linux-kernel - Re: [PATCH 19/20] drivers/net/ethernet/marvell/skge.c: fix error return code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+MoWDoOKF1NHmDbaGwpRCpHLpnHfjHngR2HrV-tWLj+8pFV7g@mail.gmail.com>
Date:	Thu, 4 Oct 2012 20:13:49 +0200
From:	Peter Senna Tschudin <peter.senna@...il.com>
To:	Stephen Hemminger <shemminger@...tta.com>
Cc:	mlindner@...vell.com, kernel-janitors@...r.kernel.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 19/20] drivers/net/ethernet/marvell/skge.c: fix error
 return code

Hello Stephen,

Thanks for the patience.

> The purpose of the commit message is not only so other developers understand
> the patch. It is also so that the consumers (distro's and maintainers)
> understand the scope of the impact.  It maybe that your effort uncovers

I was not considering the scope of the impact. I'm fixing bugs found
by Coccinelle meaning that my bug hunting is based on static program
analysis. My evaluation of what to do is simpler: Can my change make
the code better? If I believe that yes, I make the patch.

> a really bad security hole that requires a CVE and a re-release of a
> major enterprise product like RHEL, or it could just be a minor corner
> case that can never realistically happen. Unless you give a more complete
> description, someone else will have to do it for each case.

This is a mix between what I do not want and what I can't do. I can't
give that complete description for consumers and distro maintainers
for drivers that I do not know completely. I do not know how critical
those bugs are in real life. I was expecting that the maintainer, who
knows the drivers details, would do that sort of things when needed.

Isn't enough fixing bugs and describing it correctly in a technical perspective?

Thanks,

Peter
-- 
Peter
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/