Commit c50c39370c for qemu.org

commit c50c39370cfaaf0cb50858b3cb928dae607c82ec
Author: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date:   Tue Nov 10 11:48:48 2026 +0200

    virtio-snd: reject invalid feats in set_pcm_params

    Do not blindly accept features for a stream, check them against what we
    had reported to the guest with pcm_info.

    Reviewed-by: Jim MacArthur <jim.macarthur@linaro.org>
    Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>

diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index f1dc03d1b8..89406f0a3a 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -351,6 +351,18 @@ uint32_t virtio_snd_set_pcm_params(VirtIOSound *s,
         error_report("Stream rate is not supported.");
         return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);
     }
+    if ((le32_to_cpu(params->features) & ~(stream->info.features)) > 0) {
+        error_report("%s: invalid stream features. "
+                     "Stream %d offers 0x%"PRIx32", "
+                     "guest requested 0x%"PRIx32
+                     " (invalid: 0x%"PRIx32")",
+                     VIRTIO_DEVICE(s)->name, stream_id,
+                     stream->info.features,
+                     le32_to_cpu(params->features),
+                     le32_to_cpu(params->features)
+                     & ~(stream->info.features));
+        return cpu_to_le32(VIRTIO_SND_S_BAD_MSG);
+    }

     st_params = virtio_snd_pcm_get_params(s, stream_id);