Commit 2295deb488 for qemu.org

commit 2295deb48898f2c466d0a5013cdd35a9d836b1cb
Author: Denis V. Lunev <den@openvz.org>
Date:   Mon Aug 31 12:01:48 2026 +0200

    io/channel-websock: handle a blocked write during the handshake

    qio_channel_websock_handshake_send() treats every negative return from
    qio_channel_write() as fatal and passes err to error_get_pretty().
    QIO_CHANNEL_ERR_BLOCK is negative but leaves err NULL, so a socket
    which cannot take the response immediately crashes QEMU before the
    client has authenticated.

    Keep the G_IO_OUT watch armed and retry instead.

    Fixes: 2d1d0e70cf3e ("io: add QIOChannelWebsock class")
    Fixes: CVE-2026-84788
    Cc: qemu-stable@nongnu.org
    Cc: Daniel P. Berrangé <berrange@redhat.com>
    Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
    Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Signed-off-by: Denis V. Lunev <den@openvz.org>
    Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

diff --git a/io/channel-websock.c b/io/channel-websock.c
index 66c91ed2a2..8f27b1f12b 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -562,6 +562,11 @@ static gboolean qio_channel_websock_handshake_send(QIOChannel *ioc,
                             wioc->encoutput.offset,
                             &err);

+    if (ret == QIO_CHANNEL_ERR_BLOCK) {
+        /* Socket buffer is full, the G_IO_OUT watch stays armed */
+        return TRUE;
+    }
+
     if (ret < 0) {
         trace_qio_channel_websock_handshake_fail(ioc, error_get_pretty(err));
         qio_task_set_error(task, err);