lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200416172001.GC1388618@kroah.com>
Date:   Thu, 16 Apr 2020 19:20:01 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Or Gerlitz <gerlitz.or@...il.com>
Cc:     Sasha Levin <sashal@...nel.org>,
        Edward Cree <ecree@...arflare.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Stable <stable@...r.kernel.org>,
        Linux Netdev List <netdev@...r.kernel.org>,
        Saeed Mahameed <saeedm@...lanox.com>,
        David Miller <davem@...emloft.net>
Subject: Re: [PATCH AUTOSEL 4.9 09/26] net/mlx5e: Init ethtool steering for
 representors

On Thu, Apr 16, 2020 at 04:40:31PM +0300, Or Gerlitz wrote:
> On Thu, Apr 16, 2020 at 3:00 AM Sasha Levin <sashal@...nel.org> wrote:
> > I'd maybe point out that the selection process is based on a neural
> > network which knows about the existence of a Fixes tag in a commit.
> >
> > It does exactly what you're describing, but also taking a bunch more
> > factors into it's desicion process ("panic"? "oops"? "overflow"? etc).
> 
> As Saeed commented, every extra line in stable / production kernel
> is wrong.

What?  On what do you base that crazy statement on?  I have 18+ years of
direct experience of that being the exact opposite.

> IMHO it doesn't make any sense to take into stable automatically
> any patch that doesn't have fixes line. Do you have 1/2/3/4/5 concrete
> examples from your (referring to your Microsoft employee hat comment
> below) or other's people production environment where patches proved to
> be necessary but they lacked the fixes tag - would love to see them.

Oh wow, where do you want me to start.  I have zillions of these.

But wait, don't trust me, trust a 3rd party.  Here's what Google's
security team said about the last 9 months of 2019:
	- 209 known vulnerabilities patched in LTS kernels, most without
	  CVEs
	- 950+ criticial non-security bugs fixes for device XXXX alone
	  with LTS releases

> We've been coaching new comers for years during internal and on-list
> code reviews to put proper fixes tag. This serves (A) for the upstream
> human review of the patch and (B) reasonable human stable considerations.

If your driver/subsystem is doing this, wonderful, just opt-out of the
autosel process and you will never be bothered again.

But, trust me, I think I know a bit about tagging stuff for stable
kernels, and yet the AUTOSEL tool keeps finding patches that _I_ forgot
to tag as such.  So, don't be so sure of yourself, it's humbling :)

Let the AUTOSEL tool run, and if it finds things you don't agree with, a
simple "No, please do not include this" email is all you need to do to
keep it out of a stable kernel.

So far the AUTOSEL tool has found so many real bugfixes that it isn't
funny.  If you don't like it, fine, but it has proven itself _way_
beyond my wildest hopes already, and it just keeps getting better.

greg k-h

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