linux-kernel - Re: Reminder: 99 open syzbot bugs in net subsystem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190724.111225.2257475150626507655.davem@davemloft.net>
Date:   Wed, 24 Jul 2019 11:12:25 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     ebiggers@...nel.org
Cc:     eric.dumazet@...il.com, dvyukov@...gle.com, netdev@...r.kernel.org,
        fw@...len.de, i.maximets@...sung.com, edumazet@...gle.com,
        dsahern@...il.com, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: Reminder: 99 open syzbot bugs in net subsystem

From: Eric Biggers <ebiggers@...nel.org>
Date: Wed, 24 Jul 2019 09:30:14 -0700

> On Wed, Jul 24, 2019 at 08:39:05AM +0200, Eric Dumazet wrote:
>> Some of the bugs have been fixed already, before syzbot found them.
>> 
>> Why force human to be gentle to bots and actually replying to them ?
>> 
>> I usually simply wait that syzbot is finding the bug does not repro anymore,
>> but now if you send these emails, we will have even more pressure on us.
>> 
> 
> First, based on experience, I'd guess about 30-45 of these are still valid.  17
> were seen in mainline in the last week, but some others are valid too.  The ones
> most likely to still be valid are at the beginning of the list.  So let's try
> not use the presence of outdated bugs as an excuse not to fix current bugs.

So about half of the bugs we are to look at are already fixed and thus
noise, even as estimated by you.

I agree with Eric, these "reminders" are bad for the people you
actually want to work on fixing these bugs.

> Since the kernel community is basically in continuous bug bankruptcy and lots of

I don't like this hyperbole.  Please present facts and information we
can actually use to improve the kernel development and bug fixing
process.

Thank you.