On Thu, 2016-08-04 at 17:10 +0100, Mark Rutland wrote: > On Thu, Aug 04, 2016 at 11:44:28AM -0400, Daniel Micay wrote: > > > > Qualcomm's drivers might be lower quality than core kernel code, but > > they're way above the baseline set by mainline kernel drivers... > > I don't think that's true for the arm/arm64 perf code. The baseline architecture support is essentially core kernel code. I agree it's much better than the SoC vendor code. You're spending a lot of time auditing, fuzzing and improving the code in general, which is not true for most drivers. They don't get that attention. > I think we've done a reasonable job of testing and fixing those, along > with core infrastructure issues. The perf fuzzer runs for a very long > time on a mainline kernel without issues, while on my Nexus 5x I get a > hard lockup after ~85 seconds (and prior to the last android update > the > lockup was instantaneous). > > From my personal experience (and as above), and talking specifically > about PMU drivers, I think that the opposite is true. This is not to > say > there aren't issues; I would not be surprised if there are. But it's > disingenuous to say that mainline code is worse than that which exists > in a vendor kernel when the latter is demonstrably much easier to > break > than the former. I wasn't talking specifically about perf. > If there are issues you are aware of, please report them. If those > issues only exist in non-upstream code, then the applicable concerns > are > somewhat different (though certainly still exist). I'm not going to do volunteer work for a corporation. I've learned that lesson after spending years doing it. > But please, let's frame the argument to match reality. The argument is framed in reality. Stating that it now often takes a few hours to find a vulnerability with the unaltered, widely known public perf fuzzer is not impressive. It's really an argument for claiming that it's a significant security issue.
Attachment:
signature.asc
Description: This is a digitally signed message part
