Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: KASAN: use-after-free Read in hci_chan_del
To:     Greg KH <gregkh@linuxfoundation.org>
Cc:     davem@davemloft.net, johan.hedberg@gmail.com, kuba@kernel.org,
        linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org,
        marcel@holtmann.org, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
References: <000000000000adea7f05abeb19cf@google.com>
 <c2004663-e54a-7fbc-ee19-b2749549e2dd@gmail.com> <YLn24sFxJqGDNBii@kroah.com>
From:   SyzScope <syzscope@gmail.com>
Message-ID: <0f489a64-f080-2f89-6e4a-d066aeaea519@gmail.com>
Date:   Fri, 4 Jun 2021 10:11:03 -0700
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.11.0
MIME-Version: 1.0
In-Reply-To: <YLn24sFxJqGDNBii@kroah.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Precedence: bulk

Hi Greg,

> Who is working on and doing this "reseach project"?
We are a group of researchers from University of California, Riverside 
(we introduced ourselves in an earlier email to security@kernel.org if 
you recall).  Please allow us to articulate the goal of our research. 
We'd be happy to hear your feedback and suggestions.

> And what is it
> doing to actually fix the issues that syzbot finds?  Seems like that
> would be a better solution instead of just trying to send emails saying,
> in short "why isn't this reported issue fixed yet?"
 From our limited understanding, we know a key problem with syzbot bugs 
is that there are too many of them - more than what can be handled by 
developers and maintainers. Therefore, it seems some form of 
prioritization on bug fixing would be helpful. The goal of the SyzScope 
project is to *automatically* analyze the security impact of syzbot 
bugs, which helps with prioritizing bug fixes. In other words, when a 
syzbot bug is reported, we aim to attach a corresponding security impact 
"signal" to help developers make an informed decision on which ones to 
fix first.

Currently,  SyzScope is a standalone prototype system that we plan to 
open source. We hope to keep developing it to make it more and more 
useful and have it eventually integrated into syzbot (we are in talks 
with Dmitry).

We are happy to talk more offline (perhaps even in a zoom meeting if you 
would like). Thanks in advance for any feedback and suggestions you may 
have.


On 6/4/2021 2:48 AM, Greg KH wrote:
> On Tue, May 04, 2021 at 02:50:03PM -0700, ETenal wrote:
>> Hi,
>>
>> This is SyzScope, a research project that aims to reveal high-risk
>> primitives from a seemingly low-risk bug (UAF/OOB read, WARNING, BUG, etc.).
> Who is working on and doing this "reseach project"?  And what is it
> doing to actually fix the issues that syzbot finds?  Seems like that
> would be a better solution instead of just trying to send emails saying,
> in short "why isn't this reported issue fixed yet?"
>
> thanks,
>
> greg k-h
>