lkml.org 
[lkml]   [2008]   [Jun]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Linux 2.6.25.6
On Tue, Jun 10, 2008 at 08:06:45PM -0300, Henrique de Moraes Holschuh wrote:
> On Tue, 10 Jun 2008, Alexey Dobriyan wrote:
> > Person fixing a bug may not realize he fixes security-sensitive bug.
>
> That is a valid reason, I am pretty sure everyone here (including me) has
> been guilty of that one. Which doesn't mean we can't do better to educate
> ourselves on the patterns for the most common issues. The "fix for a
> null-dereference to anything that has a function pointer in it" is such a
> pattern.

Sure.

> > Or simply doesn't care because there are 5 more to fix for today.
>
> THAT, however, is unacceptable IMO. If one can't be bothered, or one
> doesn't have the time (or the skill, whatever) to access the severity of a
> fix, he should ask for someone to do that on the commit message. One extra
> short sentence at the end of the commit message [asking for that help] is
> DEFINATELY not too much to ask.

I just realized crapload of NULL dereferences were fixed in /proc and
near last couple of releases.

They were never proposed for any -stable.

And, in retrospective, they wouldn't have been marked as security
sensitive.

Do you read OpenBSD commit logs?



\
 
 \ /
  Last update: 2008-06-11 08:37    [W:0.042 / U:0.504 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site