linux-kernel - Re: [syzbot] Monthly io-uring report

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 27 Mar 2023 22:21:02 +0200
From:   Aleksandr Nogikh <nogikh@...gle.com>
To:     Jens Axboe <axboe@...nel.dk>
Cc:     Eric Biggers <ebiggers@...nel.org>, io-uring@...r.kernel.org,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        syzbot <syzbot+lista29bb0eabb2ddbae6f4a@...kaller.appspotmail.com>
Subject: Re: [syzbot] Monthly io-uring report

On Mon, Mar 27, 2023 at 10:00 PM Jens Axboe <axboe@...nel.dk> wrote:
>
> On 3/27/23 1:56 PM, Eric Biggers wrote:
> > On Mon, Mar 27, 2023 at 01:25:14PM -0600, Jens Axboe wrote:
> >> On 3/27/23 1:21?PM, Eric Biggers wrote:
> >>> Thanks for getting syzbot to classify reports by subsystem and send these
> >>> reminders!  These should be very helpful over time.
> >>>
> >>> One thing that is missing in these reminders is a mention of how to change the
> >>> subsystem of miscategorized bugs.  Yes, it's in https://goo.gl/tpsmEJ halfway
> >>> down the page, but it's not obvious.
> >>>
> >>> I think adding something like "See https://goo.gl/tpsmEJ#subsystems for how to
> >>> change the subsystem of miscategorized reports" would be helpful.  Probably not
> >>> in all syzbot emails, but just in these remainder emails.

That makes sense, thanks!
FWIW We can also add a subsystem-changing command that could be sent
just as a reply to such reminder email, so that there's no need to go
to the per-bug threads.

> >>
> >> I did go poke, it is listed off the reports too. But it'd be really
> >> handy if you could do this on the web page. When I see a report like
> >> that that's not for me, I just archive it. And like any chatter with
> >> syzbot, I have to look up what to reply to it every time. It'd be a lot
> >> easy if I could just click on that page to either mark as invalid
> >> (providing the info there) or move it to another subsystem.
> >>
> >
> > Well, one problem that syzbot has to deal with is that to meet the kernel
> > community's needs, it can't require authentication to issue commands.
> >
> > I understand that the current email-only interface, where all commands are Cc'ed
> > to the syzkaller-bug mailing list, makes that not a complete disaster currently.
> >
> > I'd imagine that if anyone could just go to a web page and mess around with bug
> > statuses with no authentication, that might be more problematic.
>
> What prevents anyone from just sending an email to the syzbot issue email
> and modifying it?
>
> I love using email as it's easier when you're replying anyway, but the
> problem is that I can never remember the magic incantations that I need
> to send it. So I invariably click the link ANYWAY to find out what to
> reply, and now it's more hassle using email. Maybe we can solve this by
> making the email footer actually contain the common responses? Then
> I would not have to click, switch desktops, scroll to find, copy part
> of it, switch desktops, paste into email, open terminal to generate
> the rest, switch back to email, paste in, click send. It really isn't
> a very pleasurable experience.

Thanks for the feedback and the idea!
It would indeed be much easier if we listed some sample commands at the bottom.

>
> --
> Jens Axboe
>
>