Commit 299e7557ed for qemu.org
commit 299e7557ed15a9a325620698add379a3ce2d1d95
Merge: 0046be6e04 6682ea3391
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon Jul 27 16:51:28 2026 -0400
Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu into staging
pci, vhost, virtio, iommu: bugfixes
Fixes all over the place, including a bunch of CVE fixes.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
# -----BEGIN PGP SIGNATURE-----
#
# iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmpnrsMPHG1zdEByZWRo
# YXQuY29tAAoJECgfDbjSjVRpRkkIAMbp882suVq4uqhYOJFCvu0pNzKyjqQRyPHk
# L+YFuKhVYoEF0Ssw9pcmq1AFT/1LzCz7DlrG1h8glxaBQ3UUyLylZWlPyDNZWUzs
# YrclY51iB4aHJm3uMmNlF82DR22BsS8DZmft65a7Xt76Z7LzhNboxW6jz2eeqWka
# /rc/0p9rymk0WOlXMwQANk3JQ9WizrYS+DBeYdbtTpHxPahZ+6napbrDQ3FS7lp8
# Ne06JjapYKZVE0XSkP4JMFRN5261NGrcS8PfCzrzdDnD7xfdnUMrYB3eqm3ZfO4D
# ZGpDloCSqblsiSXV9w9r84iStMY7EX3gnBMeUoZMTgs0erIZYdI=
# =tYYk
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 27 Jul 2026 15:17:23 EDT
# gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469
# gpg: issuer "mst@redhat.com"
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full]
# gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full]
# Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67
# Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469
* tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (30 commits)
virtio: avoid packed vring virtio_queue_empty() infinite loops (CVE-2026-16457)
backends/rng: cap request size to avoid oversized allocation
hw/virtio-rng: Fix host use-after-free (CVE-2026-50624)
hw/net/virtio-net: Protect from DMA re-entrancy bugs
intel_iommu: Check address mask before using it in pasid-based iotlb invalidation
hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle
hw/virtio/vdpa-dev: pass set_config buffer to vhost backend
hw/pci-host/q35.c: Avoid early return in mch_write_config()
hw/pci-host/q35.c: Factor out creation of SMRAM MRs
hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled
virtio-snd: check for overflow before g_malloc0
virtio-snd: check rx buffer descriptor size
virtio-iommu: fix OOM due to unbounded call_rcu
libvduse: validate vq size
libvhost-user: fix heap overflow in vu_check_queue_inflights
libvhost-user: validate last_batch_head in vu_check_queue_inflights
virtio-pmem: wait for flush requests on unrealize
vhost-user: assert nregions within limit
virtio: fail early on bad config_len in migration
virtio: stop migrating num_default, validate vring.num on load
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>