Bug#1032924: linux-image-amd64: new upstream stable kernel 6.2.6 fixes some rtl8192e, cfg80211 and tpm bugs

[Renato Gallo]

Package: linux-image-amd64
Severity: important
Tags: newcomer security
X-Debbugs-Cc: debian-experi...@lists.debian.org, debian...@lists.debian.org, Debian Security Team <te...@security.debian.org>

Dear Maintainers

I am reporting the new stable kernel release 6.2.6 which fixes some realtek
bugs
the link to the changelog is

https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.6

commit 4a48cd80957e796844d3868b2a417cf79bcd134c
Author: Hector Martin <mar...@marcan.st>
Date: Sat Mar 11 23:19:14 2023 +0900

wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for
wext"

commit 79d1ed5ca7db67d48e870c979f0e0f6b0947944a upstream.

This reverts part of commit 015b8cc5e7c4 ("wifi: cfg80211: Fix use after
free for wext")

This commit broke WPA offload by unconditionally clearing the crypto
modes for non-WEP connections. Drop that part of the patch.

Signed-off-by: Hector Martin <mar...@marcan.st>
Reported-by: Ilya <m...@0upti.me>
Reported-and-tested-by: Janne Grunau <j...@jannau.net>
Reviewed-by: Eric Curtin <ecu...@redhat.com>
Fixes: 015b8cc5e7c4 ("wifi: cfg80211: Fix use after free for wext")
Cc: sta...@kernel.org
Link: https://lore.kernel.org/linux-
wireless/ZAx0TWRB...@kroah.com/T/#m11e6e0915ab8fa19ce8bc9695ab288c0fe018edf
Signed-off-by: Linus Torvalds <torv...@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

commit e143354b441786c4f356f7c9b1852bc723dbd81b
Author: Mario Limonciello <mario.li...@amd.com>
Date: Mon Feb 27 20:44:39 2023 -0600

tpm: disable hwrng for fTPM on some AMD designs

commit f1324bbc4011ed8aef3f4552210fc429bcd616da upstream.

AMD has issued an advisory indicating that having fTPM enabled in
BIOS can cause "stuttering" in the OS. This issue has been fixed
in newer versions of the fTPM firmware, but it's up to system
designers to decide whether to distribute it.

This issue has existed for a while, but is more prevalent starting
with kernel 6.1 because commit b006c439d58db ("hwrng: core - start
hwrng kthread also for untrusted sources") started to use the fTPM
for hwrng by default. However, all uses of /dev/hwrng result in
unacceptable stuttering.

So, simply disable registration of the defective hwrng when detecting
these faulty fTPM versions. As this is caused by faulty firmware, it
is plausible that such a problem could also be reproduced by other TPM
interactions, but this hasn't been shown by any user's testing or reports.

It is hypothesized to be triggered more frequently by the use of the RNG
because userspace software will fetch random numbers regularly.

Intentionally continue to register other TPM functionality so that users
that rely upon PCR measurements or any storage of data will still have
access to it. If it's found later that another TPM functionality is
exacerbating this problem a module parameter it can be turned off entirely
and a module parameter can be introduced to allow users who rely upon
fTPM functionality to turn it on even though this problem is present.

Link: https://www.amd.com/en/support/kb/faq/pa-410
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216989
Link: https://lore.kernel.org/all/20230209153120...@zx2c4.com/
Fixes: b006c439d58d ("hwrng: core - start hwrng kthread also for untrusted
sources")
Cc: sta...@vger.kernel.org
Cc: Jarkko Sakkinen <jar...@kernel.org>
Cc: Thorsten Leemhuis <regre...@leemhuis.info>
Cc: James Bottomley <James.B...@hansenpartnership.com>
Tested-by: reac...@mailcuk.com
Tested-by: Bell <11382...@qq.com>
Co-developed-by: Jason A. Donenfeld <Ja...@zx2c4.com>
Signed-off-by: Jason A. Donenfeld <Ja...@zx2c4.com>
Signed-off-by: Mario Limonciello <mario.li...@amd.com>
Reviewed-by: Jarkko Sakkinen <jar...@kernel.org>
Signed-off-by: Jarkko Sakkinen <jar...@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

I am in the process to test it like I have tested 6.2.5.
Again the site https://tracker.debian.org/pkg/linux is lagging behind when it
comes to latest releases

Can you please package it and send it to experimental ? since If I do it is
spamming ?

