Ghostboard pixel

Malicious Pull Requests? Not on Linus Torvalds' Watch

A new Linux kernel drama? Yes, but it's been handled.

a photo of linus torvalds with tux behind him and an illustration depicting a failed pull request on the top right

By now, you already know that Linux kernel development is a massive undertaking that's carried out by thousands of contributors, and more often than not, tensions rise, leading to some mean things being said.

I like to think of such happenings as just part of the process when dealing with a huge and complex project like Linux.

A recent event serves as a reminder of just how intense things can be.

Guardian of the Linux Kernel is Awakened

Linus to patches that mess with the Linux kernel.

Expressing concern over a kernel contributor’s tree (a set of patches), Linus Torvalds reprimanded Kees Cook for submitting 330 pull requests that copied Torvalds’ own patches and re-listed him as the author.

He called the move "actively malicious", pointing to fake merge commits that included incorrect SHA-1 signatures. For instance, a legitimate patch by Torvalds had a SHA1 beginning with 9d230d500b0e, while the duplicate/fake version submitted by Kees used f8b59a0f90a2.

Soon after, Kees clarified what might have gone wrong, attributing the issue to a faulty SSD that had thrown errors during data transfer, resulting in corrupt trees and broken merges. He apologized and agreed to get rid of the affected tree and committed to rebuilding the patch set cleanly before resubmitting.

Still, Linus remained skeptical of Kees’ explanation, doubting that such a massive rewrite of commits could have happened unintentionally. He noted that, under normal circumstances, Git would correctly update the committer information during merge rebasing, suggesting that some form of scripting (read automation) was likely involved.

Kees, again, clarified that he didn't do it deliberately, mentioning that a combination of a failing SSD, a tricky manual rebase, and some overridden checks caused this.

After some back and forth in between Kees, Linus and Konstantin Ryabitsev, it was clear that the root cause was an unintended rewrite of committer information by the B4 tool, which erroneously altered commit metadata during history rewriting.

Thanks to the 'mostly civil' and very constructive communication among all the parties involved, the issue was dealt with, and in all this, one thing was made clear: Linus Torvalds is the vigilant guardian of the Linus kernel, someone who, while easily angered, is always watching.

You can check out the whole thread if you want to dig into the details.

Suggested Read 📖

After Recent Kernel Drama, Rust for Linux Policy Put in Place
The recent Linux kernel drama over Rust code has resulted in the creation of a Rust kernel policy.
🎗️
Here's why you should opt for It's FOSS Plus Membership:

- Even the biggest players in the Linux world don't care about desktop Linux users. We do.
- We don't put informational content behind paywall. Your support keeps it open for everyone. Think of it like 'pay it forward'.
- Don't like ads? With the Plus membership, you get an ad-free reading experience.
- When millions of AI-generated content is being published daily, you read and learn from real human Linux users.
- It costs just $2 a month, less than the cost of your favorite burger.

Become a Plus Member today and join over 300 people in supporting our work.

Great! You’ve successfully signed up.

Welcome back! You've successfully signed in.

You've successfully subscribed to It's FOSS News.

Success! Check your email for magic link to sign-in.

Success! Your billing info has been updated.

Your billing was not updated.