On Mon, Jun 11, 2018 at 03:07:24PM +0200, Dmitry Vyukov wrote: > > These can't be weaponized to execute code, but if a BUG_ON is > triggerable over a network, or from VM guest, then it's likely more > critical than a local code execution. That's why I am saying that > automated evaluation is infeasible. I can't imagine situations where a BUG_ON would be more critical than local code execution. You can leverage local code execution to ah remote privilege escalation attack; and local code execution can (with less effort) be translated to a system crash. Hence, local code execution is always more critical than a BUG_ON. > Anyway, bug type (UAF, BUG, task hung) is available in the bug title > on dashboard and on mailing lists, so you can just search/sort bugs on > the dashboard. What other interface you want on top of this? I also want to be able to search and filter based on subsystem, and whether or not there is a reproducer. Sometimes you can't even figure out the subsytem from the limited string shown on the dashboard, because the original string didn't include the subsystem to begin with, or the the subsytem name was truncated and not included on the dashboard. > On a related note, perhaps kernel community needs to finally start > using bugzilla for real, like with priorities, assignees, up-to-date > statuses, no stale bugs, etc. All of this is available in bug tracking > systems for decades... I do use bugzilla and in fact if syzbot would automatically file a bugzilla.kernel.org report for things that are in the ext4 subsystem, that would be really helpful. As far as no stale bugs, etc., many companies (including Google) aren't capable of doing that with their own internal bug tracking systems, because management doesn't give them enough time to track and fix all stale bugs. You seem to be assuming/demanding things of the kernel community that are at least partially constrained by resource availability --- and since you've used constrained resources as a reason why Syzbot can't be extended as we've requested to reduce developer toil and leverage our available resources, it would perhaps be respectful if you also accepted that resource constraints also exist in other areas, such as how much we can keep a fully groomed bug tracking system. Regards, - Ted -- To unsubscribe from this list: send the line "unsubscribe linux-xfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
