netdev - Re: [PATCH] iproute2: lib/utils.c bug fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 12 Apr 2013 09:02:31 -0700
From:	Stephen Hemminger <stephen@...workplumber.org>
To:	Mr Dash Four <mr.dash.four@...glemail.com>
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH] iproute2: lib/utils.c bug fixes

On Fri, 12 Apr 2013 14:49:17 +0100
Mr Dash Four <mr.dash.four@...glemail.com> wrote:

> 
> 
> Stephen Hemminger wrote:
> > On Fri, 12 Apr 2013 03:30:45 +0100
> > Mr Dash Four <mr.dash.four@...glemail.com> wrote:
> >
> >   
> >> This patch fixes the following 3 bugs in get_u32/get_u64 functions:
> >>
> >>   1. On 32-bit systems, get_u32 could not detect an overflow.
> >>      get_u32(&l, "4294967296", 10) always returned 4294967295
> >>      (ULONG_MAX on 32-bit systems).
> >>
> >>   2. get_u64(&ll, "4294967295", 10) was returning an error where
> >>      it shouldn't have (4294967295 is perfectly legitimate value for
> >>      unsigned long long).
> >>
> >>   3. get_u64 couldn't detect an overflow errors (arg > ULLONG_MAX)
> >>
> >> Signed-off-by: Mr Dash Four <mr.dash.four@...glemail.com>
> >>     
> >
> > I don't demand Developer Certificate of Origin on iproute2 patches.
> > But if you are going to include it then you must use your real name,
> > no pseudonyms. See kernel/Documentation/SubmittingPatches.
> >   
> 1. You may or may not be aware that this isn't my first-and-only 
> contribution to the 
> Linux/Netfilter/Security/Audit/kernel/any_other_Linux_development_project_you_care_to_mention 
> tree in which I used my name above.
> 2. How do you know that Dash Four isn't my name and is a "pseudonym" (do 
> you consider the name "Dotcom" not to be a real name too, simply because 
> in your, quite narrow-minded, understanding of the world this name 
> "looks a bit strange, therefore it must be a pseudonym")?
> 3. The above text you were kind enough to point me to, is with regards 
> to kernel submissions. My patch does not alter the kernel tree in any 
> way whatsoever (but even if it has, see 1. above).

The issue is that "Signed-off-by" has a legal meaning as defined
in the kernel SubmittingPatches

<quote>

       Developer's Certificate of Origin 1.1

        By making a contribution to this project, I certify that:

        (a) The contribution was created in whole or in part by me and I
            have the right to submit it under the open source license
            indicated in the file; or

        (b) The contribution is based upon previous work that, to the best
            of my knowledge, is covered under an appropriate open source
            license and I have the right under that license to submit that
            work with modifications, whether created in whole or in part
            by me, under the same open source license (unless I am
            permitted to submit under a different license), as indicated
            in the file; or

        (c) The contribution was provided directly to me by some other
            person who certified (a), (b) or (c) and I have not modified
            it.

	(d) I understand and agree that this project and the contribution
	    are public and that a record of the contribution (including all
	    personal information I submit with it, including my sign-off) is
	    maintained indefinitely and may be redistributed consistent with
	    this project or the open source license(s) involved.

then you just add a line saying

	Signed-off-by: Random J Developer <random@...eloper.example.org>

using your real name (sorry, no pseudonyms or anonymous contributions.)
</quote>

It was introduced during the SCO pre-trial paranoia phase to deal with
the possibility of somebody putting something into kernel, then claiming it
as proprietary.

By putting on Signed-off-by: you are making a legal statement.
Either resubmit without the Signed-off-by, or give a real name.





--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html