[GIT PULL 00/15] Various UI/security-related fixes for 11.1

["Marc-André Lureau" <marcandre.lureau@redhat.com>]

The following changes since commit eca2c16212ef9dcb0871de39bb9d1c2efebe76be:

  Update version for v11.1.0-rc0 release (2026-07-14 20:36:23 +0100)

are available in the Git repository at:

  https://gitlab.com/marcandre.lureau/qemu.git tags/fix-pr-v1

for you to fetch changes up to f1af81ba2aeec7b5a5ee8529ef55275865aea0c0:

  hw/display/virtio-gpu: Check pixman_image_create_bits() results (2026-07-17 15:52:31 +0400)

----------------------------------------------------------------
Various UI/security-related fixes for 11.1

To: qemu-devel@nongnu.org
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

----------------------------------------------------------------
Akihiko Odaki (3):
      ui/gtk: Narrow DMA-BUF critical section
      hw/display/virtio-gpu: reject strides exceeding INT_MAX
      hw/display/virtio-gpu: Check pixman_image_create_bits() results

Marc-André Lureau (12):
      i386/tdx: fix uninitialized variable warning in tdx_check_features
      ui/vnc: fix OOB write in vnc_refresh_lossy_rect
      ui/vnc: validate color shifts in SetPixelFormat
      ui/vnc: use RFB wire types for client message handlers
      ui/input-barrier: fix off-by-one in keycode bounds check
      ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
      ui/vnc: validate SetPixelFormat field ranges
      hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
      hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
      hw/display/virtio-gpu: validate stride against width on scanout
      hw/display/virtio-gpu: cap submit_3d command buffer allocation
      hw/display/virtio-gpu: handle migration iov allocation failure

 contrib/vhost-user-gpu/vugpu.h   |  9 ++++++
 include/hw/virtio/virtio-gpu.h   |  9 ++++++
 contrib/vhost-user-gpu/virgl.c   |  7 +++++
 hw/display/qxl-render.c          | 28 ++++++++++-------
 hw/display/virtio-gpu-rutabaga.c |  8 +++++
 hw/display/virtio-gpu-udmabuf.c  |  1 +
 hw/display/virtio-gpu-virgl.c    |  8 +++++
 hw/display/virtio-gpu.c          | 57 ++++++++++++++++++++++++++++++++---
 target/i386/kvm/tdx.c            |  2 +-
 ui/gtk-egl.c                     |  6 ++--
 ui/gtk-gl-area.c                 | 23 +-------------
 ui/input-barrier.c               |  2 +-
 ui/vnc.c                         | 65 ++++++++++++++++++++++++----------------
 13 files changed, 157 insertions(+), 68 deletions(-)