[PULL 0/7] USB-related bug fixes

[Thomas Huth <thuth@redhat.com>]

 Hi Stefan!

The following changes since commit 5ef0ecc5942ee07bb581cc96a97bbfc0fdf4005c:

  Merge tag 'hw-misc-20260714' of https://github.com/philmd/qemu into staging (2026-07-17 10:01:52 +0100)

are available in the Git repository at:

  https://gitlab.com/thuth/qemu.git tags/pull-request-2026-07-20

for you to fetch changes up to cc479aa89743655a725ce29328bcd0585a65983a:

  hw/usb/hcd-xhci-sysbus: Fix OOB heap access in xhci_sysbus_intr_raise() (2026-07-20 11:27:52 +0200)

----------------------------------------------------------------
* Fixes for various USB-related bugs

----------------------------------------------------------------
Feifan Qian (1):
      hw/usb/xhci: clamp interval exponent to avoid UB shift in xhci_init_epctx()

Marc-André Lureau (2):
      usbredir: fix use-after-free on buffered bulk packet overflow
      usbredir: fix infinite loop and SIGFPE with zero max_packet_size

Thomas Huth (2):
      hw/usb/hcd-xhci: Fix guest-triggerable assert() in xhci_find_stream()
      hw/usb/hcd-xhci-sysbus: Fix OOB heap access in xhci_sysbus_intr_raise()

Xiangfeng Cai (2):
      hw/usb/hcd-xhci-pci: break host link cycle so device_finalize() runs on unplug
      tests/qtest: add xhci-pci unplug finalize regression test

 hw/usb/hcd-xhci-pci.c           | 12 ++++++++
 hw/usb/hcd-xhci-sysbus.c        |  1 +
 hw/usb/hcd-xhci.c               | 22 ++++++++++++--
 hw/usb/redirect.c               | 42 +++++++++++++++++++++++++-
 tests/qtest/usb-hcd-xhci-test.c | 67 +++++++++++++++++++++++++++++++++++++++++
 5 files changed, 141 insertions(+), 3 deletions(-)