linux-kernel - Re: [RFC] syzbot process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+bvcHFwURDaz8Zt1nnEcG9NH00QYGvD8JqHNBzjbiXRJw@mail.gmail.com>
Date:   Thu, 28 Dec 2017 11:14:08 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Andrey Ryabinin <ryabinin.a.a@...il.com>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>,
        Eric Dumazet <edumazet@...gle.com>,
        Eric Biggers <ebiggers3@...il.com>,
        Kostya Serebryany <kcc@...gle.com>,
        Alexander Potapenko <glider@...gle.com>,
        andreyknvl <andreyknvl@...gle.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
        David Miller <davem@...emloft.net>,
        Willem de Bruijn <willemb@...gle.com>,
        Guenter Roeck <groeck@...gle.com>,
        Stephan Mueller <smueller@...onox.de>
Subject: Re: [RFC] syzbot process

On Thu, Dec 21, 2017 at 7:08 PM, Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
> On Thu, Dec 21, 2017 at 5:22 AM, Andrey Ryabinin <ryabinin.a.a@...il.com> wrote:
>>
>>      instead of
>>      From: syzbot <syzkaller@...glegroups.com>
>>
>>      make it
>>      From: syzbot-{hash} <syzkaller@...glegroups.com>
>
> That is probably good, but people drop the name all the time.
>
> But with a very simple tweak, I think this would be close to perfect:
> put the hash in the original email instead, and use "+" instead of
> "-", because that's the standard email ("latter part doesn't matter").
> Skip the proper name part entirely, since it doesn't really add
> anything.
>
> And then make it show up in the "Cc:" part or "Reported-by:", so it
> would just look something like
>
>     Reported-by: syzkaller+1234abc@...glegroups.com
>
> and you're all done. I think that would be easiest for us to track
> (just one email that we're supposed to put in the commit message
> _anyway_), and I hope/think that all email clients and servers will
> still maintain the original full "syzkaller+xyz" part of the email, so
> it doesn't get lost.
>
> Because the "proper name" part definitely does get lost occasionally.
> I'm not sure why it happens, but it definitely happens quite often.


Hi Linus,

This sound like a plan. I like that we piggy-back on the existing
process so _theoretically_ don't increase burden on developers. Also
may probably help improving general practice of properly crediting
people (which is now at around 50% from our experience). So new emails
now include (and that's also actual email sender):

====================
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4396883fa8c4f64e0175@...kaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for details.
If you forward the report, please keep this part and the footer.
====================

Thanks