Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 10 Aug 2023 21:37:50 -0700
From:   Eric Biggers <ebiggers@kernel.org>
To:     Jan Kara <jack@suse.cz>
Cc:     Zhang Zhiyu <zhiyuzhang999@gmail.com>,
        reiserfs-devel@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-fsdevel@vger.kernel.org
Subject: Re: A Discussion Request about a maybe-false-positive of UBSAN: OOB
 Write in do_journal_end in Kernel 6.5-rc3(with POC)
Message-ID: <20230811043750.GA1934@sol.localdomain>
References: <CALf2hKvsXPbRoqEYL8LEBZOFFoZd-puf6VEiLd60+oYy2TaxLg@mail.gmail.com>
 <20230809153207.zokdmoco4lwa5s6b@quack3>
 <20230810051521.GC923@sol.localdomain>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230810051521.GC923@sol.localdomain>
Precedence: bulk

On Wed, Aug 09, 2023 at 10:15:23PM -0700, Eric Biggers wrote:
> On Wed, Aug 09, 2023 at 05:32:07PM +0200, Jan Kara wrote:
> > Improving kernel security is certainly a worthy goal but I have two notes.
> > Firstly, reiserfs is a deprecated filesystem and it will be removed from
> > the kernel in a not so distant future. So it is not very useful to fuzz it
> > because there are practically no users anymore and no developer is
> > interested in fixing those bugs even if you find some. Secondly, please do
> > a better job of reading the code and checking whether your theory is
> > actually valid before filing a CVE (CVE-2023-4205). That's just adding
> > pointless job for everyone... Thanks!
> 
> FYI I filled out https://cveform.mitre.org/ to request revocation of this CVE.
> 
> - Eric

Just to follow up on this, the CVE has now been "rejected".  For future
reference, MITRE had me contact Red Hat since they issued the CVE.  So the right
procedure was to email secalert@redhat.com, not fill out the CVE form.

- Eric