Commit 5611a9268d for qemu.org
commit 5611a9268dae7b7ff99d478ed134052a9fc7e9f7
Merge: 49044ac0bb 5a8da7e979
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon Jun 1 08:43:53 2026 -0400
Merge tag 'pull-9p-20260601' of https://github.com/cschoenebeck/qemu into staging
9pfs changes:
- fix V9fsPath heap buffer overflow (gitlab #3358)
- fix missing rename lock in v9fs_co_readdir_many (CVE-2026-48004)
# -----BEGIN PGP SIGNATURE-----
#
# iQJLBAABCgA1FiEEltjREM96+AhPiFkBNMK1h2Wkc5UFAmodVmQXHHFlbXVfb3Nz
# QGNydWRlYnl0ZS5jb20ACgkQNMK1h2Wkc5WQEA//VgSO/pQrK+6N0zKgPGCsNmY+
# gPqZMjZDnMSCHmmvEkQzdObbkBSJR8yrXnJm4MBkwx0CiVWL0AuGEpdlXmFkIrXR
# 7w2aW12a6G9KStFmQzMShx5VtbQHECkxWSoGwEvNYKysgOC1rubokxQiW/FZMexr
# SFkBuXlCdH5HEQHisidbeQOLPEzpZUqsF+6ex3cyBtTBBzE3Bm3e0EKEFsNw7Pod
# 3tjGmZpc9vU0EA/tFpK21nOk4k6sVLws7QugsG75YbFdsMW3XYb2curBDOn8zJIp
# Vc2685U8i1HKE349t8zBrrwXxZcI0vcV1S4tDKsexHxhBkLhNxWurERsX3XCV9pp
# hygASyPULI25Ckvv4lvXG1tmGWcuvyJ0IKSH4VsOLVGAuckB+k9pUqVHpe/tzl4T
# tL4jMISi63ud0VxZYdtmvvxgevdxa7dkM/0dbSl3r2De8KErPPTPxoOJR5IwbBca
# kuyYHImv/sgV6O3z0bE3RgpYSDNKmzdagmZyXbe4JKchw/sHAsi5+2X23ow3YkQI
# m6mJefb39HrQe6uMo5NKhGnv7x3kByvTi9eiIU/xdxaHRx+Q3o801u78jDcHPn4h
# 8amzgjWtHxVngNdQ7NR8qExu+2iepw3LtVpz5sfqfGwwn4/CjMegV+/Vf4iZ5eTH
# 22+c2sZfepyd2MqOL/I=
# =vJVW
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 01 Jun 2026 05:52:36 EDT
# gpg: using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395
# gpg: issuer "qemu_oss@crudebyte.com"
# gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" [unknown]
# gpg: Note: This key has expired!
# Primary key fingerprint: ECAB 1A45 4014 1413 BA38 4926 30DB 47C3 A012 D5F4
# Subkey fingerprint: 96D8 D110 CF7A F808 4F88 5901 34C2 B587 65A4 7395
* tag 'pull-9p-20260601' of https://github.com/cschoenebeck/qemu:
9pfs: fix missing rename lock in v9fs_co_readdir_many (CVE-2026-48004)
tests/9pfs: add deep absolute path test
tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset
hw/9pfs: let callers of v9fs_path_sprintf() and v9fs_fix_path() handle errors
hw/9pfs: add error handling to v9fs_fix_path()
hw/9pfs: change V9fsPath.size to size_t and v9fs_path_sprintf() return type
hw/9pfs: add NULL check in v9fs_path_is_ancestor()
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>