> -----Original Message-----
> From: Michael Tokarev <mjt@tls.msk.ru>
> Sent: 24 July 2026 09:51
> To: Thanos Makatos <thanos.makatos@nutanix.com>; qemu-
> devel@nongnu.org
> Cc: John Levon <john.levon@nutanix.com>; clg@redhat.com; QEMU Stable
> <qemu-stable@nongnu.org>
> Subject: Re: [PATCH v2 0/6] vfio-user: validate server responses
> 
> !-------------------------------------------------------------------|
>   CAUTION: External Email
> 
> |-------------------------------------------------------------------!
> 
> On 7/20/26 16:58, Thanos Makatos wrote:
> > This patch series fixes some bugs where the vfio-user client doesn't
> > properly validate information returned by the vfio-user server.
> >
> > Thanos Makatos (6):
> >    vfio-user: vfio_user_get_region_info: prevent buffer overflow
> >    vfio-user: vfio_user_get_region_info: respect max_xfer_size
> >    vfio-user: vfio_user_get_region_info: reject unreasonably short struct
> >    vfio-user: vfio_user_get_region_info: prevent excessive malloc
> >    vfio-user: vfio_user_device_io_get_region_info: fix capability check
> >    vfio-user: vfio_user_device_io_device_feature: prevent buffer overflow
> >
> >   hw/vfio-user/device.c | 40
> +++++++++++++++++++++++++++++++++++++---
> >   1 file changed, 37 insertions(+), 3 deletions(-)
> 
> I'm picking this patch set for the stable-11.0 branch, except of the
> last change which fixes a problem introduced after v11.0.0.
> Please let me know if I shouldn't.

Sounds good to me.

> 
> Thanks,
> 
> /mjt