Commit 2a2fc7ea6c for qemu.org

commit 2a2fc7ea6c72b0f07d6e58493b05296de85dee57
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date:   Thu Oct 29 07:43:12 2026 -0400

    qed: fix incorrect denominator in qed_bytes_to_clusters() (CVE-2026-118594)

    cluster_size - 1 is often used in bitwise mask operations in qed.h, so
    this bug is probably a copy-paste error. qed_bytes_to_clusters() uses a
    division and the denominator should be the full cluster_size value.

    This bug can be used to leak heap memory to the guest with a QED file
    where cluster_size <= 32 KB (the default is 64 KB) and table_size = 8 or
    16 (the default is 4).

    Fixes: CVE-2026-118594
    Fixes: 298800cae72e ("qed: Table, L2 cache, and cluster functions")
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4737
    Reported-by: oxsignal <awo@kakao.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

diff --git a/block/qed.h b/block/qed.h
index 26d4bf038c..04bcd7ac4f 100644
--- a/block/qed.h
+++ b/block/qed.h
@@ -253,7 +253,7 @@ static inline uint64_t qed_offset_into_cluster(BDRVQEDState *s, uint64_t offset)
 static inline uint64_t qed_bytes_to_clusters(BDRVQEDState *s, uint64_t bytes)
 {
     return qed_start_of_cluster(s, bytes + (s->header.cluster_size - 1)) /
-           (s->header.cluster_size - 1);
+           s->header.cluster_size;
 }

 static inline unsigned int qed_l1_index(BDRVQEDState *s, uint64_t pos)