Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20210407001658.2208535-1-pakki001@umn.edu> <YH5/i7OvsjSmqADv@kroah.com>
 <20210420171008.GB4017@fieldses.org> <YH+zwQgBBGUJdiVK@unreal>
In-Reply-To: <YH+zwQgBBGUJdiVK@unreal>
From:   Anna Schumaker <anna.schumaker@netapp.com>
Date:   Wed, 21 Apr 2021 08:51:02 -0400
Message-ID: <CAFX2JfnGCbanTaGurArBw-5F2MynPD=GpwkfU6wVoNKr9ffzRg@mail.gmail.com>
Subject: Re: [PATCH] SUNRPC: Add a check for gss_release_msg
To:     Leon Romanovsky <leon@kernel.org>
Cc:     "J. Bruce Fields" <bfields@fieldses.org>,
        Greg KH <gregkh@linuxfoundation.org>,
        Aditya Pakki <pakki001@umn.edu>,
        Chuck Lever <chuck.lever@oracle.com>,
        Trond Myklebust <trond.myklebust@hammerspace.com>,
        "David S. Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>,
        Dave Wysochanski <dwysocha@redhat.com>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        netdev@vger.kernel.org,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Wed, Apr 21, 2021 at 2:07 AM Leon Romanovsky <leon@kernel.org> wrote:
>
> On Tue, Apr 20, 2021 at 01:10:08PM -0400, J. Bruce Fields wrote:
> > On Tue, Apr 20, 2021 at 09:15:23AM +0200, Greg KH wrote:
> > > If you look at the code, this is impossible to have happen.
> > >
> > > Please stop submitting known-invalid patches.  Your professor is playing
> > > around with the review process in order to achieve a paper in some
> > > strange and bizarre way.
> > >
> > > This is not ok, it is wasting our time, and we will have to report this,
> > > AGAIN, to your university...
> >
> > What's the story here?
>
> Those commits are part of the following research:
> https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf

This thread is the first I'm hearing about this. I wonder if there is
a good way of alerting the entire kernel community (including those
only subscribed to subsystem mailing lists) about what's going on? It
seems like useful information to have to push back against these
patches.

Anna

>
> They introduce kernel bugs on purpose. Yesterday, I took a look on 4
> accepted patches from Aditya and 3 of them added various severity security
> "holes".
>
> Thanks
>
> >
> > --b.