Re: [PULL 00/30] pci, vhost, virtio, iommu: bugfixes

["Michael S. Tsirkin" <mst@redhat.com>]

On Sun, Jul 26, 2026 at 05:29:01PM -0400, Michael S. Tsirkin wrote:
> The following changes since commit cbd42e2b75b23953a9bdb073c8531518b1bd6163:
> 
>   Update version for v11.1.0-rc1 release (2026-07-21 13:18:25 -0400)
> 
> are available in the Git repository at:
> 
>   https://git.kernel.org/pub/scm/virt/kvm/mst/qemu.git tags/for_upstream
> 
> for you to fetch changes up to 13342b9c4104f3bf93c2e52e7de4b383971d7bd6:


moved to f2fe2afd27ddf93b49a16a29e8224d16b9888953 now:
I dropped 
       vmstate: fix type confusion in vmstate_size() for VMSTATE_VBUFFER_UINT64
will go in through the migration tree.

>   backends/rng: cap request size to avoid oversized allocation (2026-07-26 17:26:41 -0400)
> 
> ----------------------------------------------------------------
> pci, vhost, virtio, iommu: bugfixes
> 
> Fixes all over the place, including a bunch of CVE fixes.
> 
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> 
> ----------------------------------------------------------------
> Clément MATHIEU--DRIF (1):
>       intel_iommu: Check address mask before using it in pasid-based iotlb invalidation
> 
> GuoHan Zhao (1):
>       hw/virtio/vdpa-dev: pass set_config buffer to vhost backend
> 
> Haotian Jiang (1):
>       hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle
> 
> Laurent Vivier (4):
>       hw/virtio: reject zero-length packed indirect descriptor table
>       hw/net/virtio-net: Protect from DMA re-entrancy bugs
>       hw/virtio-rng: Fix host use-after-free (CVE-2026-50624)
>       backends/rng: cap request size to avoid oversized allocation
> 
> Manos Pitsidianakis (2):
>       virtio-snd: check rx buffer descriptor size
>       virtio-snd: check for overflow before g_malloc0
> 
> Michael S. Tsirkin (18):
>       virtio: use masked features with set_features_ex
>       virtio-net: fix OOB read in RSC receive path
>       virtio-net: fix short frame OOB read in receive_filter()
>       libvhost-user: protect against OOB writes in vu_set_inflight_fd
>       libvhost-user: protect against OOB vring queue access
>       vhost: do not crash on ring map failure
>       virtio-scsi: fix SCSIRequest leak on a bad request
>       virtio-mmio: fix QUEUE_NUM_MAX
>       virtio: fix queue size validation against allocated maximum
>       virtio: stop migrating num_default, validate vring.num on load
>       virtio: fail early on bad config_len in migration
>       vhost-user: assert nregions within limit
>       virtio-pmem: wait for flush requests on unrealize
>       libvhost-user: validate last_batch_head in vu_check_queue_inflights
>       libvhost-user: fix heap overflow in vu_check_queue_inflights
>       vmstate: fix type confusion in vmstate_size() for VMSTATE_VBUFFER_UINT64
>       libvduse: validate vq size
>       virtio-iommu: fix OOM due to unbounded call_rcu
> 
> Peter Maydell (3):
>       hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled
>       hw/pci-host/q35.c: Factor out creation of SMRAM MRs
>       hw/pci-host/q35.c: Avoid early return in mch_write_config()
> 
>  include/hw/scsi/scsi.h                    |   1 +
>  include/hw/virtio/virtio-bus.h            |   1 +
>  include/hw/virtio/virtio-iommu.h          |   1 +
>  include/hw/virtio/virtio-mmio.h           |   1 +
>  include/hw/virtio/virtio-pmem.h           |   1 +
>  include/migration/vmstate.h               |   5 +-
>  include/system/rng.h                      |  14 ++++
>  backends/rng.c                            |  21 +++++-
>  hw/audio/virtio-snd.c                     |  24 +++++--
>  hw/core/machine.c                         |   1 +
>  hw/i386/intel_iommu.c                     |   9 +++
>  hw/mem/cxl_type3.c                        |   3 +
>  hw/net/virtio-net.c                       |  25 ++++++-
>  hw/pci-bridge/cxl_upstream.c              |   3 +
>  hw/pci-host/q35.c                         | 110 ++++++++++++++++--------------
>  hw/scsi/scsi-bus.c                        |   7 ++
>  hw/scsi/virtio-scsi.c                     |   2 +
>  hw/virtio/vdpa-dev.c                      |   2 +-
>  hw/virtio/vhost-user.c                    |   3 +
>  hw/virtio/vhost.c                         |   5 +-
>  hw/virtio/virtio-iommu.c                  |  29 ++++++++
>  hw/virtio/virtio-mmio.c                   |   7 +-
>  hw/virtio/virtio-pmem.c                   |  17 ++++-
>  hw/virtio/virtio-rng.c                    |   2 +
>  hw/virtio/virtio.c                        |  43 ++++++++----
>  migration/vmstate.c                       |  31 ++++++++-
>  subprojects/libvduse/libvduse.c           |   5 ++
>  subprojects/libvhost-user/libvhost-user.c |  61 ++++++++++++++++-
>  28 files changed, 345 insertions(+), 89 deletions(-)
>