[PULL 0/4] Misc fixes patches

[PULL 0/4] Misc fixes patches

[Daniel P. Berrangé]

The following changes since commit d7a65d1793d691d356a56833620f7d1e6f5d653b:

  Merge tag 'hppa-a400-updates-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2026-10-03 14:17:49 +0200)

are available in the Git repository at:

  https://gitlab.com/berrange/qemu tags/misc-fixes-pull-request

for you to fetch changes up to f33fb19cab412ffbc19e3b7914a320ae1d73709c:

  seccomp: fix blocking of setns/execveat/unshare (2026-10-06 09:17:43 +0100)

----------------------------------------------------------------
Merge USB, I/O and seccomp fixes

* Fix seccomp to use errno action for setns/execveat/unshare
  instead of killing the thread
* Improve TLS performance and avoid test suite timeouts by
  corking TLS writes to increase packet size
* Fix websocket server unbounded read of client data
  CVE-2026-101291
* Avoid use-after-free in MTP device during object delete

----------------------------------------------------------------

Daniel P. Berrangé (3):
  io: prevent unbounded read of websocket data from client
  io: cork TLS writes to avoid small TLS records
  seccomp: fix blocking of setns/execveat/unshare

Tommaso Califano (1):
  hw/usb: Fix USB MTP Use-After-Free in usb_mtp_deletefn List Iteration

 crypto/tlssession.c         | 45 +++++++++++++++++++
 hw/usb/dev-mtp.c            |  4 +-
 include/crypto/tlssession.h | 25 +++++++++++
 include/io/channel-tls.h    |  1 +
 io/channel-tls.c            | 87 ++++++++++++++++++++++++++++++++++---
 io/channel-websock.c        |  4 +-
 system/qemu-seccomp.c       | 15 +++++--
 7 files changed, 169 insertions(+), 12 deletions(-)

-- 
2.55.0

[PULL 1/4] hw/usb: Fix USB MTP Use-After-Free in usb_mtp_deletefn List Iteration

[Daniel P. Berrangé]

From: Tommaso Califano <tcalifan@redhat.com>

In QEMU's USB MTP (Media Transfer Protocol) device emulation, the usb_mtp_deletefn()
function in hw/usb/dev-mtp.c iterates over a child object list using QLIST_FOREACH
while the recursive call may free the current element. After the free, the macro reads
the le_next field from freed memory to advance the iterator.

Replace QLIST_FOREACH with QLIST_FOREACH_SAFE, which saves the next pointer before the
iteration body executes.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3991
Signed-off-by: Tommaso Califano <tcalifan@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 hw/usb/dev-mtp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index 1d8cfd32dc6..c2d36a73cf9 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -1152,7 +1152,7 @@ enum {
 
 static int usb_mtp_deletefn(MTPState *s, MTPObject *o, uint32_t trans)
 {
-    MTPObject *iter, *iter2;
+    MTPObject *iter, *iter2, *iter2_next;
     int ret = 0;
 
     /*
@@ -1161,7 +1161,7 @@ static int usb_mtp_deletefn(MTPState *s, MTPObject *o, uint32_t trans)
 
     QLIST_FOREACH(iter, &o->children, list) {
         if (iter->format == FMT_ASSOCIATION) {
-            QLIST_FOREACH(iter2, &iter->children, list) {
+            QLIST_FOREACH_SAFE(iter2, &iter->children, list, iter2_next) {
                 ret |= usb_mtp_deletefn(s, iter2, trans);
             }
         }
-- 
2.55.0

[PULL 2/4] io: prevent unbounded read of websocket data from client

[Daniel P. Berrangé]

The QIOChannelWebsock class wraps an underlying QIOChannel instance,
providing a websocket server handshake and packet encoding/decoding.

When a watch is added to QIOChannelWebsock, this in turn creates a watch
on the underlying QIOChannel that is always monitoring G_IO_IN, as long
as the 'encinput' buffer has space.

When this watch fires, it reads data off the wire into 'encinput' and
then decodes as much of 'encinput' as possible into the 'rawinput'
buffer.

The qio_channel_websock_set_watch method checks to see that 'encinput'
does not exceed a max limit, but fails to check that 'rawinput' size.
Since any data read into 'encinput', can usually be immediately decoded
into 'rawinput', the 'encinput' size check is largely a no-op, and so
'rawinput' will grow without bound.

This is readily seen with the chardev socket backend if enabling
websockets, connecting a client that sends data, while not running any
guest OS to consume data from the chardev via a virtual serial port.

The qio_channel_websock_read_wire() method will also unconditionally
read more data into 'encinput' if it has less than 4k present, which
is then decoded into 'rawinput'.

IOW, if qio_channel_websock_read_wire() is triggered for lots of small
reads, it will be reading and decoding more data to 'rawinput' than is
consumed. Skip reading more data if 'rawinput' is already at its max
size.

Reported-by: Aisle Research
Fixes: CVE-2026-101291
Fixes: 2d1d0e70cf3e ("io: add QIOChannelWebsock class")
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 io/channel-websock.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/io/channel-websock.c b/io/channel-websock.c
index 461abcae487..646cd45be2a 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -970,7 +970,8 @@ static ssize_t qio_channel_websock_read_wire(QIOChannelWebsock *ioc,
 {
     ssize_t ret;
 
-    if (ioc->encinput.offset < 4096) {
+    if (ioc->encinput.offset < 4096 &&
+        ioc->rawinput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) {
         size_t want = 4096 - ioc->encinput.offset;
 
         buffer_reserve(&ioc->encinput, want);
@@ -1091,6 +1092,7 @@ static void qio_channel_websock_set_watch(QIOChannelWebsock *ioc)
         cond |= G_IO_OUT;
     }
     if (ioc->encinput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER &&
+        ioc->rawinput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER &&
         !ioc->io_eof) {
         cond |= G_IO_IN;
     }
-- 
2.55.0

[PULL 3/4] io: cork TLS writes to avoid small TLS records

[Daniel P. Berrangé]

The migration code caches vmstate/ram writes into an iovec and
flushes this periodically. The total amount of data to sent
may be 100's of KB, but split across many iovec, each of which
is potentially quite small.

The QIOChannelTLS receives the iovec, but since GNUTLS cannot
accept iovec data, it iterates calling send for each element.

As a result of the migration data pattern, this results in
GNUTLS putting lots of small TLS records on the wire. This
has shown writes alternate between about 4k and 30 bytes
in some tests.

This is triggering the nagle algorithm on migration-test for
many of the TLS test cases, resulting in a "go slow" for I/O
that eventually hits the migration timeout configured by the
test.

Not every contributor reports seeing the "go slow" but for
those who do see it, it hits >= 95% of the time for at least
one of the migration TLS test cases run by 'make check'.

While we could disable the nagle algorithm (and multifd
channels already do this), that would stil result in lots
of small TLS records hitting the wire which is not good for
throughput. The migration code flushes in batches because
it wants large writes for high throughput.

To achieve this we must tell GNUTLS to encrypt data but not
immediately sent TLS records by "corking" its output. Once
the complete iovec has been written to GNUTLS, it can be
uncorked allowing it to hit the wire.

There is added complexity with uncorking on non-blocking
channels as not all encrypted data can be sent at once.
qio_channel_write() will return what was sent, but some
data might remain pending inside GNUTLS buffers. A later
call to qio_channel_write() will provide the same plain
text data buffers that have already been cached. Thus the
code must attempt to uncork GNUTLS again to clear pending
data and then deduct the equivalent amount of plain text.

Overall this corking action fixes the test suite timeouts,
but more importantly, it also improves the performance of
TLS protection migrations in the real world. Tests with
one workload show at 36% increase in throughput.

