The following changes since commit 299e7557ed15a9a325620698add379a3ce2d1d95:

  Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu into staging (2026-07-27 16:51:28 -0400)

are available in the Git repository at:

  https://repo.or.cz/qemu/kevin.git tags/for-upstream

for you to fetch changes up to 2896bf07932af5f114ad9c507cb5a45b2983d446:

  iotests: increase timeouts for tests to 5 minutes (2026-07-28 17:55:55 +0200)

----------------------------------------------------------------
Block layer patches

- Fix missing locking in latency histogram setters
- coroutine: fix lost wakeup in qemu_co_sleep_wake()
- floppy: Fix READ/WRITE/FORMAT/READ ID behaviour with missing medium
- qcow2: Fix crash on closing a read-only image with dirty bit set
- cloop: fix integer overflow in total_sectors calculation
- dmg: Fix out of bounds accesses (CVE-2026-65929, CVE-2026-65928)
- FUSE export: fix regression with O_TRUNC when export is not growable
- iotests: Various small fixes

----------------------------------------------------------------
Christian Quante (2):
      hw/block/fdc: select the drive named by the READ ID command
      hw/block/fdc: report a missing address mark on an empty drive

Daniel P. Berrangé (1):
      iotests: increase timeouts for tests to 5 minutes

Denis V. Lunev (8):
      block/accounting: take stats->lock in latency histogram setters
      block/qapi: take stats->lock when reading BlockAcctStats for query-blockstats
      tests/unit: add reproducer for BlockAcctStats histogram locking race
      qcow2: do not try to clear the dirty bit on a read-only node
      iotests: run the test pool with the 'fork' start method
      iotests: skip FUSE tests when FUSE is not usable
      iotests/migrate-bitmaps-postcopy-test: replace the timing assertion with a content check
      coroutine: fix lost wakeup in qemu_co_sleep_wake()

Fiona Ebner (2):
      block/export/fuse: fix regression with O_TRUNC when export is not growable
      iotests: test O_TRUNC behavior for fuse exports

Stefan Hajnoczi (3):
      dmg: fix out-of-bounds load in search_chunk() (CVE-2026-65929)
      dmg: refuse to open files with no chunks
      dmg: reject inconsistent UDRW chunk sector count and length (CVE-2026-65928)

malike (1):
      block/cloop: fix integer overflow in total_sectors calculation

 include/block/accounting.h                         |   1 +
 include/qemu/coroutine.h                           |  17 +-
 block/accounting.c                                 |  11 +-
 block/cloop.c                                      |   3 +-
 block/dmg.c                                        |  36 ++++-
 block/export/fuse.c                                |  12 ++
 block/qapi.c                                       |   3 +
 block/qcow2.c                                      |   6 +-
 hw/block/fdc.c                                     |  55 ++++++-
 tests/qtest/fdc-test.c                             |  70 ++++++++-
 tests/unit/test-block-accounting.c                 | 115 ++++++++++++++
 tests/unit/test-coroutine.c                        |  53 +++++++
 util/qemu-coroutine-sleep.c                        |  53 +++++--
 tests/qemu-iotests/testrunner.py                   |   4 +-
 tests/qemu-iotests/039                             |  11 ++
 tests/qemu-iotests/039.out                         |   3 +
 tests/qemu-iotests/common.rc                       |  14 ++
 tests/qemu-iotests/meson.build                     |  15 +-
 tests/qemu-iotests/tests/file-io-error             |   4 +-
 tests/qemu-iotests/tests/fuse-allow-other          |   2 +
 tests/qemu-iotests/tests/fuse-mmap-shared          |   9 +-
 tests/qemu-iotests/tests/fuse-truncate             | 171 +++++++++++++++++++++
 tests/qemu-iotests/tests/fuse-truncate.out         |   5 +
 .../tests/migrate-bitmaps-postcopy-test            |  15 +-
 tests/unit/meson.build                             |   1 +
 25 files changed, 633 insertions(+), 56 deletions(-)
 create mode 100644 tests/unit/test-block-accounting.c
 create mode 100755 tests/qemu-iotests/tests/fuse-truncate
 create mode 100644 tests/qemu-iotests/tests/fuse-truncate.out