linux-kernel - Re: Link: tag and links to submission and reports (was: Re: [GIT pull] core/urgent for v5.18-rc6)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 11 May 2022 10:37:35 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Thorsten Leemhuis <linux@...mhuis.info>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Zhangfei Gao <zhangfei.gao@...mail.com>,
        Fenghua Yu <fenghua.yu@...el.com>,
        Jean-Philippe Brucker <jean-philippe@...aro.org>,
        Jacob Pan <jacob.jun.pan@...ux.intel.com>,
        Dave Hansen <dave.hansen@...el.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        the arch/x86 maintainers <x86@...nel.org>
Subject: Re: Link: tag and links to submission and reports (was: Re: [GIT
 pull] core/urgent for v5.18-rc6)

On Tue, May 10, 2022 at 01:27:54PM +0200, Thorsten Leemhuis wrote:
> Many thx for reminding people about the tag.  FWIW, that's a problem in
> a lot or subsystems and makes my regression tracking efforts hard, as my
> tracking bot relies on the 'Link:' tag. If it's missing I thus have to
> manually search if patches were posted or committed to fix a regression,
> which makes the tracking hard and annoying. :-/

Here's my experience with the Link thing:

So it is trivial to take the Message-ID and turn it into a link tag and
our automation does that.

- Now, it is not a problem when that link tag points to a patch which is
part of the thread which contains the initial bug report - you just go
up-thread.

- If the link tag points to a patch which is version N and it is the
version which passed all review and gets committed, it is a bit harder
to find the previous versions and find the whole discussion how it all
arrived at version N. You can search by the Subject, ofc, which, if it
hasn't been changed, will give you the previous threads. And so on ...

- The problem is when the discussion happened somewhere and the patch
got submitted separately. I can't think of a good way to automate
that so we have to pay attention and fix the link tag by hand and add
the relevant one. And I try to do that when I'm especially awake when
applying the patch.

So I think we should simply pay attention to making sure the link tags
point to the relevant discussion. And we even document that:

 "If related discussions or any other background information behind the
 change can be found on the web, add 'Link:' tags pointing to it."

so we better follow through with it.

:-)

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette