On Thu, Apr 21, 2016 at 09:39:18PM +0900, Greg KH wrote: > On Thu, Apr 21, 2016 at 02:05:41PM +0200, Jiri Slaby wrote: > > On 04/21/2016, 01:59 PM, Jiri Slaby wrote: > > >> (CVE-2016-2085) 613317b EVM: Use crypto_memneq() for digest comparisons > > > > > > Does not exist in the CVE database/is not confirmed yet AFAICS. > > > > And now I am looking at the patch and I remember why I threw it away. > > crypto_memneq is not in 3.12 yet and I was not keen enough to backport it. > > Which brings up the question, Sasha, why did you think these CVEs were > relevant for 3.12? What were you basing that list on? Yep same question here because in fact checking what is *missing* is harder than checking what should not have been there. I'm pretty sure I missed a lot of things in 2.6.32 (though Ben and Moritz helped a lot) but precisely the fact that they provided me fixes I wasn't aware of is a sign that I can miss things. Any reliable process to check for missing fixes is welcome of course. For now the best way I found is to pick from more recent stable versions, which also ensures people upgrading from and older branch to a newer branch will not find a bug they used to see fixed. Cheers, Willy -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html