Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu into staging

pci, vhost, virtio, iommu: bugfixes Fixes all over the place, including a bunch of CVE fixes. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmpnrsMPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRpRkkIAMbp882suVq4uqhYOJFCvu0pNzKyjqQRyPHk # L+YFuKhVYoEF0Ssw9pcmq1AFT/1LzCz7DlrG1h8glxaBQ3UUyLylZWlPyDNZWUzs # YrclY51iB4aHJm3uMmNlF82DR22BsS8DZmft65a7Xt76Z7LzhNboxW6jz2eeqWka # /rc/0p9rymk0WOlXMwQANk3JQ9WizrYS+DBeYdbtTpHxPahZ+6napbrDQ3FS7lp8 # Ne06JjapYKZVE0XSkP4JMFRN5261NGrcS8PfCzrzdDnD7xfdnUMrYB3eqm3ZfO4D # ZGpDloCSqblsiSXV9w9r84iStMY7EX3gnBMeUoZMTgs0erIZYdI= # =tYYk # -----END PGP SIGNATURE----- # gpg: Signature made Mon 27 Jul 2026 15:17:23 EDT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (30 commits) virtio: avoid packed vring virtio_queue_empty() infinite loops (CVE-2026-16457) backends/rng: cap request size to avoid oversized allocation hw/virtio-rng: Fix host use-after-free (CVE-2026-50624) hw/net/virtio-net: Protect from DMA re-entrancy bugs intel_iommu: Check address mask before using it in pasid-based iotlb invalidation hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle hw/virtio/vdpa-dev: pass set_config buffer to vhost backend hw/pci-host/q35.c: Avoid early return in mch_write_config() hw/pci-host/q35.c: Factor out creation of SMRAM MRs hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled virtio-snd: check for overflow before g_malloc0 virtio-snd: check rx buffer descriptor size virtio-iommu: fix OOM due to unbounded call_rcu libvduse: validate vq size libvhost-user: fix heap overflow in vu_check_queue_inflights libvhost-user: validate last_batch_head in vu_check_queue_inflights virtio-pmem: wait for flush requests on unrealize vhost-user: assert nregions within limit virtio: fail early on bad config_len in migration virtio: stop migrating num_default, validate vring.num on load ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>