Re: [PATCH 000/190] Revertion of all of the umn.edu commits

[Jason Gunthorpe]

On Wed, Apr 21, 2021 at 02:57:55PM +0200, Greg Kroah-Hartman wrote:
> I have been meaning to do this for a while, but recent events have
> finally forced me to do so.
> 
> Commits from @umn.edu addresses have been found to be submitted in "bad
> faith" to try to test the kernel community's ability to review "known
> malicious" changes.  The result of these submissions can be found in a
> paper published at the 42nd IEEE Symposium on Security and Privacy
> entitled, "Open Source Insecurity: Stealthily Introducing
> Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University
> of Minnesota) and Kangjie Lu (University of Minnesota).

I noted in the paper it says:

  A. Ethical Considerations

  Ensuring the safety of the experiment. In the experiment, we aim to
  demonstrate the practicality of stealthily introducing vulnerabilities
  through hypocrite commits. Our goal is not to introduce
  vulnerabilities to harm OSS. Therefore, we safely conduct the
  experiment to make sure that the introduced UAF bugs will not be
  merged into the actual Linux code

So, this revert is based on not trusting the authors to carry out
their work in the manner they explained?

>From what I've reviewed, and general sentiment of other people's
reviews I've read, I am concerned this giant revert will degrade
kernel quality more than the experimenters did - especially if they
followed their stated methodology.

Jason