Reviewed-by: Peter Xu <peterx@redhat.com>
Tested-by: Juraj Marcin <jmarcin@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlssession.c         | 45 +++++++++++++++++++
 include/crypto/tlssession.h | 25 +++++++++++
 include/io/channel-tls.h    |  1 +
 io/channel-tls.c            | 87 ++++++++++++++++++++++++++++++++++---
 4 files changed, 152 insertions(+), 6 deletions(-)

diff --git a/crypto/tlssession.c b/crypto/tlssession.c
index 314e3e96ba8..b343d1a5956 100644
--- a/crypto/tlssession.c
+++ b/crypto/tlssession.c
@@ -513,6 +513,39 @@ qcrypto_tls_session_read(QCryptoTLSSession *session,
 }
 
 
+void qcrypto_tls_session_write_cork(QCryptoTLSSession *sess)
+{
+    gnutls_record_cork(sess->handle);
+}
+
+
+ssize_t qcrypto_tls_session_write_uncork(QCryptoTLSSession *sess,
+                                         Error **errp)
+{
+    int ret;
+    ret = gnutls_record_uncork(sess->handle, 0);
+    if (ret == GNUTLS_E_AGAIN ||
+        ret == GNUTLS_E_INTERRUPTED) {
+        ret = gnutls_record_check_corked(sess->handle);
+        if (ret < 0) {
+            error_setg(errp,
+                       "Cannot query pending TLS output: %s",
+                       gnutls_strerror(ret));
+            return -1;
+        }
+
+        return ret;
+    } else if (ret < 0) {
+        error_setg(errp,
+                   "Cannot uncork TLS output: %s",
+                   gnutls_strerror(ret));
+        return -1;
+    }
+
+    return 0;
+}
+
+
 size_t
 qcrypto_tls_session_check_pending(QCryptoTLSSession *session)
 {
@@ -757,4 +790,16 @@ qcrypto_tls_session_get_peer_name(QCryptoTLSSession *sess)
     return NULL;
 }
 
+void qcrypto_tls_session_write_cork(QCryptoTLSSession *sess)
+{
+}
+
+
+ssize_t qcrypto_tls_session_write_uncork(QCryptoTLSSession *sess,
+                                         Error **errp)
+{
+    error_setg(errp, "TLS requires GNUTLS support");
+    return -1;
+}
+
 #endif
diff --git a/include/crypto/tlssession.h b/include/crypto/tlssession.h
index 28e419681e4..5415503ebab 100644
--- a/include/crypto/tlssession.h
+++ b/include/crypto/tlssession.h
@@ -208,6 +208,31 @@ typedef ssize_t (*QCryptoTLSSessionReadFunc)(void *buf,
                                              void *opaque,
                                              Error **errp);
 
+/**
+ * qcrypto_tls_session_write_cork:
+ * @sess: the TLS session object
+ *
+ * Causes future qcrypto_tls_session_write() calls to encrypt
+ * and queue data, without sending on the wire.
+ */
+void qcrypto_tls_session_write_cork(QCryptoTLSSession *sess);
+
+/**
+ * qcrypto_tls_session_write_uncork:
+ * @sess: the TLS session object
+ * @errp: pointer to a NULL-initialized error object
+ *
+ * Attempt to send previously queued data. If the underlying
+ * stream is non-blocking, then only a subset of data (if any)
+ * may be written. To process outstanding data, this method
+ * must be called again until it returns 0.
+ *
+ * Returns: the number of bytes remaining to be sent,
+ * or -1 on error.
+ */
+ssize_t qcrypto_tls_session_write_uncork(QCryptoTLSSession *sess,
+                                         Error **errp);
+
 /**
  * qcrypto_tls_session_set_callbacks:
  * @sess: the TLS session object
diff --git a/include/io/channel-tls.h b/include/io/channel-tls.h
index 7e9023570d8..9e9b00c034b 100644
--- a/include/io/channel-tls.h
+++ b/include/io/channel-tls.h
@@ -50,6 +50,7 @@ struct QIOChannelTLS {
     QIOChannelShutdown shutdown;
     guint hs_ioc_tag;
     guint bye_ioc_tag;
+    size_t corked;
 };
 
 /**
diff --git a/io/channel-tls.c b/io/channel-tls.c
index 31ec4d236de..05317ed5a38 100644
--- a/io/channel-tls.c
+++ b/io/channel-tls.c
@@ -21,6 +21,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/module.h"
+#include "qemu/iov.h"
 #include "io/channel-tls.h"
 #include "trace.h"
 #include "qemu/atomic.h"
@@ -448,12 +449,24 @@ static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
     size_t i;
     ssize_t done = 0;
+    ssize_t remain;
+    g_autofree struct iovec *tmpiov = NULL;
+    size_t ntmpiov = 0;
 
