[PULL 00/30] pci, vhost, virtio, iommu: bugfixes

["Michael S. Tsirkin" <mst@redhat.com>]

The following changes since commit cbd42e2b75b23953a9bdb073c8531518b1bd6163:

  Update version for v11.1.0-rc1 release (2026-07-21 13:18:25 -0400)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/virt/kvm/mst/qemu.git tags/for_upstream

for you to fetch changes up to 13342b9c4104f3bf93c2e52e7de4b383971d7bd6:

  backends/rng: cap request size to avoid oversized allocation (2026-07-26 17:26:41 -0400)

----------------------------------------------------------------
pci, vhost, virtio, iommu: bugfixes

Fixes all over the place, including a bunch of CVE fixes.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

----------------------------------------------------------------
Clément MATHIEU--DRIF (1):
      intel_iommu: Check address mask before using it in pasid-based iotlb invalidation

GuoHan Zhao (1):
      hw/virtio/vdpa-dev: pass set_config buffer to vhost backend

Haotian Jiang (1):
      hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle

Laurent Vivier (4):
      hw/virtio: reject zero-length packed indirect descriptor table
      hw/net/virtio-net: Protect from DMA re-entrancy bugs
      hw/virtio-rng: Fix host use-after-free (CVE-2026-50624)
      backends/rng: cap request size to avoid oversized allocation

Manos Pitsidianakis (2):
      virtio-snd: check rx buffer descriptor size
      virtio-snd: check for overflow before g_malloc0

Michael S. Tsirkin (18):
      virtio: use masked features with set_features_ex
      virtio-net: fix OOB read in RSC receive path
      virtio-net: fix short frame OOB read in receive_filter()
      libvhost-user: protect against OOB writes in vu_set_inflight_fd
      libvhost-user: protect against OOB vring queue access
      vhost: do not crash on ring map failure
      virtio-scsi: fix SCSIRequest leak on a bad request
      virtio-mmio: fix QUEUE_NUM_MAX
      virtio: fix queue size validation against allocated maximum
      virtio: stop migrating num_default, validate vring.num on load
      virtio: fail early on bad config_len in migration
      vhost-user: assert nregions within limit
      virtio-pmem: wait for flush requests on unrealize
      libvhost-user: validate last_batch_head in vu_check_queue_inflights
      libvhost-user: fix heap overflow in vu_check_queue_inflights
      vmstate: fix type confusion in vmstate_size() for VMSTATE_VBUFFER_UINT64
      libvduse: validate vq size
      virtio-iommu: fix OOM due to unbounded call_rcu

Peter Maydell (3):
      hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled
      hw/pci-host/q35.c: Factor out creation of SMRAM MRs
      hw/pci-host/q35.c: Avoid early return in mch_write_config()

 include/hw/scsi/scsi.h                    |   1 +
 include/hw/virtio/virtio-bus.h            |   1 +
 include/hw/virtio/virtio-iommu.h          |   1 +
 include/hw/virtio/virtio-mmio.h           |   1 +
 include/hw/virtio/virtio-pmem.h           |   1 +
 include/migration/vmstate.h               |   5 +-
 include/system/rng.h                      |  14 ++++
 backends/rng.c                            |  21 +++++-
 hw/audio/virtio-snd.c                     |  24 +++++--
 hw/core/machine.c                         |   1 +
 hw/i386/intel_iommu.c                     |   9 +++
 hw/mem/cxl_type3.c                        |   3 +
 hw/net/virtio-net.c                       |  25 ++++++-
 hw/pci-bridge/cxl_upstream.c              |   3 +
 hw/pci-host/q35.c                         | 110 ++++++++++++++++--------------
 hw/scsi/scsi-bus.c                        |   7 ++
 hw/scsi/virtio-scsi.c                     |   2 +
 hw/virtio/vdpa-dev.c                      |   2 +-
 hw/virtio/vhost-user.c                    |   3 +
 hw/virtio/vhost.c                         |   5 +-
 hw/virtio/virtio-iommu.c                  |  29 ++++++++
 hw/virtio/virtio-mmio.c                   |   7 +-
 hw/virtio/virtio-pmem.c                   |  17 ++++-
 hw/virtio/virtio-rng.c                    |   2 +
 hw/virtio/virtio.c                        |  43 ++++++++----
 migration/vmstate.c                       |  31 ++++++++-
 subprojects/libvduse/libvduse.c           |   5 ++
 subprojects/libvhost-user/libvhost-user.c |  61 ++++++++++++++++-
 28 files changed, 345 insertions(+), 89 deletions(-)