lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <bug-216283-13602-B3pbXtQvhV@https.bugzilla.kernel.org/> Date: Wed, 27 Jul 2022 11:53:15 +0000 From: bugzilla-daemon@...nel.org To: linux-ext4@...r.kernel.org Subject: [Bug 216283] FUZZ: BUG() triggered in fs/ext4/extent.c:ext4_ext_insert_extent() when mount and operate on crafted image https://bugzilla.kernel.org/show_bug.cgi?id=216283 --- Comment #2 from Lukas Czerner (lczerner@...hat.com) --- On Tue, Jul 26, 2022 at 01:10:24PM -0700, Darrick J. Wong wrote: > If you are going to run some scripted tool to randomly > corrupt the filesystem to find failures, then you have an > ethical and moral responsibility to do some of the work to > narrow down and identify the cause of the failure, not just > throw them at someone to do all the work. > > --D While I understand the frustration with the fuzzer bug reports like this I very much disagree with your statement about ethical and moral responsibility. The bug is in the code, it would have been there even if Wenqing Liu didn't run the tool. We know there are bugs in the code we just don't know where all of them are. Now, thanks to this report, we know a little bit more about at least one of them. That's at least a little useful. But you seem to argue that the reporter should put more work in, or not bother at all. That's wrong. Really, Wenqing Liu has no more ethical and moral responsibility than you finding and fixing the problem regardless of the bug report. I think the frustration comes from the fact that it's potentially a lot of work to untangle and fix the real problem and now when it is out there we feel obligated to fix it. And while bug reports and tools generating these can always be better and reporters can always be a bit more active in narrowing the problem down, you're of course free to ignore this until you, or anyone else, has a bit of spare time and energy to investigate. -Lukas -- You may reply to this email to add a comment. You are receiving this mail because: You are watching the assignee of the bug.
Powered by blists - more mailing lists