Commit 022aa31362 for qemu.org
commit 022aa313628fd74154d21de13d7bd66db46c044e
Merge: 9ded45a67f 3255605461
Author: Richard Henderson <richard.henderson@linaro.org>
Date: Sat Oct 3 08:56:34 2026 +0200
Merge tag 'smartcard-fixes-pr-v1' of https://gitlab.com/marcandre.lureau/qemu into staging
smartcard fixes
- CVE-2026-18609: guest-triggered assert via short interrupt transfer
- CVE-2026-18204: OOB read from the pending bulk-in ring buffer
- CVE-2026-18410: assert crash when pending answers ring overflows
- various bug fixes, spec compliance and refactoring
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmq+YDsACgkQ2ujhCXWW
# nOVQfw/9E0E4yb+JFIRCgM4IVBcR+yI0PxHW+PvxYDSS/VIq+okebyEDLNLlIwwj
# sNun496HlDrHWsZzdqq/ddnUoynbsL5GopSHD+bPawGs0jVZfj6q5B3dtj+Z9H88
# YtnrP2Krj0pr8qpAPuYj97gtRc58t5cc1u830Bq6P9auwKIecC0PEV3fdMboeDYk
# 2hfyFld0CoVFcTChmNRJEqBiPBEWAn4kgNC+bZtqy3kAuuXYVajOldHUvRV/qROb
# 5ydNAJmwy4Hh4TMtiBAT4dnIasYWbyJw+R2eoK/9D+75Qe62rDWj7UIPu+5eqX1D
# ImIl1aVfqSL5RcuMTSM60Pze+VhSycGPX4QOJbxLxKC5hcmLTStEHDas5dfIJwrc
# CA+5RZNyPiUy5MCAfgb3MuT+AoYeQHXYTmVc8uFFqclFcbK3BcfelJxv/ATDxLuh
# s+bm7MDLROb8VfT5hl9DVHFnSapV3jyJqNyJIoC/a7bOoeEjBlV3abSnsDkNWjcK
# R9hKX67Sml3T5CK4WdtRBVAi18gq2EEMrRRZ+NVDBcfXNS2HlB5e1ohsk/lvewR8
# FEKjykgZ40u3fhBIXjD7yuRtX3X7NKC7zrl6HLlyBbFicWXMEqt1OrAIVJzADEqU
# 5t19zMZMTdZOb+9MIyvdLeaPqg8XhreO0IIhqvYXDYphxI9YEaM=
# =08p+
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 01 Oct 2026 03:29:31 PM CEST
# gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [unknown]
# gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5
* tag 'smartcard-fixes-pr-v1' of https://gitlab.com/marcandre.lureau/qemu: (27 commits)
hw/usb/ccid-card-emulated: free libcacard context
hw/usb/dev-smartcard-reader: correct CCID_IccPowerOff
hw/usb/dev-smartcard-reader: advertise T=1 protocol support
hw/usb/dev-smartcard-reader: use usb_packet_size() accessor
hw/usb/dev-smartcard-reader: validate per-command dwLength
hw/usb/dev-smartcard-reader: stop advertising PIN support
hw/usb/dev-smartcard-reader: report error on XfrBlock with no card
hw/usb/dev-smartcard-reader: zero bChainParameter in DataBlock responses
hw/usb/dev-smartcard-reader: reject commands for invalid slots
hw/usb/dev-smartcard-reader: handle Secure, Escape and SetDataRate commands
hw/usb/dev-smartcard-reader: fix pending queue migration
hw/usb/dev-smartcard-reader: derive queue counts from start/end indices
hw/usb/dev-smartcard-reader: drop current_bulk_in pointer
hw/usb/dev-smartcard-reader: release short bulk-in responses with xHCI
hw/usb/dev-smartcard-reader: reject oversized responses safely
hw/usb/dev-smartcard-reader: fix RDR_to_PC_Parameters dwLength
hw/usb/dev-smartcard-reader: apply backpressure to bulk-out
hw/usb/dev-smartcard-reader: reset all I/O state on device reset
hw/usb/dev-smartcard-reader: validate migrated fields in post_load
hw/usb/dev-smartcard-reader: drop needless state fields
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>