Kind Regards
Renato Gallo




-- System Information:
Debian Release: 12.0
APT prefers testing
APT policy: (700, 'testing'), (600, 'unstable'), (500, 'testing-security'), (499, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.2.5 (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

[Diederik de Haas]

Previously I tried to be nice and gave you pointers which I hoped would give
you insight as to why your behavior is unhelpful, which in turn would result
in improved behavior. That did not have the intended effect.

So now I'm NOT going to be nice, so I added comm...@debian.org in the
address list because:
1) I consider your behavior in violation of the CoC:
https://www.debian.org/code_of_conduct
2) You and possibly others will complain about my style of communication, so
it'll end up in the Debian Community Team's plate anyway.

On 2023-01-19 I wrote in https://bugs.debian.org/1029159#16:
> On Wed, 18 Jan 2023 17:41:33 +0100 xevilstar <vmxev...@gmail.com> wrote:
> > Package: linux-headers-6.2.0-rc4
> > Version: 6.2.0-rc4-2
> >
> > I am trying to dpkg-buildpackage -us -uc linux-6.2-rc4.tar.gz
> > Because I strongly want to learn how to contribute.
>
> It's great that you want to learn how to contribute, but please don't abuse
> the Debian BTS for that. Only use that to report actual issues in actual
> existing packages/versions.
>
> There are various resources that will help you get started, f.e. on
> wiki.debian.org and there's also #debian-mentors on IRC where you can ask
> questions related to Debian packaging. But the available resources should
> already teach you how you can start making contributions and also when it's
> appropriate to submit a RFS bug and how to do it.
>
> As for learning how to build a Debian kernel, please read the debian-kernel-
> handbook which explains many things on how the Debian kernel gets build.
>
> As for (potential) issues wrt rt packages, you may want to take a look at:
> https://salsa.debian.org/kernel-team/linux/-/merge_requests/629
>
> Where the commits should tell you how to deal with that.
>
> Good luck!

Despite me asking you to NOT file bugs for packages/versions which do not exist
in the Debian archive, you continue to do so:

On 2023-01-30 I wrote in https://bugs.debian.org/1030013#12
> On Monday, 30 January 2023 10:49:32 CET xevilstar wrote:
> > The new rc kernel version 6.2~rc6 is out, still not displayed on
> > https://tracker.debian.org/pkg/linux Can I dput the packages ?
>
> Stop filing bug reports on things which are not bugs.
> And it's not just one, but several.

For emphasis: *And it's not just one, but several.* (on 2023-01-30!)
This mail contains quotes from several different bug reports, but not 'even'
all of them.

> You said you wanted to contribute, but all you've accomplished thus far is
> annoy people and cause people to spend time on things which are MUCH better
> spend on actual issues. Please stop!
>
> The focus is, as it should be, on getting the kernel ready for the Bookworm
> release and that should be version 6.1.
> Until Bookworm is released, any later version is not important to the Debian
> kernel team, so stop *continuously* asking for it.

Before that I said in https://bugs.debian.org/1027921#25:
> On Wednesday, 4 January 2023 16:39:33 CET Renato Gallo wrote:
> > 5.10 should be EOL by now
>
> Please refrain from comments like that.
> It doesn't help at all and is also plain false.

5.10 is Bullseye's kernel and it's also a Super Long Term Support release,
meaning it will probably receive ~ 20 YEARS of support.

But that's not the point I want to make here, which is that you send an
unsolicited email, aka spam, to a bug report with which you were not involved
and your message was plain wrong and unhelpful.

Then in https://bugs.debian.org/1022126#112 this happened:
On Monday, 20 February 2023 10:30:43 CET vmxev...@gmail.com wrote:
> I have stopped sending kernel packages as per your request (you defined
> it spamming).
> For who might be interested I am making the 6.2.0 kernel amd64 packages
> myself ...
> Since this version fixes bug 1022126 (and, I am sure others),

This is another bug you inserted yourself into with not only an unhelpful
reply, but one which angered the OP of that bug. How is that helping?
Why are you surprised that this kind of behavior is considered spamming?

