linux-kernel - Re: Oops in secretmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEXGt5TEr353v7waAc8N68te4xLwCRE+RB2BWs5tFwMC1mQs9Q@mail.gmail.com>
Date: Fri, 31 Oct 2025 12:48:15 +0100
From: Big Sleep <big-sleep-vuln-reports@...gle.com>
To: big-sleep-vuln-reports@...gle.com
Cc: Mike Rapoport <rppt@...nel.org>, linux-mm@...ck.org, linux-kernel@...r.kernel.org, 
	"Matthew Wilcox (Oracle)" <willy@...radead.org>, Lorenzo Stoakes <lorenzo.stoakes@...cle.com>, 
	Lance Yang <lance.yang@...ux.dev>
Subject: Re: Oops in secretmem_fault()

Hello Andrew!

On Fri, Oct 31, 2025 at 2:36 AM Andrew Morton <akpm@...ux-foundation.org> wrote:
> On Thu, 30 Oct 2025 16:34:29 +0100 Big Sleep <big-sleep-vuln-reports@...gle.com> wrote:
> You might want to include a token here so we (you!) can track the
> report through to its resolution.  See what the sysbot people are
> doing.  For example,
>
> https://lkml.rescloud.iu.edu/2408.2/07972.html included:
>
> : IMPORTANT: if you fix the issue, please add the following tag to the commit:
> : Reported-by: syzbot+5054473a31f78f735416@...kaller.appspotmail.com
>
> and when Dmitry fixed this he included that info in the patch metadata:
>
> https://lore.kernel.org/all/20251028101447.693289-1-dmantipov@yandex.ru/T/#u
>
> and that Reported-by: will be carried all the way into the mainline tree.

Thank you for the suggestion!  We are not currently tracking reports
which we categorize as having no security impact, but we will include
a tagging scheme like this for future reports to the kernel which do
have a security impact.

> btw, it would be nice to Cc some human on these reports.  One cannot
> be very confident that emails sent to big-sleep-vuln-reports@...gle.com
> will actually be read by someone.

We are monitoring and replying to our reports and the surrounding
conversations from our project alias.  We'll try to clarify this on
future reports.

--Google Big Sleep Team