-    for (i = 0 ; i < niov ; i++) {
-        ssize_t ret = qcrypto_tls_session_write(tioc->session,
-                                                iov[i].iov_base,
-                                                iov[i].iov_len,
-                                                errp);
+    /*
+     * The previous write encrypted all the data, but some
+     * was not able to be sent on the wire when uncorked,
+     * so we returned a short write. The encrypted data
+     * will still be cached by GNUTLS and the session will
+     * be in a corked state.
+     *
+     * This write call will be trying to write the remaining
+     * plain text data again, but we must avoid sending that
+     * into GNUTLS. Instead flush the previously encrypted
+     * pending data.
+     */
+    while (tioc->corked) {
+        ssize_t ret = qcrypto_tls_session_write_uncork(tioc->session, errp);
         if (ret == QCRYPTO_TLS_SESSION_ERR_BLOCK) {
             if (done) {
                 return done;
@@ -463,12 +476,74 @@ static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
         } else if (ret < 0) {
             return -1;
         }
+        done += (tioc->corked - ret);
+        tioc->corked = ret;
+    }
+
+    /*
+     * If we flushed pending data, we must discard an
+     * equivalent amount of plain text data from this
+     * write call, and then process what's left over,
+     * if any.
+     */
+    if (done) {
+        ssize_t total = iov_size(iov, niov);
+        if (done == total) {
+            return done;
+        }
+
+        tmpiov = g_new0(struct iovec, niov);
+        ntmpiov = iov_copy(tmpiov, niov, iov, niov,
+                           done, total - done);
+
+        iov = tmpiov;
+        niov = ntmpiov;
+    }
+
+    /*
+     * At this point we should ony be processing "new"
+     * data, not seen by a previous write call so we
+     * send to GNUTLS as normal.
+     */
+    qcrypto_tls_session_write_cork(tioc->session);
+    for (i = 0 ; i < niov ; i++) {
+        ssize_t ret = qcrypto_tls_session_write(tioc->session,
+                                                iov[i].iov_base,
+                                                iov[i].iov_len,
+                                                errp);
+        if (ret == QCRYPTO_TLS_SESSION_ERR_BLOCK) {
+            error_setg(errp, "Unexpected TLS blocking I/O while corked");
+            return -1;
+        } else if (ret < 0) {
+            return -1;
+        }
         done += ret;
         if (ret < iov[i].iov_len) {
             break;
         }
     }
-    return done;
+
+    /*
+     * On non-blocking sockets, uncorking may not succeed
+     * in sending all encrypted data, so we have to check
+     * what was actually sent to see if GNUTLS remains in
+     * the corked state with pending data.
+     */
+    remain = qcrypto_tls_session_write_uncork(tioc->session, errp);
+    if (remain < 0) {
+        return -1;
+    } else if (remain) {
+        tioc->corked = remain;
+    }
+    /*
+     * done == what we sent to GNUTLS for encryption & sending
+     * remain == subset of 'done' that was encrypted but not sent
+     */
+    if (done && (remain == done)) {
+        return QIO_CHANNEL_ERR_BLOCK;
+    } else {
+        return done - remain;
+    }
 }
 
 static int qio_channel_tls_set_blocking(QIOChannel *ioc,
-- 
2.55.0

[PULL 4/4] seccomp: fix blocking of setns/execveat/unshare

[Daniel P. Berrangé]

The initializer for these syscalls missed the seccomp action
field, so it got the default action which was to kill the calling
thread, instead of returning an errno value, which the other
equivalent syscalls use.

Since we don't ever intend to use a seccomp filter without a
defined action, use an assert to validate that action is always
set to non-zero.

