Messages in this thread | | | Date | Fri, 23 Apr 2021 09:10:06 +0200 | From | Greg Kroah-Hartman <> | Subject | Re: [PATCH 000/190] Revertion of all of the umn.edu commits |
| |
On Fri, Apr 23, 2021 at 09:01:26AM +0200, Krzysztof Kozlowski wrote: > On 22/04/2021 20:53, Doug Ledford wrote: > > On Wed, 2021-04-21 at 15:01 -0300, Jason Gunthorpe wrote: > >> On Wed, Apr 21, 2021 at 02:57:55PM +0200, Greg Kroah-Hartman wrote: > >>> I have been meaning to do this for a while, but recent events have > >>> finally forced me to do so. > >>> > >>> Commits from @umn.edu addresses have been found to be submitted in > >>> "bad > >>> faith" to try to test the kernel community's ability to review > >>> "known > >>> malicious" changes. The result of these submissions can be found in > >>> a > >>> paper published at the 42nd IEEE Symposium on Security and Privacy > >>> entitled, "Open Source Insecurity: Stealthily Introducing > >>> Vulnerabilities via Hypocrite Commits" written by Qiushi Wu > >>> (University > >>> of Minnesota) and Kangjie Lu (University of Minnesota). > >> > >> I noted in the paper it says: > >> > >> A. Ethical Considerations > >> > >> Ensuring the safety of the experiment. In the experiment, we aim to > >> demonstrate the practicality of stealthily introducing > >> vulnerabilities > >> through hypocrite commits. Our goal is not to introduce > >> vulnerabilities to harm OSS. Therefore, we safely conduct the > >> experiment to make sure that the introduced UAF bugs will not be > >> merged into the actual Linux code > >> > >> So, this revert is based on not trusting the authors to carry out > >> their work in the manner they explained? > >> > >> From what I've reviewed, and general sentiment of other people's > >> reviews I've read, I am concerned this giant revert will degrade > >> kernel quality more than the experimenters did - especially if they > >> followed their stated methodology. > > > > I have to agree with Jason. This seems like trying to push a thumbtack > > into a bulletin board using a pyle driver. Unless the researchers are > > lying (which I've not seen a clear indication of), the 190 patches you > > have selected here are nothing more than collateral damage while you are > > completely missing the supposed patch submission addresses from which > > the malicious patches were sent! > > > > This all really sounds like a knee-jerk reaction to thier posting. I > > have to say, I think it's the wrong reaction to have. > > Nothing stops you from participating in the review of this > revert-series, if you think these are valuable commits. Patches getting > the review, won't be reverted (as I understood).
You understand correctly :)
| |