Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 22 Sep 2022 12:05:19 +0100
From:   Conor Dooley <conor.dooley@microchip.com>
To:     <cgel.zte@gmail.com>
CC:     <linux-kernel@vger.kernel.org>, Xu Panda <xu.panda@zte.com.cn>,
        Zeal Robot <zealci@zte.com.cn>, <gregkh@linuxfoundation.org>
Subject: Re: [PATCH linux-next] scripts/extract_xc3028: use absolute path for
 which
Message-ID: <YyxBb63/8MdaxxvC@wendy>
References: <20220922102624.236308-1-xu.panda@zte.com.cn>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20220922102624.236308-1-xu.panda@zte.com.cn>
Precedence: bulk

On Thu, Sep 22, 2022 at 10:26:25AM +0000, cgel.zte@gmail.com wrote:
> From: Xu Panda <xu.panda@zte.com.cn>

Hey Xu Panda,
I accidentally found this patch while looking for your RISC-V one on
lore.

You've not CC'ed any maintainers so I am not sure who you expect to pick
this patch up, but seeing as Greg has NACKed the patch you sent to the
RISC-V list [0] earlier doing the same thing I figure it is a moot
point... maybe engaging with maintainers rather than sending more
patches would be a more successful strategy for you here :(

Either way, you'll likely have to resend this with a maintainer CCed for
someone to be able to apply your patch once you've resolved the email
issues.

Thanks,
Conor.

0 - https://lore.kernel.org/all/Yyw24J7YFVtxsnJ7@kroah.com/
> 
> Not using absolute path when invoking which can lead to serious security
> issues.
> 
> Reported-by: Zeal Robot <zealci@zte.com.cn>
> Signed-off-by: Xu Panda <xu.panda@zte.com.cn>
> ---
>  scripts/extract_xc3028.pl | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/scripts/extract_xc3028.pl b/scripts/extract_xc3028.pl
> index e1c9af25a595..c9ddcba07550 100755
> --- a/scripts/extract_xc3028.pl
> +++ b/scripts/extract_xc3028.pl
> @@ -29,7 +29,7 @@ sub verify ($$)
>         my ($filename, $hash) = @_;
>         my ($testhash);
> 
> -       if (system("which md5sum > /dev/null 2>&1")) {
> +       if (system("/usr/bin/which md5sum > /dev/null 2>&1")) {
>                 die "This firmware requires the md5sum command - see http://www.gnu.org/software/coreutils/\n";
>         }
> 
> -- 
> 2.15.2
>