Re: [PATCH] hw/display/virtio-gpu: Fix empty blob discrimination
Akihiko Odaki <[email protected]>
| Newsgroups | gmane.comp.emulators.qemu.stable,gmane.comp.emulators.qemu |
|---|---|
| Message-ID | <[email protected]> |
On 2026/07/28 16:47, Michael Tokarev wrote: > On 7/28/26 09:54, Akihiko Odaki wrote: > ... >> The consequence of the bug this patch fixes is a NULL pointer >> dereference and denial-of-service. docs/devel/stable-process.rst says: >> >> > Generally, the following patches are considered stable material: >> > >> > * Patches that fix severe issues, like fixes for CVEs >> > * Patches that fix regressions > > In these two cases, changes are *definitely* for-stable. Other changes - > fixing bugs but without regressions or CVEs - might also be for stable, > but it is more case-by-case material. > > You haven't quoted the very next paragraph from this document though: > > If you think the patch would be important for users of the current > release > (or for a distribution picking fixes), it is usually a good candidate > for stable. > > Without "regular bug fixes" in stable we wont survive ;) > >> And I don't think this match with the description. It still does fix a >> bug, and I think you can cleanly backport it and you tend to backport >> such a patch. > What I'm thinking is more like - all at once - does the bug affects users > (is the subsystem in question actually used or not (it might be some > very niche thing); is it a fast-moving target so only very recent code > makes sense in the first place and so there's no reason to back-port > fixes; can the bug be triggered in real life or just theoretical (like, > it is not a problem in current code but future changes might trigger it); > is it more a cosmetic thing or something like a crash; and so on. And > on the other hand, whenever this is a trivial fix or something more > complex which might cause bugs by its own. > > In this particular case, the fix is trivial and the subsystem is in > use, but if this bug can be seen in real life I still don't know. > > At least now I know why you haven't considered it for-stable in > the first place - because you assumed only CVE and regression fixes > should go there :) Indeed I forgot to quote the paragraph. This bug can only be triggered by a malfunctional guest and does not have a practical impact. I usually consider a fix that address a user-provided bug report for stable. Regards, Akihiko Odaki