Reported-by: Igor Santos-Grueiro (gitlab:@igorsantosgrueiro)
Fixes: https://gitlab.com/qemu-project/qemu/-/work_items/4600
Fixes: 4638057110 (seccomp: block setns, unshare and execveat syscalls)
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 system/qemu-seccomp.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/system/qemu-seccomp.c b/system/qemu-seccomp.c
index f8e1238b914..3889d48b4f2 100644
--- a/system/qemu-seccomp.c
+++ b/system/qemu-seccomp.c
@@ -249,10 +249,13 @@ static const struct QemuSeccompSyscall denylist[] = {
       0, NULL, SCMP_ACT_ERRNO(ENOSYS) },
 #endif
 #ifdef __SNR_execveat
-    { SCMP_SYS(execveat),               QEMU_SECCOMP_SET_SPAWN },
+    { SCMP_SYS(execveat),               QEMU_SECCOMP_SET_SPAWN,
+      ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
 #endif
-    { SCMP_SYS(setns),                  QEMU_SECCOMP_SET_SPAWN },
-    { SCMP_SYS(unshare),                QEMU_SECCOMP_SET_SPAWN },
+    { SCMP_SYS(setns),                  QEMU_SECCOMP_SET_SPAWN,
+      ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
+    { SCMP_SYS(unshare),                QEMU_SECCOMP_SET_SPAWN,
+      ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
     /* resource control */
     { SCMP_SYS(setpriority),            QEMU_SECCOMP_SET_RESOURCECTL,
       0, NULL, SCMP_ACT_ERRNO(EPERM) },
@@ -337,6 +340,12 @@ static int seccomp_start(uint32_t seccomp_opts, Error **errp)
         if (!(seccomp_opts & denylist[i].set)) {
             continue;
         }
+        /*
+         * action == 0 is SCMP_ACT_KILL_THREAD which is not
+         * something we ever want to use. Validate it to protect
+         * against missing struct field initializers
+         */
+        assert(denylist[i].action);
 
         action = qemu_seccomp_update_action(denylist[i].action);
         rc = seccomp_rule_add_array(ctx, action, denylist[i].num,
-- 
2.55.0

Re: [PULL 0/4] Misc fixes patches

[Richard Henderson]

On 10/6/26 10:34, Daniel P. Berrangé wrote:
> The following changes since commit d7a65d1793d691d356a56833620f7d1e6f5d653b:
> 
>    Merge tag 'hppa-a400-updates-pull-request' ofhttps://github.com/hdeller/qemu-hppa into staging (2026-10-03 14:17:49 +0200)
> 
> are available in the Git repository at:
> 
>    https://gitlab.com/berrange/qemu tags/misc-fixes-pull-request
> 
> for you to fetch changes up to f33fb19cab412ffbc19e3b7914a320ae1d73709c:
> 
>    seccomp: fix blocking of setns/execveat/unshare (2026-10-06 09:17:43 +0100)
> 
> ----------------------------------------------------------------
> Merge USB, I/O and seccomp fixes
> 
> * Fix seccomp to use errno action for setns/execveat/unshare
>    instead of killing the thread
> * Improve TLS performance and avoid test suite timeouts by
>    corking TLS writes to increase packet size
> * Fix websocket server unbounded read of client data
>    CVE-2026-101291
> * Avoid use-after-free in MTP device during object delete

Applied, thanks.

r~

Re: [PULL 0/4] Misc fixes patches

[Michael Tokarev]

On 06.10.2026 11:34, Daniel P. Berrangé wrote:
> The following changes since commit d7a65d1793d691d356a56833620f7d1e6f5d653b:
> 
>    Merge tag 'hppa-a400-updates-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2026-10-03 14:17:49 +0200)
> 
> are available in the Git repository at:
> 
>    https://gitlab.com/berrange/qemu tags/misc-fixes-pull-request
> 
> for you to fetch changes up to f33fb19cab412ffbc19e3b7914a320ae1d73709c:
> 
>    seccomp: fix blocking of setns/execveat/unshare (2026-10-06 09:17:43 +0100)
> 
> ----------------------------------------------------------------
> Merge USB, I/O and seccomp fixes
> 
> * Fix seccomp to use errno action for setns/execveat/unshare
>    instead of killing the thread
> * Improve TLS performance and avoid test suite timeouts by
>    corking TLS writes to increase packet size
> * Fix websocket server unbounded read of client data
>    CVE-2026-101291
> * Avoid use-after-free in MTP device during object delete
> 
> ----------------------------------------------------------------
> 
> Daniel P. Berrangé (3):
>    io: prevent unbounded read of websocket data from client
>    io: cork TLS writes to avoid small TLS records
>    seccomp: fix blocking of setns/execveat/unshare
> 
> Tommaso Califano (1):
>    hw/usb: Fix USB MTP Use-After-Free in usb_mtp_deletefn List Iteration

I'm picking the 3 out of 4 changes here for qemu-stable - omitting
the "cork" one.  Please let me know if I should not.

