Malicious Pull Requests? Not on Linus Torvalds' Watch

By now, you already know that Linux kernel development is a massive undertaking that's carried out by thousands of contributors, and more often than not, tensions rise, leading to some mean things being said.

I like to think of such happenings as just part of the process when dealing with a huge and complex project like Linux.

A recent event serves as a reminder of just how intense things can be.

Guardian of the Linux Kernel is Awakened

Expressing concern over a kernel contributor’s tree (a set of patches), Linus Torvalds reprimanded Kees Cook for submitting 330 pull requests that copied Torvalds’ own patches and re-listed him as the author.

He called the move "actively malicious", pointing to fake merge commits that included incorrect SHA-1 signatures. For instance, a legitimate patch by Torvalds had a SHA1 beginning with 9d230d500b0e, while the duplicate/fake version submitted by Kees used f8b59a0f90a2.

Soon after, Kees clarified what might have gone wrong, attributing the issue to a faulty SSD that had thrown errors during data transfer, resulting in corrupt trees and broken merges. He apologized and agreed to get rid of the affected tree and committed to rebuilding the patch set cleanly before resubmitting.

Still, Linus remained skeptical of Kees’ explanation, doubting that such a massive rewrite of commits could have happened unintentionally. He noted that, under normal circumstances, Git would correctly update the committer information during merge rebasing, suggesting that some form of scripting (read automation) was likely involved.

Kees, again, clarified that he didn't do it deliberately, mentioning that a combination of a failing SSD, a tricky manual rebase, and some overridden checks caused this.

After some back and forth in between Kees, Linus and Konstantin Ryabitsev, it was clear that the root cause was an unintended rewrite of committer information by the B4 tool, which erroneously altered commit metadata during history rewriting.

Thanks to the 'mostly civil' and very constructive communication among all the parties involved, the issue was dealt with, and in all this, one thing was made clear: Linus Torvalds is the vigilant guardian of the Linus kernel, someone who, while easily angered, is always watching.

You can check out the whole thread if you want to dig into the details.

Suggested Read 📖

After Recent Kernel Drama, Rust for Linux Policy Put in Place

The recent Linux kernel drama over Rust code has resulted in the creation of a Rust kernel policy.

It's FOSS NewsSourav Rudra