Messages in this thread | | | Subject | Re: [PATCH 000/190] Revertion of all of the umn.edu commits | From | Krzysztof Kozlowski <> | Date | Fri, 23 Apr 2021 09:01:26 +0200 |
| |
On 22/04/2021 20:53, Doug Ledford wrote: > On Wed, 2021-04-21 at 15:01 -0300, Jason Gunthorpe wrote: >> On Wed, Apr 21, 2021 at 02:57:55PM +0200, Greg Kroah-Hartman wrote: >>> I have been meaning to do this for a while, but recent events have >>> finally forced me to do so. >>> >>> Commits from @umn.edu addresses have been found to be submitted in >>> "bad >>> faith" to try to test the kernel community's ability to review >>> "known >>> malicious" changes. The result of these submissions can be found in >>> a >>> paper published at the 42nd IEEE Symposium on Security and Privacy >>> entitled, "Open Source Insecurity: Stealthily Introducing >>> Vulnerabilities via Hypocrite Commits" written by Qiushi Wu >>> (University >>> of Minnesota) and Kangjie Lu (University of Minnesota). >> >> I noted in the paper it says: >> >> A. Ethical Considerations >> >> Ensuring the safety of the experiment. In the experiment, we aim to >> demonstrate the practicality of stealthily introducing >> vulnerabilities >> through hypocrite commits. Our goal is not to introduce >> vulnerabilities to harm OSS. Therefore, we safely conduct the >> experiment to make sure that the introduced UAF bugs will not be >> merged into the actual Linux code >> >> So, this revert is based on not trusting the authors to carry out >> their work in the manner they explained? >> >> From what I've reviewed, and general sentiment of other people's >> reviews I've read, I am concerned this giant revert will degrade >> kernel quality more than the experimenters did - especially if they >> followed their stated methodology. > > I have to agree with Jason. This seems like trying to push a thumbtack > into a bulletin board using a pyle driver. Unless the researchers are > lying (which I've not seen a clear indication of), the 190 patches you > have selected here are nothing more than collateral damage while you are > completely missing the supposed patch submission addresses from which > the malicious patches were sent! > > This all really sounds like a knee-jerk reaction to thier posting. I > have to say, I think it's the wrong reaction to have.
Nothing stops you from participating in the review of this revert-series, if you think these are valuable commits. Patches getting the review, won't be reverted (as I understood).
Best regards, Krzysztof
| |