Thanks,

/mjt

Re: [PULL 0/4] Misc fixes patches

[Daniel P. Berrangé]

On Sat, Oct 10, 2026 at 10:29:34AM +0300, Michael Tokarev wrote:
> On 06.10.2026 11:34, Daniel P. Berrangé wrote:
> > The following changes since commit d7a65d1793d691d356a56833620f7d1e6f5d653b:
> > 
> >    Merge tag 'hppa-a400-updates-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2026-10-03 14:17:49 +0200)
> > 
> > are available in the Git repository at:
> > 
> >    https://gitlab.com/berrange/qemu tags/misc-fixes-pull-request
> > 
> > for you to fetch changes up to f33fb19cab412ffbc19e3b7914a320ae1d73709c:
> > 
> >    seccomp: fix blocking of setns/execveat/unshare (2026-10-06 09:17:43 +0100)
> > 
> > ----------------------------------------------------------------
> > Merge USB, I/O and seccomp fixes
> > 
> > * Fix seccomp to use errno action for setns/execveat/unshare
> >    instead of killing the thread
> > * Improve TLS performance and avoid test suite timeouts by
> >    corking TLS writes to increase packet size
> > * Fix websocket server unbounded read of client data
> >    CVE-2026-101291
> > * Avoid use-after-free in MTP device during object delete
> > 
> > ----------------------------------------------------------------
> > 
> > Daniel P. Berrangé (3):
> >    io: prevent unbounded read of websocket data from client
> >    io: cork TLS writes to avoid small TLS records
> >    seccomp: fix blocking of setns/execveat/unshare
> > 
> > Tommaso Califano (1):
> >    hw/usb: Fix USB MTP Use-After-Free in usb_mtp_deletefn List Iteration
> 
> I'm picking the 3 out of 4 changes here for qemu-stable - omitting
> the "cork" one.  Please let me know if I should not.

I'd recommend taking the cork one too.  The migration qtest suite
will randomly throw timeouts without that, as it sometimes get into
a "go slow" state with the nagle algorithm, which the corking avoids.


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

Re: [PULL 0/4] Misc fixes patches

[Daniel P. Berrangé]

On Sat, Oct 10, 2026 at 10:29:34AM +0300, Michael Tokarev wrote:
> On 06.10.2026 11:34, Daniel P. Berrangé wrote:
> > The following changes since commit d7a65d1793d691d356a56833620f7d1e6f5d653b:
> > 
> >    Merge tag 'hppa-a400-updates-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2026-10-03 14:17:49 +0200)
> > 
> > are available in the Git repository at:
> > 
> >    https://gitlab.com/berrange/qemu tags/misc-fixes-pull-request
> > 
> > for you to fetch changes up to f33fb19cab412ffbc19e3b7914a320ae1d73709c:
> > 
> >    seccomp: fix blocking of setns/execveat/unshare (2026-10-06 09:17:43 +0100)
> > 
> > ----------------------------------------------------------------
> > Merge USB, I/O and seccomp fixes
> > 
> > * Fix seccomp to use errno action for setns/execveat/unshare
> >    instead of killing the thread
> > * Improve TLS performance and avoid test suite timeouts by
> >    corking TLS writes to increase packet size
> > * Fix websocket server unbounded read of client data
> >    CVE-2026-101291
> > * Avoid use-after-free in MTP device during object delete
> > 
> > ----------------------------------------------------------------
> > 
> > Daniel P. Berrangé (3):
> >    io: prevent unbounded read of websocket data from client
> >    io: cork TLS writes to avoid small TLS records
> >    seccomp: fix blocking of setns/execveat/unshare
> > 
> > Tommaso Califano (1):
> >    hw/usb: Fix USB MTP Use-After-Free in usb_mtp_deletefn List Iteration
> 
> I'm picking the 3 out of 4 changes here for qemu-stable - omitting
> the "cork" one.  Please let me know if I should not.

NB, the seccomp patch is broken. Please don't release it on stable
without a followup fix arriving shortly...


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|