Hi Michael On Mon, Jul 27, 2026 at 12:57 PM Michael S. Tsirkin <[email protected]> wrote: > > On Sun, Jul 26, 2026 at 05:29:01PM -0400, Michael S. Tsirkin wrote: > > The following changes since commit cbd42e2b75b23953a9bdb073c8531518b1bd6163: > > > > Update version for v11.1.0-rc1 release (2026-07-21 13:18:25 -0400) > > > > are available in the Git repository at: > > > > https://git.kernel.org/pub/scm/virt/kvm/mst/qemu.git tags/for_upstream > > > > for you to fetch changes up to 13342b9c4104f3bf93c2e52e7de4b383971d7bd6: > > > moved to f2fe2afd27ddf93b49a16a29e8224d16b9888953 now: > I dropped > vmstate: fix type confusion in vmstate_size() for > VMSTATE_VBUFFER_UINT64 > will go in through the migration tree. >
Some of the commits have duplicate Signed-off lines. It's also strange to be both the Author and Reviewed-by (and some did not receive external review) I guess we could teach checkpatch about those quirks > > backends/rng: cap request size to avoid oversized allocation (2026-07-26 > > 17:26:41 -0400) > > > > ---------------------------------------------------------------- > > pci, vhost, virtio, iommu: bugfixes > > > > Fixes all over the place, including a bunch of CVE fixes. > > > > Signed-off-by: Michael S. Tsirkin <[email protected]> > > > > ---------------------------------------------------------------- > > Clément MATHIEU--DRIF (1): > > intel_iommu: Check address mask before using it in pasid-based iotlb > > invalidation > > > > GuoHan Zhao (1): > > hw/virtio/vdpa-dev: pass set_config buffer to vhost backend > > > > Haotian Jiang (1): > > hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle > > > > Laurent Vivier (4): > > hw/virtio: reject zero-length packed indirect descriptor table > > hw/net/virtio-net: Protect from DMA re-entrancy bugs > > hw/virtio-rng: Fix host use-after-free (CVE-2026-50624) > > backends/rng: cap request size to avoid oversized allocation > > > > Manos Pitsidianakis (2): > > virtio-snd: check rx buffer descriptor size > > virtio-snd: check for overflow before g_malloc0 > > > > Michael S. Tsirkin (18): > > virtio: use masked features with set_features_ex > > virtio-net: fix OOB read in RSC receive path > > virtio-net: fix short frame OOB read in receive_filter() > > libvhost-user: protect against OOB writes in vu_set_inflight_fd > > libvhost-user: protect against OOB vring queue access > > vhost: do not crash on ring map failure > > virtio-scsi: fix SCSIRequest leak on a bad request > > virtio-mmio: fix QUEUE_NUM_MAX > > virtio: fix queue size validation against allocated maximum > > virtio: stop migrating num_default, validate vring.num on load > > virtio: fail early on bad config_len in migration > > vhost-user: assert nregions within limit > > virtio-pmem: wait for flush requests on unrealize > > libvhost-user: validate last_batch_head in vu_check_queue_inflights > > libvhost-user: fix heap overflow in vu_check_queue_inflights > > vmstate: fix type confusion in vmstate_size() for > > VMSTATE_VBUFFER_UINT64 > > libvduse: validate vq size > > virtio-iommu: fix OOM due to unbounded call_rcu > > > > Peter Maydell (3): > > hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled > > hw/pci-host/q35.c: Factor out creation of SMRAM MRs > > hw/pci-host/q35.c: Avoid early return in mch_write_config() > > > > include/hw/scsi/scsi.h | 1 + > > include/hw/virtio/virtio-bus.h | 1 + > > include/hw/virtio/virtio-iommu.h | 1 + > > include/hw/virtio/virtio-mmio.h | 1 + > > include/hw/virtio/virtio-pmem.h | 1 + > > include/migration/vmstate.h | 5 +- > > include/system/rng.h | 14 ++++ > > backends/rng.c | 21 +++++- > > hw/audio/virtio-snd.c | 24 +++++-- > > hw/core/machine.c | 1 + > > hw/i386/intel_iommu.c | 9 +++ > > hw/mem/cxl_type3.c | 3 + > > hw/net/virtio-net.c | 25 ++++++- > > hw/pci-bridge/cxl_upstream.c | 3 + > > hw/pci-host/q35.c | 110 > > ++++++++++++++++-------------- > > hw/scsi/scsi-bus.c | 7 ++ > > hw/scsi/virtio-scsi.c | 2 + > > hw/virtio/vdpa-dev.c | 2 +- > > hw/virtio/vhost-user.c | 3 + > > hw/virtio/vhost.c | 5 +- > > hw/virtio/virtio-iommu.c | 29 ++++++++ > > hw/virtio/virtio-mmio.c | 7 +- > > hw/virtio/virtio-pmem.c | 17 ++++- > > hw/virtio/virtio-rng.c | 2 + > > hw/virtio/virtio.c | 43 ++++++++---- > > migration/vmstate.c | 31 ++++++++- > > subprojects/libvduse/libvduse.c | 5 ++ > > subprojects/libvhost-user/libvhost-user.c | 61 ++++++++++++++++- > > 28 files changed, 345 insertions(+), 89 deletions(-) > > > > -- Marc-André Lureau
