Hi Stefan!

The following changes since commit 5ef0ecc5942ee07bb581cc96a97bbfc0fdf4005c:

  Merge tag 'hw-misc-20260714' of https://github.com/philmd/qemu into staging (2026-07-17 10:01:52 +0100)

are available in the Git repository at:

  https://gitlab.com/thuth/qemu.git tags/pull-request-2026-07-20

for you to fetch changes up to cc479aa89743655a725ce29328bcd0585a65983a:

  hw/usb/hcd-xhci-sysbus: Fix OOB heap access in xhci_sysbus_intr_raise() (2026-07-20 11:27:52 +0200)

----------------------------------------------------------------
* Fixes for various USB-related bugs

----------------------------------------------------------------
Feifan Qian (1):
      hw/usb/xhci: clamp interval exponent to avoid UB shift in xhci_init_epctx()

Marc-André Lureau (2):
      usbredir: fix use-after-free on buffered bulk packet overflow
      usbredir: fix infinite loop and SIGFPE with zero max_packet_size

Thomas Huth (2):
      hw/usb/hcd-xhci: Fix guest-triggerable assert() in xhci_find_stream()
      hw/usb/hcd-xhci-sysbus: Fix OOB heap access in xhci_sysbus_intr_raise()

Xiangfeng Cai (2):
      hw/usb/hcd-xhci-pci: break host link cycle so device_finalize() runs on unplug
      tests/qtest: add xhci-pci unplug finalize regression test

 hw/usb/hcd-xhci-pci.c           | 12 ++++++++
 hw/usb/hcd-xhci-sysbus.c        |  1 +
 hw/usb/hcd-xhci.c               | 22 ++++++++++++--
 hw/usb/redirect.c               | 42 +++++++++++++++++++++++++-
 tests/qtest/usb-hcd-xhci-test.c | 67 +++++++++++++++++++++++++++++++++++++++++
 5 files changed, 141 insertions(+), 3 deletions(-)

On 7/20/26 13:38, Thomas Huth wrote:
..
> * Fixes for various USB-related bugs
> 
> ----------------------------------------------------------------
> Feifan Qian (1):
>        hw/usb/xhci: clamp interval exponent to avoid UB shift in xhci_init_epctx()
> 
> Marc-André Lureau (2):
>        usbredir: fix use-after-free on buffered bulk packet overflow
>        usbredir: fix infinite loop and SIGFPE with zero max_packet_size
> 
> Thomas Huth (2):
>        hw/usb/hcd-xhci: Fix guest-triggerable assert() in xhci_find_stream()
>        hw/usb/hcd-xhci-sysbus: Fix OOB heap access in xhci_sysbus_intr_raise()
> 
> Xiangfeng Cai (2):
>        hw/usb/hcd-xhci-pci: break host link cycle so device_finalize() runs on unplug
>        tests/qtest: add xhci-pci unplug finalize regression test

Hi!

It smells like everything in there needs to be picked up for the current
stable qemu series, not only the patches which were Cc'ed qemu-stable@
explicitly.

I'm picking everything up.  Please let me know if I shoudln't.

Thanks,

/mjt

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.