Post

Doğaç Eldenk
@dogac.dev

It starts with a patch on the GSS-based authentication (auth_gss.c) used within the linux kernel's SunRPC implementation. SunRPC is developed by Sun Microsystems as a part of their NFS implementation. That patch supposedly prevents a "double-free" bug.

Doğaç Eldenk
@dogac.dev

Couple contributors quickly join, some argue there isn't a double-free bug and some say it should be fixed in a different way. However a major kernel developer Greg KH answered,

Doğaç Eldenk
@dogac.dev

> Please stop submitting known-invalid patches. Your professor is playing around with the review process in order to achieve a paper in some strange and bizarre way. > > This is not ok, it is wasting our time, and we will have to report this, AGAIN, to your university...

Doğaç Eldenk
@dogac.dev

However the OP claims those commits are auto-generated by some experimental tool and did not carry a bad intention. There is also some evidence that the same professor worked on static analysis tools.

0 reposts0 likes

Doğaç Eldenk
@dogac.dev

However another maintainer mentions he took a look at OP's patches and 3 of 4 are seemed to be adding bugs. This creates a lot of suspicion on OP's intentions and they immediately decide to revert all PR's coming from UMN (the university of the researchers) and ban them from any contribution.

Doğaç Eldenk
@dogac.dev

Looking at what the professor at UMN published in 2020, "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits" This paper was the reason why Linux maintainers were so sceptical about the patch.

Doğaç Eldenk
@dogac.dev

According to the apology letter, the research on stealthily introducing vulnerabilities was concluded last year and those commits were a product of a new research which aims to fix kernel security bugs. Also reverting all commits would result in losing valuable fixes.