Commit 5257259428 for qemu.org

commit 5257259428eaa305b76e63e5657448a39de0570f
Author: Thomas Huth <thuth@redhat.com>
Date:   Mon Jul 13 18:14:04 2026 +0200

    hw/usb/hcd-xhci: Turn guest-triggerable abort() into qemu_log_mask()

    The FIXME macros in xhci_alloc_device_streams() can be triggered
    by a (malicious) guest. Since the macro also contains an abort()
    statement, this terminates QEMU. Turn the FIXME statements into
    a qemu_log_mask() instead to avoid that a guest can shoot itself
    this way.

    Reported-by: Feifan Qian <bea1e@proton.me>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3784
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
    Message-ID: <20260713161406.361197-2-thuth@redhat.com>
    Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 2cdab3ba0e..f5bb7d2560 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -965,11 +965,13 @@ static TRBCCode xhci_alloc_device_streams(XHCIState *xhci, unsigned int slotid,
          * together and make an usb_device_alloc_streams call per group.
          */
         if (epctxs[i]->nr_pstreams != req_nr_streams) {
-            FIXME("guest streams config not identical for all eps");
+            qemu_log_mask(LOG_UNIMP,
+                          "guest streams config not identical for all eps\n");
             return CC_RESOURCE_ERROR;
         }
         if (eps[i]->max_streams != dev_max_streams) {
-            FIXME("device streams config not identical for all eps");
+            qemu_log_mask(LOG_UNIMP,
+                          "device streams config not identical for all eps\n");
             return CC_RESOURCE_ERROR;
         }
     }