Post

This must be one of the weirdest dramas between the OSS community and Academia: lobste.rs/s/3qgyzp/the... "They introduce kernel bugs on purpose" 🧵

It starts with a patch on the GSS-based authentication (auth_gss.c) used within the linux kernel's SunRPC implementation. SunRPC is developed by Sun Microsystems as a part of their NFS implementation. That patch supposedly prevents a "double-free" bug.

Couple contributors quickly join, some argue there isn't a double-free bug and some say it should be fixed in a different way. However a major kernel developer Greg KH answered,

> Please stop submitting known-invalid patches. Your professor is playing around with the review process in order to achieve a paper in some strange and bizarre way. > > This is not ok, it is wasting our time, and we will have to report this, AGAIN, to your university...

However the OP claims those commits are auto-generated by some experimental tool and did not carry a bad intention. There is also some evidence that the same professor worked on static analysis tools.

Looking at what the professor at UMN published in 2020, "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits" This paper was the reason why Linux maintainers were so sceptical about the patch.

Paper mentioned: raw.githubusercontent.com/QiushiWu/qiu... Original patch that started the banning process, lore.kernel.org/linux-nfs/20... Apology letter from the authors, lore.kernel.org/lkml/CAK8Kej... Q&A: www-users.cse.umn.edu/~kjlu/papers...

According to the apology letter, the research on stealthily introducing vulnerabilities was concluded last year and those commits were a product of a new research which aims to fix kernel security bugs. Also reverting all commits would result in losing valuable fixes.