Received-SPF: pass (google.com: domain of linux-ext4-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <0000000000006c411605e2f127e5@google.com> <000000000000b60c1105efe06dea@google.com>
 <Y5vTyjRX6ZgIYxgj@mit.edu> <Y5xsIkpIznpObOJL@google.com> <CANp29Y6KHBE-fpfJCXeN5Ju_qSOfUYAp2n+cNrGj25QtU0X=sA@mail.gmail.com>
 <Y5ylNxoN2p7dmcRD@mit.edu> <CANp29Y4QVp1G83pSqpxeETbw_+kQQ5CZUz+Vgi767WxE8AuhHQ@mail.gmail.com>
 <Y5y824gPqZo+vcxb@mit.edu>
In-Reply-To: <Y5y824gPqZo+vcxb@mit.edu>
From:   Aleksandr Nogikh <nogikh@google.com>
Date:   Mon, 19 Dec 2022 17:12:47 +0100
Message-ID: <CANp29Y4S0TTVjonA9ADpBKviNHR+n3nYi2hy2hcee-4ArD5t4Q@mail.gmail.com>
Subject: Re: kernel BUG in ext4_free_blocks (2)
To:     "Theodore Ts'o" <tytso@mit.edu>
Cc:     Lee Jones <lee@kernel.org>,
        syzbot <syzbot+15cd994e273307bf5cfa@syzkaller.appspotmail.com>,
        adilger.kernel@dilger.ca, gregkh@linuxfoundation.org,
        lczerner@redhat.com, linux-ext4@vger.kernel.org,
        linux-kernel@vger.kernel.org, sashal@kernel.org,
        stable@vger.kernel.org, syzkaller-android-bugs@googlegroups.com,
        tadeusz.struk@linaro.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hi Ted,

Thanks for the comments!

On Fri, Dec 16, 2022 at 7:45 PM Theodore Ts'o <tytso@mit.edu> wrote:
>
> On Fri, Dec 16, 2022 at 06:14:50PM +0100, Aleksandr Nogikh wrote:
> > > Thanks for the clarification; stupid question, though -- I see
> > > "upstream" is listed on the dashboard link above.  Assuming that
> > > "usptream" is "Linus's tree", why was it still saying, "I can't find
> > > this patch in any of my trees"?  What about the upstream tree?
> >
> > Bugs from different namespaces are treated independently, so in this
> > particular case syzbot was expecting the fixing commit to reach the
> > Android trees that it fuzzes.
>
> Is there a way someone can look at the dashboard link to determine
> which (a) what namespace a particular syzkaller report is in, and (b)
> what trees are included in a particular namespace?

(a) Once you have opened the bug report page, you can find the
namespace at the top of the page.
(b) One can at least see the list of the tested trees on the main page
of the namespace -- we do share the latest commits for each manager
instance. Also see the comment below.

>
> Adding a link to the e-mail to the dashboard page may not help if it's
> not obvious why the dashboard mentions "upstream" and yet it's not in
> "any of the trees".  Maybe the e-mail should explicitly list the trees
> that syzkaller will be searching?

I've sent a PR[1] that makes the bot send the list of the searched
trees. For upstream, we search quite a lot of trees, so the bot will
share some of them in the email and give a link to see the rest.
Otherwise the contents would be totally unintelligible.

[1] https://github.com/google/syzkaller/pull/3593

>
> And it would seem that it would be a *feature* if looking at a syzbot
> dashboard from Android namespace could expose the fact that particular
> patch is in any of the LTS trees or Linus's upstream tree, no?

Yes, that would be definitely nice.
We do have the improvements to the missing commit detection on our
TODO list, but I cannot say at the moment when exactly it will be
done.

>
> Also, what is the reason for Android for being in a separate
> namespace?  Is it running on a separate syzbot VM?  I can understand
> why from a feature perspective, that Fuschia and OpenBSD should be in
> separate namespaces; but what are the reasons that there are separate
> namespaces for Android versus the upstream kernel?  Especially since
> the Android dashboard is apparently referencing the upstream kernel?
> What's up with that?

It's based on Linux, but it's not exactly Linux and can have its own bugs.

>
> Put another way, while I think it's super useful to have a link to
> Syzbot dashboard page, in the e-mail, I'm not sure it's going to be a
> complete solution to the confusion that was inspired by this case.
>
> That being said, in general I think a link to the Dashboard is useful;
> in fact, it might be nice if we could encourage upstream developers
> put in the commit trailer:
>
> Link: https://syzkaller.appspot.com/bug?id=5266d464285a03cee9dbfda7d2452a72c3c2ae7c
>
> in addition to, or better yet, instead of:
>
> Reported-by: syzbot+15cd994e273307bf5cfa@syzkaller.appspotmail.com
>
> ... and have Syzbot be able to translate from the Link: tag as being
> equivalent to the Reported-by: link.  That's becase the Link is going
> to be much more useful to humans than the Reported-by --- we've had a
> number of cases where as part of the patch review, we really wanted to
> get back to the Dashboard page, and it's not easy to get to the
> Dashboard from the Reported-by tag.

FWIW it's quite easy to get the Dashboard link from the Reported-by
tag (although I agree it's not the most intuitive thing imaginable) --
one just needs to substitute the hash code after the + sign to
https://syzkaller.appspot.com/bug?extid=%s

Re. the Link tag.. it's interesting. It doesn't seem to be very
reasonable to include both, as it would look somewhat excessive:

Reported-by: syzbot+abcdef012345678@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=abcdef012345678

I'll take a look into the pros and cons of using just the Link tag.

--
Aleksandr

>
> Thanks,
>
>                                                 - Ted
>