)]}'
{
  "commit": "e5cb62e7b6f99d45a42f0cd358d76d6ee2cef5cd",
  "tree": "ee123134506eaa174c5c8b5991f337a827902e67",
  "parents": [
    "5a5b06d2f6f71d7789719b97143fc5b543bec07a"
  ],
  "author": {
    "name": "Thomas Huth",
    "email": "thuth@redhat.com",
    "time": "Tue Nov 18 18:40:47 2025 +0100"
  },
  "committer": {
    "name": "Thomas Huth",
    "email": "thuth@redhat.com",
    "time": "Fri Nov 21 08:33:15 2025 +0100"
  },
  "message": "hw/s390x: Fix a possible crash with passed-through virtio devices\n\nConsider the following nested setup: An L1 host uses some virtio device\n(e.g. virtio-keyboard) for the L2 guest, and this L2 guest passes this\ndevice through to the L3 guest. Since the L3 guest sees a virtio device,\nit might send virtio notifications to the QEMU in L2 for that device.\nBut since the QEMU in L2 defined this device as vfio-ccw, the function\nhandle_virtio_ccw_notify() cannot handle this and crashes: It calls\nvirtio_ccw_get_vdev() that casts sch-\u003edriver_data into a VirtioCcwDevice,\nbut since \"sch\" belongs to a vfio-ccw device, that driver_data rather\npoints to a CcwDevice instead. So as soon as QEMU tries to use some\nVirtioCcwDevice specific data from that device, we\u0027ve lost.\n\nWe must not take virtio notifications for such devices. Thus fix the\nissue by adding a check to the handle_virtio_ccw_notify() handler to\nrefuse all devices that are not our own virtio devices. Like in the\nother branches that detect wrong settings, we return -EINVAL from the\nfunction, which will later be placed in GPR2 to inform the guest about\nthe error.\n\nReviewed-by: Halil Pasic \u003cpasic@linux.ibm.com\u003e\nReviewed-by: Eric Farman \u003cfarman@linux.ibm.com\u003e\nTested-by: Eric Farman \u003cfarman@linux.ibm.com\u003e\nReviewed-by: Cornelia Huck \u003ccohuck@redhat.com\u003e\nAcked-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\nMessage-ID: \u003c20251118174047.73103-1-thuth@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ac1b08b2cd5fcd662fb0b03965f2a1731a3a64e1",
      "old_mode": 33188,
      "old_path": "hw/s390x/s390-hypercall.c",
      "new_id": "508dd97ca0d5f7945d635e1818e4c8bf7f3d1a4f",
      "new_mode": 33188,
      "new_path": "hw/s390x/s390-hypercall.c"
    }
  ]
}