On Mon, Nov 17, 2014 at 04:08:58PM +0530, Amit Shah wrote: > On (Mon) 17 Nov 2014 [12:32:57], Michael S. Tsirkin wrote: > > On Mon, Nov 17, 2014 at 12:06:38PM +0530, Amit Shah wrote: > > > On (Wed) 12 Nov 2014 [11:44:35], Michael S. Tsirkin wrote: > > > > This patchset fixes CVE-2014-7840: invalid > > > > migration stream can cause arbitrary qemu memory > > > > overwrite. > > > > First patch includes the minimal fix for the issue. > > > > Follow-up patches on top add extra checking to reduce the > > > > chance this kind of bug recurs. > > > > > > > > Note: these are already (tentatively-pending review) > > > > queued in my tree, so only review/ack > > > > is necessary. > > > > > > Why not let this go in via the migration tree? > > > > Well I Cc'd Juan and David, so if they had a problem with this, I expect > > they'd complain. David acked so I assume it's ok. Since I wasted time > > testing this and have it on my tree already, might as well just merge. > > IMO asking as a courtesy would've been better than just stating it.
Right, thanks for reminding me. BTW, there is actually a good reason to special-case it: it's a CVE fix, which I handle. So they stay on my private queue and are passed to vendors so vendors can fix downstreams, until making fix public is cleared with all reporters and vendors. After reporting is cleared, I try to collect acks but don't normally route patches through separate queues - that would make it harder to track the status which we need for CVEs. I guess this specific one actually is well contained, so it could go in through a specific tree if it had to. In fact, it is still possible if Juan says he prefers it so: I only expect to send pull request around tomorrow or the day after that. > > Which reminds me: we really should have someone in MAINTAINERS > > for migration-related files. > > There is, since last week. > > > Amit That's good. I see Juan is listed there now, so all's well. -- MST