The following changes since commit ff1d2d19d7e24893e2012d879f8e73077e17b9bd:

  Merge tag 'pull-11.1-check-tcg-meson-040926-2' of https://gitlab.com/stsquad/qemu into staging (2026-09-04 16:52:58 +0100)

are available in the Git repository at:

  https://gitlab.com/berrange/qemu tags/misc-fixes-pull-request

for you to fetch changes up to 0766e83d2f94285338e6c642b4b003ffafb142f4:

  docs/system/security: exclude uninitialized stack variables as bugs (2026-09-07 11:31:03 +0100)

----------------------------------------------------------------
Merge crypto, I/O and misc fixes

 * Deprecated the AF_ALG crypto backend
 * Improve checkpatch output in CI jobs
 * Document security policy for uninitialized stack variables
 * Fix multiple denial of service flaws in websockets
 * Fix error handling in some x509 APIs

----------------------------------------------------------------

Daniel P. Berrangé (3):
  crypto: deprecate the AF_ALG crypto backend
  gitlab: use --emacs --quiet for checkpatch.pl instead of --terse
  docs/system/security: exclude uninitialized stack variables as bugs

Denis V. Lunev (6):
  io/channel-socket: do not treat a zero length write as an error
  io/channel-websock: send an HTTP 400 when the greeting has no space
  io/channel-websock: handle a blocked write during the handshake
  tests/unit: add websock handshake test
  io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading
  tests/unit: cover blocked IO during the websock handshake

Evgeny Kolmakov (1):
  crypto: Use g_autofree

Marc-André Lureau (2):
  crypto/x509-utils: don't double set errp
  crypto/x509-utils: propagate the error

 .gitlab-ci.d/check-patch.py          |   6 +-
 crypto/block.c                       |  17 +-
 crypto/hmac-gcrypt.c                 |  12 +-
 crypto/hmac-glib.c                   |  10 +-
 crypto/ivgen-essiv.c                 |  15 +-
 crypto/ivgen.c                       |   6 +-
 crypto/secret_keyring.c              |   5 +-
 crypto/x509-utils.c                  |   4 +-
 docs/about/deprecated.rst            |  21 +++
 docs/system/security.rst             |  10 ++
 io/channel-socket.c                  |   2 +-
 io/channel-websock.c                 |  10 +-
 meson.build                          |   6 +
 tests/unit/meson.build               |   1 +
 tests/unit/test-io-channel-websock.c | 249 +++++++++++++++++++++++++++
 15 files changed, 326 insertions(+), 48 deletions(-)
 create mode 100644 tests/unit/test-io-channel-websock.c

-- 
2.55.0

On Mon, 7 Sept 2026 at 11:53, Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> The following changes since commit ff1d2d19d7e24893e2012d879f8e73077e17b9bd:
>
>   Merge tag 'pull-11.1-check-tcg-meson-040926-2' of https://gitlab.com/stsquad/qemu into staging (2026-09-04 16:52:58 +0100)
>
> are available in the Git repository at:
>
>   https://gitlab.com/berrange/qemu tags/misc-fixes-pull-request
>
> for you to fetch changes up to 0766e83d2f94285338e6c642b4b003ffafb142f4:
>
>   docs/system/security: exclude uninitialized stack variables as bugs (2026-09-07 11:31:03 +0100)
>
> ----------------------------------------------------------------
> Merge crypto, I/O and misc fixes
>
>  * Deprecated the AF_ALG crypto backend
>  * Improve checkpatch output in CI jobs
>  * Document security policy for uninitialized stack variables
>  * Fix multiple denial of service flaws in websockets
>  * Fix error handling in some x509 APIs
>
> ----------------------------------------------------------------



Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.2
for any user-visible changes.

-- PMM