Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 22 Apr 2021 00:50:15 -0700
From:   Eric Biggers <ebiggers@kernel.org>
To:     Theodore Ts'o <tytso@mit.edu>
Cc:     Weikeng Chen <w.k@berkeley.edu>, anna.schumaker@netapp.com,
        bfields@fieldses.org, chuck.lever@oracle.com, davem@davemloft.net,
        dwysocha@redhat.com, gregkh@linuxfoundation.org, kuba@kernel.org,
        leon@kernel.org, linux-kernel@vger.kernel.org,
        linux-nfs@vger.kernel.org, netdev@vger.kernel.org,
        pakki001@umn.edu, trond.myklebust@hammerspace.com
Subject: Re: [PATCH] SUNRPC: Add a check for gss_release_msg
Message-ID: <YIEqt8iAPVq8sG+t@sol.localdomain>
References: <CAHr+ZK-ayy2vku9ovuSB4egtOxrPEKxCdVQN3nFqMK07+K5_8g@mail.gmail.com>
 <YICB3wiptvvtTeA5@mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <YICB3wiptvvtTeA5@mit.edu>
Precedence: bulk

On Wed, Apr 21, 2021 at 03:49:51PM -0400, Theodore Ts'o wrote:
> 
> Of course, UMN researchers could just start using fake e-mail
> addresses, or start using personal gmail or yahoo or hotmail
> addresses.  (Hopefully at that point the ethics review boards at UMN
> will be clueful enough to realize that maybe, just maybe, UMN
> researchers have stepped over a line.)
> 

They are actually already doing (or did) that -- see page 9 of their paper
(https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf)
where they say they use "a random email account" to send patches.

I think that (two of?) the accounts they used were
James Bond <jameslouisebond@gmail.com>
(https://lore.kernel.org/lkml/?q=jameslouisebond%40gmail.com) and
George Acosta <acostag.ubuntu@gmail.com>
(https://lore.kernel.org/lkml/?q=acostag.ubuntu%40gmail.com).  Most of their
patches match up very closely with commits they described in their paper:

Figure 9 = https://lore.kernel.org/lkml/20200809221453.10235-1-jameslouisebond@gmail.com/
Figure 10 = https://lore.kernel.org/lkml/20200821034458.22472-1-acostag.ubuntu@gmail.com/
Figure 11 = https://lore.kernel.org/lkml/20200821031209.21279-1-acostag.ubuntu@gmail.com/

Unfortunately they obfuscated the code in their paper for some bizarre reason
and don't provide a proper list, so it's hard to know for sure though.  And
there could be more patches elsewhere.

Note that the "Figure 11" patch was actually accepted and is in mainline.
However it's not actually a bug; apparently they didn't realize that.

- Eric