Contributing is about helping the maintainer(s) of a package by lessening
their load or in case there is no maintainer, by f.e. adopting a package.
Or if there is a maintainer but for some reason has been unable to work on
their package for a while, work on that *with their permission*.

The Debian kernel package does not fall in that category, quite the opposite.

On 2023-01-15 https://bugs.debian.org/1028965 happened:
RFS: linux/6.1.6-1~exp1 [ITP] -- Linux for multiprocessor

On Sunday, 15 January 2023 20:40:16 CET I wrote:
> On Sun, 15 Jan 2023 15:59:13 +0100 vmxev...@gmail.com wrote:
> > Package: sponsorship-requests
> > Severity: normal
> >
> > Dear mentors,
> >
> > I am looking for a sponsor for my package "linux":
> > * Package name : linux
> >
> > Version : 6.1.6-1~exp1
> > Upstream contact : Salvatore Bonaccorso <car...@debian.org>
> >
> > * URL : https://www.kernel.org/
> > * License : Unicode-data, LGPL-2.1, GPL-2+-or-X11, CRYPTOGAMS,
>
> LGPL-2.1 or BSD-2-clause, GPL-2 or BSD-2-clause, GPL-2, Xen-interface
>
> > * Vcs : https://salsa.debian.org/kernel-team/linux
> >
> > Section : kernel
>
> JFTR: This isn't the way and Salvatore isn't the Upstream contact and was
> not made aware of this (prior).

By pointing you to resources to learn how to contribute I had hoped that you
would've learned that such an action is considered
an EXTREMELY hostile take-over attempt.

I've wasted more then enough time on this already, so I'll conclude with 2 bug
reports which are essentially the same.

Filed yesterday https://bugs.debian.org/1032876:
On Monday, 13 March 2023 10:13:38 CET Renato Gallo wrote:
> Source: linux
> Version: 6.2.5
> Severity: critical
> Tags: newcomer
> Justification: bugfix
>
> I came across the new stable kernel release that fixes some bugs actually
> present in the system

and today https://bugs.debian.org/1032924

On Tuesday, 14 March 2023 08:42:39 CET Renato Gallo wrote:
> Package: linux-image-amd64
> Severity: important
> Tags: newcomer security
> X-Debbugs-Cc: debian-experi...@lists.debian.org,
> debian...@lists.debian.org, Debian Security Team
> <te...@security.debian.org>
>
> Dear Maintainers
>
> I am reporting the new stable kernel release 6.2.6 which fixes some realtek
> bugs the link to the changelog is
>
> https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.6

> ...

> Can you please package it and send it to experimental ? since If I do it is
> spamming ?

It's considered spamming because you keep abusing the BTS for bugs which
aren't bugs, for kernel versions which aren't in Debian, repeated after having
been asked multiple times to stop doing that and now you've also expanded the
X-Debbugs-Cc field so that more people see it.

Let me REPEAT the quote of my reply on 2023-01-30 from above:
> The focus is, as it should be, on getting the kernel ready for the Bookworm
> release and that should be version 6.1.
> Until Bookworm is released, any later version is not important to the Debian
> kernel team, so stop *continuously* asking for it.

While I have REPEATEDLY and EXPLICITLY asked you to stop doing that!

I have wasted a considerable amount of time to collect all this 'evidence'
after having wasted a lot of time previously trying to steer you in a
direction which could be helpful instead of wasteful that you have been so
far. I could've spend that time on *actual* contributions.

And you not only have wasted my time and annoyed me on multiple occasions, but
also others.

If I see any more of these useless and annoying bug reports from you or you
inserting yourself into other people's bug reports with useless and annoying
replies, then I'm going to spend a considerable amount of time on you again,
but this time to figure out how to get you banned from the BTS!

I will now close your useless bug reports and I will not respond again.
Any reaction will have to come from the Community Team who are likely not as
fed up with this and surely are better at communicating.

Diederik