From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:52658)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <mjt@tls.msk.ru>) id 1ZbYjT-0001sn-OD
	for qemu-devel@nongnu.org; Mon, 14 Sep 2015 14:44:04 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <mjt@tls.msk.ru>) id 1ZbYjS-0001QC-V7
	for qemu-devel@nongnu.org; Mon, 14 Sep 2015 14:44:03 -0400
Message-ID: <55F71564.1010906@msgid.tls.msk.ru>
Date: Mon, 14 Sep 2015 21:43:48 +0300
From: Michael Tokarev <mjt@tls.msk.ru>
MIME-Version: 1.0
References: <1441816082-21031-1-git-send-email-jsnow@redhat.com>
	<55F27B1D.4030901@msgid.tls.msk.ru> <55F70C16.1070302@redhat.com>
In-Reply-To: <55F70C16.1070302@redhat.com>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH] ide: fix ATAPI command permissions
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: John Snow <jsnow@redhat.com>, qemu-block@nongnu.org
Cc: kwolf@redhat.com, stefano.stabellini@eu.citrix.com, armbru@redhat.com, qemu-devel@nongnu.org, ppandit@redhat.com, luodalongde@gmail.com, liuling-it@360.cn

14.09.2015 21:04, John Snow wrote:
> On 09/11/2015 02:56 AM, Michael Tokarev wrote:
>> 09.09.2015 19:28, John Snow wrote:
>>> We're a little too lenient with what we'll let an ATAPI drive handle.
>>> Clamp down on the IDE command execution table to remove CD_OK permissions
>>> from commands that are not and have never been ATAPI commands.
>>
>> FWIW, this issue has been assigned CVE-2015-6855 identifier, which
>> can be reflected in the commit message when applying.  Since this
>> issue has security impact, it might be a good idea to add
>>
>> Cc: qemu-stable@nongnu.org
> 
> I'm still awaiting review/acks, but would you like me to re-send this
> patch to trivial, or just fwd/reply-to?

I think it is anything but trivial ;)  Well, the semantics is trivial,
but it isn't -trivial material per se.

I suggested add a Cc to qemu-stable, this can be done at commit,
together with mentioning the CVE# assigned meanwhile, and I don't
know who will commit it, Kevin?

Thanks,

/mjt