would be nice. cip-kernel-sec is kind of dashboard, not a code repository.09:28
pave1iwamatsu: So approving commits only delays stuff...09:28
wensright, we are mostly pulling in data from other projects.09:29
pave1wens: Right. Plus, you announce CVEs here, and it would be very nice to be able to git pull and have the information available.09:29
wensoccasionally we have to fill in data ourselves, but maybe we could do those separately with review, while having the automated scripts just push directly?09:29
iwamatsuwens: I just send invite.09:30
pave1wens: I'd prefer not to do reviews. It is our internal status, it does not go into product.09:30
wensiwamatsu: thanks. looks like I can merge stuff now.09:30
pave1wens: if we make mistake, we fix a mistake.09:30
pave1iwamatsu: Thanks a lot!09:31
wenspave1: so, auditing instead of reviewing09:31
pave1wens: Yes, I guess.09:31
wensbwh isn't around right now. we should let him know.09:32
pave1Yes, I guess we need to discuss that.09:32
wensI am in favor of pushing directly.09:32
iwamatsu+109:33
pave1+1 :-)09:33
pave1For the i40e issues, I wonder is we have right commit identified in CVE-2019-0145.yml .09:35
wensin that case, I will probably do tags for each week.09:35
wenspave1: the fix or the cause?09:36
pave1...and if 184 is worth handling as a security problem. Maybe the integger overflow part is.09:37
pave1wens: The fix part.09:37
wenspave1: it was mostly a guess. I am not certain.09:37
pave1Aha, ok.09:38
wenssorry if they confused you. There really is nothing to work from for the i40e CVEs.09:39
pave1Yes, CVEs are rather hard to work from :-(. I wonder if we should be using mainline commit IDs as a bug identifiers, as Greg suggested...09:40
wensthat only works after the fixes have landed though09:40
iwamatsuindeed.09:41
pave1Well... we have upstream first policy, so that should not be a problem :-).09:41
pave1I mean, serious bugs do get fixed rather fast.09:41
wensare you suggesting we identify bugs / fixes from mainline directly?09:43
wenssounds like Sasha's automated picker :)09:43
pave1Well, maybe rather than having CVE as a primary key, have mainline ID as a primary key, and listing CVEs it is supposed to fix.09:44
pave1Or perhaps that can be generated from existing data.09:45
wensreversing the data should be easy09:45
wensour data sources use CVE as the primary key though, so we should probably stick to that.09:46
pave1Like... in ideal world I could run some kind of script which would tell me which mainline commits I should be looking at :-).09:46
wensscripts/report_affected.py but report commit hashes instead of CVE numbers?09:47
pave1I'll need to take a look :-).09:47
pave1Thanks!09:47
wensright now it just lists unfixed CVE numbers for each branch (or branches you specify)09:48
wensanything else?09:50
pave1Ok, let me play with that.09:50
pave1No, I believe I have enough to think about, thank you.09:50
pave1:-)09:50
wensyou're welcome :)09:50
pave1bye for now!09:52
*** pave1 has quit IRC09:53
*** masashi910 has quit IRC09:54
wensI sent out an email about cip-kernel-sec just now.10:01
*** fujita has quit IRC10:23
*** hungtran has quit IRC10:24
*** monstr has joined #cip12:00
*** tpollard is now known as cttpollard12:10
*** monstr has quit IRC15:15
*** eduardas has quit IRC15:26
*** cttpollard has quit IRC16:03
*** alicef has quit IRC18:07
*** alicef has joined #cip18:08
*** rajm has quit IRC22:01
« Wednesday, 2020-10-21 Index Friday, 2020-10-23 »

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!