From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54730) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YzoTi-0007ms-Hy for qemu-devel@nongnu.org; Tue, 02 Jun 2015 11:51:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YzoTe-00019L-HD for qemu-devel@nongnu.org; Tue, 02 Jun 2015 11:51:46 -0400 Received: from mail-ig0-f175.google.com ([209.85.213.175]:37173) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YzoTe-00019G-E8 for qemu-devel@nongnu.org; Tue, 02 Jun 2015 11:51:42 -0400 Received: by igbsb11 with SMTP id sb11so91313329igb.0 for ; Tue, 02 Jun 2015 08:51:41 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: References: From: Peter Maydell Date: Tue, 2 Jun 2015 16:51:21 +0100 Message-ID: Content-Type: text/plain; charset=UTF-8 Subject: Re: [Qemu-devel] [PATCH 0/11] Xen PCI Passthrough security fixes List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefano Stabellini Cc: "xen-devel@lists.xensource.com Devel" , QEMU Developers , JBeulich@suse.com On 2 June 2015 at 16:32, Stefano Stabellini wrote: > On Tue, 2 Jun 2015, Stefano Stabellini wrote: >> Hi all, >> >> the following is a collection of QEMU security fixes for PCI Passthrough >> on Xen. Non-Xen usages of QEMU are unaffected. >> >> Although the CVEs have already been made public, given the large amount >> of changes, I decided not to send a pull request without giving a chance >> to the QEMU community to comment on the patches first. > > Peter convinced me to send out a pull request immediately. If anybody > has any comments on the patches, we can still fix them up later or even > revert them if that becomes necessary. For the record, the rationale is: * fixes for CVEs will have been reviewed during the nondisclosure period * getting security fixes into master in a timely fashion is important * having the patches in upstream master be different from the ones advertised with the CVE can cause confusion about which are "correct" * if there are any problems with the CVE fixes (stylistic or otherwise) we can correct them with followup patches Our workflow/process for handling security issues is not set in stone (indeed it's evolving a bit at the moment), so comments/suggestions welcome. thanks -- PMM