netdev - Re: [PATCH] SUNRPC: Add a check for gss_release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Apr 2021 09:42:41 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Leon Romanovsky <leon@...nel.org>
Cc:     Trond Myklebust <trondmy@...merspace.com>,
        "a.shelat@...theastern.edu" <a.shelat@...theastern.edu>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
        "chuck.lever@...cle.com" <chuck.lever@...cle.com>,
        "dwysocha@...hat.com" <dwysocha@...hat.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "kuba@...nel.org" <kuba@...nel.org>,
        "sudipm.mukherjee@...il.com" <sudipm.mukherjee@...il.com>,
        "bfields@...ldses.org" <bfields@...ldses.org>,
        "anna.schumaker@...app.com" <anna.schumaker@...app.com>,
        "pakki001@....edu" <pakki001@....edu>,
        "linux-nfs@...r.kernel.org" <linux-nfs@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [PATCH] SUNRPC: Add a check for gss_release_msg

On Wed, 21 Apr 2021 16:20:46 +0300
Leon Romanovsky <leon@...nel.org> wrote:

> > There really is no alternative for maintainers other than to always be
> > sceptical of patches submitted by people who are not known and trusted
> > members of the community, and to scrutinise those patches with more
> > care.  
> 

There's only a couple of contributors to my code that I will take without
looking deeply at what it does. And those are well respected developers
that many other people know.

> Right, my guess is that many maintainers failed in the trap when they
> saw respectful address @umn.edu together with commit message saying
> about "new static analyzer tool".
> 
> The mental bias here is to say that "oh, another academic group tries
> to reinvent the wheel, looks ok".

I'm skeptical of all static analyzers, as I've seen too many good ones
still produce crappy fixes. I look even more carefully if I see that it was
a tool that discovered the bug and not a human.

The one patch from Greg's reverts that affects my code was actually a
legitimate fix, and looking back at the thread of the submission, I even
asked if it was found via inspection or a tool.

https://lore.kernel.org/lkml/20190419223718.17fa8246@oasis.local.home/

-- Steve