Merge tag 'pull-request-2026-07-27' of https://gitlab.com/thuth/qemu into staging

* Validate bounds in CXL "Set Feature" payloads * Fix guest-triggerable heap OOB access in "usb-uas" device * Fix possible crash via NULL pointer in ide_cancel_dma_sync() * Avoid possible assert() usb_packet_copy() * Check return value of xhci_xfer_create_sgl() for errors # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmpnVAMACgkQLtnXdP5w # LbXM1Q/+J7zxVdGniadV0FpTn4ZalaIFmJCenoC1fqbwy2ygf3lupuOKPlkEUl+/ # NHc6LnXMZ3+/+L1FQENVgConAZnb0CLJ/l/3zhlvIShPvWkPpgWFzUFO3fGkwc1G # RppCNRO280tLbNTFqSc57YXyqbmzG/A4N6+bGMb6sbZYrWAwuiIXDgt9TA1XM7S+ # 9Yqh+qcJ6/aFm1HUY82+cF6Kf+NFpMDI/Q7R23WpgrjAAuw/0R07PQSfyVHKe0HK # NP7lw/xuQWvhcOHLMF3RZaQTZGekTEXK56CGvcrh0RcyPXVOYSBBtHVY7VRvEM0K # Vjnp6vuFWKz/Mk1z2HFu+VL91PhN7FmT/vJHylkBt1UItz2M+XwfPlzAGUUobyr+ # sCrm0Cf1lIkMUOBzT1zJcvhZ1bFtk0e4YszkWVlk5ymvbov3+laiveNBJbMHz1qt # 3QAqaiSfLnVjunQh4XRta6QVeZBO3DD1QYpT+LcsQX4GJMKqfBilyJiz1tAJsQ3i # sZtbSMUR5HY8geGHz2VGi5Sa3ZW9dyHbFY2p99DL7l1WobJr8CIMGzxUqrsly55C # lXeYZPjAfSnShv6SYq1kUeJ2c3otL+ti9Wq22lZzJ00Jv0LeXzgx5SMH6Dz6+KMq # QGnFo9wEMihMWcgXwJu3sEyqiguNPHTYgZKWOHMHnfdHL19TnqU= # =wtEN # -----END PGP SIGNATURE----- # gpg: Signature made Mon 27 Jul 2026 08:50:11 EDT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.eu>" [full] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2026-07-27' of https://gitlab.com/thuth/qemu: hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl() for errors hw/usb/core: Avoid possible assert() in do_parameter() --> usb_packet_copy() hw/ide/core: Fix possible crash via NULL pointer in ide_cancel_dma_sync() hw/usb/dev-uas: Fix guest-triggerable heap OOB access hw/cxl: Validate Set Feature payload bounds Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>