Commit 0046be6e04 for qemu.org
commit 0046be6e0440fd09e5829b8df84c23a3ca23ed53
Merge: 0ae6e3a207 92abc3c51e
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon Jul 27 16:51:16 2026 -0400
Merge tag 'pull-request-2026-07-27' of https://gitlab.com/thuth/qemu into staging
* Validate bounds in CXL "Set Feature" payloads
* Fix guest-triggerable heap OOB access in "usb-uas" device
* Fix possible crash via NULL pointer in ide_cancel_dma_sync()
* Avoid possible assert() usb_packet_copy()
* Check return value of xhci_xfer_create_sgl() for errors
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmpnVAMACgkQLtnXdP5w
# LbXM1Q/+J7zxVdGniadV0FpTn4ZalaIFmJCenoC1fqbwy2ygf3lupuOKPlkEUl+/
# NHc6LnXMZ3+/+L1FQENVgConAZnb0CLJ/l/3zhlvIShPvWkPpgWFzUFO3fGkwc1G
# RppCNRO280tLbNTFqSc57YXyqbmzG/A4N6+bGMb6sbZYrWAwuiIXDgt9TA1XM7S+
# 9Yqh+qcJ6/aFm1HUY82+cF6Kf+NFpMDI/Q7R23WpgrjAAuw/0R07PQSfyVHKe0HK
# NP7lw/xuQWvhcOHLMF3RZaQTZGekTEXK56CGvcrh0RcyPXVOYSBBtHVY7VRvEM0K
# Vjnp6vuFWKz/Mk1z2HFu+VL91PhN7FmT/vJHylkBt1UItz2M+XwfPlzAGUUobyr+
# sCrm0Cf1lIkMUOBzT1zJcvhZ1bFtk0e4YszkWVlk5ymvbov3+laiveNBJbMHz1qt
# 3QAqaiSfLnVjunQh4XRta6QVeZBO3DD1QYpT+LcsQX4GJMKqfBilyJiz1tAJsQ3i
# sZtbSMUR5HY8geGHz2VGi5Sa3ZW9dyHbFY2p99DL7l1WobJr8CIMGzxUqrsly55C
# lXeYZPjAfSnShv6SYq1kUeJ2c3otL+ti9Wq22lZzJ00Jv0LeXzgx5SMH6Dz6+KMq
# QGnFo9wEMihMWcgXwJu3sEyqiguNPHTYgZKWOHMHnfdHL19TnqU=
# =wtEN
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 27 Jul 2026 08:50:11 EDT
# gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg: aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg: aka "Thomas Huth <th.huth@posteo.de>" [full]
# gpg: aka "Thomas Huth <th.huth@posteo.eu>" [full]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5
* tag 'pull-request-2026-07-27' of https://gitlab.com/thuth/qemu:
hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl() for errors
hw/usb/core: Avoid possible assert() in do_parameter() --> usb_packet_copy()
hw/ide/core: Fix possible crash via NULL pointer in ide_cancel_dma_sync()
hw/usb/dev-uas: Fix guest-triggerable heap OOB access
hw/cxl: Validate Set Feature payload bounds
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>