linux-kernel - Re: [PATCH] fs: Document 'name' parameter in name_contains

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250824031026.GF39973@ZenIV>
Date: Sun, 24 Aug 2025 04:10:26 +0100
From: Al Viro <viro@...iv.linux.org.uk>
To: Eric Biggers <ebiggers@...nel.org>
Cc: Prithvi Tambewagh <activprithvi@...il.com>, skhan@...uxfoundation.org,
	brauner@...nel.org, jack@...e.cz, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] fs: Document 'name' parameter in name_contains_dotdot()

On Sat, Aug 23, 2025 at 09:52:24PM -0400, Eric Biggers wrote:
> On Sun, Aug 24, 2025 at 02:06:23AM +0100, Al Viro wrote:
> > On Sat, Aug 23, 2025 at 07:52:08PM +0530, Prithvi Tambewagh wrote:
> > > Add documentation for the 'name' parameter in name_contains_dotdot()
> > > 
> > > Signed-off-by: Prithvi Tambewagh <activprithvi@...il.com>
> > 
> > Out of curiosity, could you describe the process that has lead to
> > that patch?
> > 
> > The reason why I'm asking is that there had been a truly ridiculous
> > amount of identical patches, all dealing with exact same function.
> > 
> > Odds of random coincedence are very low - there's quite lot of
> > similar places, and AFAICS you are the 8th poster choosing the
> > same one.
> > 
> > I would expect that kind of response to a "kernel throws scary
> > warnings on boot for reasonably common setups", but for a comment
> > about a function being slightly wrong this kind of focus is
> > strange.
> > 
> > If that's some AI (s)tool responding to prompts along the lines of
> > "I want to fix some kernel problem, find some low-hanging fruit
> > and gimme a patch", we might be seeing a small-scale preview of
> > a future DDoS with the same underlying mechanism...
> 
> You do know that kernel-doc warns about this, right?
> 
>     $ ./scripts/kernel-doc -v -none include/linux/fs.h
>     [...]
>     Warning: include/linux/fs.h:3287 function parameter 'name' not described in 'name_contains_dotdot'
> 
> It's the only warning in include/linux/fs.h.

; ./scripts/kernel-doc -v -none include/linux/*.h 2>&1|grep -c Warning.*function\ parameter
 145

I rest my point.  If one of those has managed to generate 8 duplicate patches
(and the earliest one has landed in linux-next within a day) and people are
still sending that stuff...  I'd say we have a problem.

Whatever underlying mechanism is in action, it seems to have the makings of
a large DDoS.  I'm not blaming the people sending that and I would really
like to understand the mechanism behind this, er, synchronicity.