From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Biggers <ebiggers@kernel.org>
Subject: Re: A Discussion Request about a maybe-false-positive of UBSAN: OOB
 Write in do_journal_end in Kernel 6.5-rc3(with POC)
Date: Thu, 10 Aug 2023 21:37:50 -0700
Message-ID: <20230811043750.GA1934@sol.localdomain>
References: <CALf2hKvsXPbRoqEYL8LEBZOFFoZd-puf6VEiLd60+oYy2TaxLg@mail.gmail.com>
 <20230809153207.zokdmoco4lwa5s6b@quack3>
 <20230810051521.GC923@sol.localdomain>
Mime-Version: 1.0
Return-path: <reiserfs-devel-owner@vger.kernel.org>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
        s=k20201202; t=1691728672;
        bh=oM3J+HVnI97b6e/ppsDoFWW8Qty/fxY7Rh8duwlKvUU=;
        h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
        b=Ea2MI1M4M8Dw/ox1lQePpfUuORPD9a3DC/NS4MLPgTllPv+LLun1HVt23zY6TRwl6
         C5DSfr3mJuz8QeOZlspmikVejYhmppu2usBzHP+o0eTEEVCt5E9zYKyrFblbjQN7P+
         h+KXKA5K7WOF8IDI4pyTJ7RYeIqLZzkiooLECBPaPA2C2yfwEXhf2kMfd9FpKF8ZZ5
         gx7syZKLMudzKsSx1GUWQbnD5+6hgExBaVzwONoIIPJMWWDaAxTdhamxM609SYfFKa
         cGaKIGH2nlFJK16vvE7DIYFOn1l6hRegX5n1P+3amh8TkQHE2n6BwBjiMLC80J20WG
         mNptodM1vxr6A==
Content-Disposition: inline
In-Reply-To: <20230810051521.GC923@sol.localdomain>
List-ID: <reiserfs-devel.vger.kernel.org>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: Jan Kara <jack@suse.cz>
Cc: Zhang Zhiyu <zhiyuzhang999@gmail.com>, reiserfs-devel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org

On Wed, Aug 09, 2023 at 10:15:23PM -0700, Eric Biggers wrote:
> On Wed, Aug 09, 2023 at 05:32:07PM +0200, Jan Kara wrote:
> > Improving kernel security is certainly a worthy goal but I have two notes.
> > Firstly, reiserfs is a deprecated filesystem and it will be removed from
> > the kernel in a not so distant future. So it is not very useful to fuzz it
> > because there are practically no users anymore and no developer is
> > interested in fixing those bugs even if you find some. Secondly, please do
> > a better job of reading the code and checking whether your theory is
> > actually valid before filing a CVE (CVE-2023-4205). That's just adding
> > pointless job for everyone... Thanks!
> 
> FYI I filled out https://cveform.mitre.org/ to request revocation of this CVE.
> 
> - Eric

Just to follow up on this, the CVE has now been "rejected".  For future
reference, MITRE had me contact Red Hat since they issued the CVE.  So the right
procedure was to email secalert@redhat.com, not fill out the CVE form.

- Eric