Subject: Re: using vulnerability ids in patches
To: Johannes Berg <johannes@sipsolutions.net>,
        Kalle Valo <kvalo@codeaurora.org>
Cc: linux-wireless <linux-wireless@vger.kernel.org>
References: <7415a11b-398c-69df-b39f-7b985f07112b@broadcom.com>
 <1504774743.6177.0.camel@sipsolutions.net>
From: Arend van Spriel <arend.vanspriel@broadcom.com>
Message-ID: <2071b388-93fd-2c51-599f-bfd091f5ec68@broadcom.com> (sfid-20170907_112829_279505_1F4DE4F1)
Date: Thu, 7 Sep 2017 11:28:09 +0200
MIME-Version: 1.0
In-Reply-To: <1504774743.6177.0.camel@sipsolutions.net>
Content-Type: text/plain; charset=utf-8; format=flowed
Sender: linux-wireless-owner@vger.kernel.org

On 07-09-17 10:59, Johannes Berg wrote:
> On Thu, 2017-09-07 at 10:40 +0200, Arend van Spriel wrote:
>> Hi Kalle,
>>
>> Due to recent events we were asked about some vulnerability fixes
>> for
>> brcmfmac. We already fixed a couple of things without referring to a
>> so-called CVE-ID, which is what people are asking for. Do we have a
>> upstream policy on that? I could not really find anything in the
>> Documentation folder (but I may have overlooked it). Might be worth
>> mentioning in the commit message like with the coverity ids.
> 
> Sure.
> 
> git log --grep "CVE-"
> 
> shows it being done frequently.

Right. Failed to do the obvious ;-)

Thanks,
Arend