netdev - Re: [PATCH AUTOSEL 4.9 09/26] net/mlx5e: Init ethtool steering for representors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 16 Apr 2020 19:20:01 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Or Gerlitz <gerlitz.or@...il.com>
Cc:     Sasha Levin <sashal@...nel.org>,
        Edward Cree <ecree@...arflare.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Stable <stable@...r.kernel.org>,
        Linux Netdev List <netdev@...r.kernel.org>,
        Saeed Mahameed <saeedm@...lanox.com>,
        David Miller <davem@...emloft.net>
Subject: Re: [PATCH AUTOSEL 4.9 09/26] net/mlx5e: Init ethtool steering for
 representors

On Thu, Apr 16, 2020 at 04:40:31PM +0300, Or Gerlitz wrote:
> On Thu, Apr 16, 2020 at 3:00 AM Sasha Levin <sashal@...nel.org> wrote:
> > I'd maybe point out that the selection process is based on a neural
> > network which knows about the existence of a Fixes tag in a commit.
> >
> > It does exactly what you're describing, but also taking a bunch more
> > factors into it's desicion process ("panic"? "oops"? "overflow"? etc).
> 
> As Saeed commented, every extra line in stable / production kernel
> is wrong.

What?  On what do you base that crazy statement on?  I have 18+ years of
direct experience of that being the exact opposite.

> IMHO it doesn't make any sense to take into stable automatically
> any patch that doesn't have fixes line. Do you have 1/2/3/4/5 concrete
> examples from your (referring to your Microsoft employee hat comment
> below) or other's people production environment where patches proved to
> be necessary but they lacked the fixes tag - would love to see them.

Oh wow, where do you want me to start.  I have zillions of these.

But wait, don't trust me, trust a 3rd party.  Here's what Google's
security team said about the last 9 months of 2019:
	- 209 known vulnerabilities patched in LTS kernels, most without
	  CVEs
	- 950+ criticial non-security bugs fixes for device XXXX alone
	  with LTS releases

> We've been coaching new comers for years during internal and on-list
> code reviews to put proper fixes tag. This serves (A) for the upstream
> human review of the patch and (B) reasonable human stable considerations.

If your driver/subsystem is doing this, wonderful, just opt-out of the
autosel process and you will never be bothered again.

But, trust me, I think I know a bit about tagging stuff for stable
kernels, and yet the AUTOSEL tool keeps finding patches that _I_ forgot
to tag as such.  So, don't be so sure of yourself, it's humbling :)

Let the AUTOSEL tool run, and if it finds things you don't agree with, a
simple "No, please do not include this" email is all you need to do to
keep it out of a stable kernel.

So far the AUTOSEL tool has found so many real bugfixes that it isn't
funny.  If you don't like it, fine, but it has proven itself _way_
beyond my wildest hopes already, and it just keeps getting better.

greg k-h