Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging trivial patches for 2026-11-12 # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmr2DyMACgkQgqpKJDse # lHjSWw//c3kywmPZOONmmZoswENDa2te9nOAsQAD4E15dnny5GqiaUVGQwxu7arg # 7jODnHdCAHQIzvltT9GH1oSgq1gYNVo99h0bRsy2sEEPOHkxNDUY3BgBEF0P3R/d # nd9nE72WDQfLBNN0oMKIiSM+pKIV14/PPlMznSmo7jsiUk1rwynFmDLXClVOeG00 # 46oSHju2YPw2r12uDTw0PqUsyqpOvoaIC9HA885I1whQQQM7aNgFnjeExHYarvAl # puhfdQTUGXdtSNR4FtrgPX1AnNrwAd+q1BblJwGkgIrV/cGSmxqFgRaSnynGQd3L # t9wodCf2xOAQ5iXHgYui+YLqGUvHjl8tPowM6eqVij/Ur9EpELIgJz4G4d2dh0YV # BMo7p8uZCEotB80i7Q7TW22UJBfV5LHrC1ImE52YtG76RkuvTudKraRwIXeRXt8t # xpmwGKpFLWTWXwUIRXe5zjN5Uwu4rz9uRPED51BBKVAeFu2CAFe/LO7ZLaSmZkwh # F2kw0ZmpLLX8cwE77c0xqf75KgZFUTwbHbYRz2vY0bhzBLesAlzAmiHOi4OAFAbC # C6Jl21WXB1l9B6Nz8JaafEkktmUYLWicuGHCVOGyOXVY4bzZV3gp3veJGz8Zly4J # 8vbn0r+q+fzH0pWtKuK6E4tG4mKLD8BvkAO9SBmrCi2ofiMWF1A= # =EmRm # -----END PGP SIGNATURE----- # gpg: Signature made Thu 12 Nov 2026 12:10:27 PM MST # gpg: using RSA key 64AA2AB531D56903366BFEF982AA4A243B1E9478 # gpg: Good signature from "Michael Tokarev <mjt@debian.org>" [unknown] # gpg: aka "Michael Tokarev <mjt@corpit.ru>" [unknown] # gpg: aka "Michael Tokarev <mjt@tls.msk.ru>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 9D8B E14E 3F2A 9DD7 9199 28F1 61AD 3D98 ECDF 2C8E # Subkey fingerprint: 64AA 2AB5 31D5 6903 366B FEF9 82AA 4A24 3B1E 9478 * tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu: hw/audio/intel-hda: Belatedly update comment for removal of -soundhw MAINTAINERS: fix typo in Gerd's name docs: fix a few typos hw/audio/fmopl.c: Convert malloc, free to g_malloc0, g_new and g_free io: avoid potential double close of qio_channel_file's fd Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
diff --git a/MAINTAINERS b/MAINTAINERS index fa0c6d0..3d53e10 100644 --- a/MAINTAINERS +++ b/MAINTAINERS
@@ -2945,7 +2945,7 @@ VM Launch Update M: Ani Sinha <anisinha@redhat.com> -M: Gerd Hoffman <kraxel@redhat.com> +M: Gerd Hoffmann <kraxel@redhat.com> S: Maintained F: hw/misc/vmlaunchupdate.c F: include/hw/misc/vmlaunchupdate.h
diff --git a/docs/devel/clocks.rst b/docs/devel/clocks.rst index 16de321..997b09c 100644 --- a/docs/devel/clocks.rst +++ b/docs/devel/clocks.rst
@@ -280,7 +280,7 @@ have guest-programmable frequency multipliers or dividers. Similarly to ``clock_set()``, ``clock_set_mul_div()`` returns ``true`` if -the clock state was modified; that is, if the multiplier or the diviser +the clock state was modified; that is, if the multiplier or the divisor or both were changed by the call. Note that ``clock_set_mul_div()`` does not automatically call
diff --git a/docs/devel/control-flow-integrity.rst b/docs/devel/control-flow-integrity.rst index 3d5702f..466888b 100644 --- a/docs/devel/control-flow-integrity.rst +++ b/docs/devel/control-flow-integrity.rst
@@ -39,7 +39,7 @@ later). Given the use of LTO, a version of AR that supports LLVM IR is required. -The easies way of doing this is by selecting the AR provided by LLVM:: +The easiest way of doing this is by selecting the AR provided by LLVM:: AR=llvm-ar-9 CC=clang-9 CXX=clang++-9 /path/to/configure --enable-cfi
diff --git a/docs/devel/docs.rst b/docs/devel/docs.rst index a7768b5..7fe7e44 100644 --- a/docs/devel/docs.rst +++ b/docs/devel/docs.rst
@@ -5,7 +5,7 @@ QEMU's documentation is written in reStructuredText format and built using the Sphinx documentation generator. We generate both -the HTML manual and the manpages from the some documentation sources. +the HTML manual and the manpages from the same documentation sources. hxtool and .hx files --------------------
diff --git a/docs/devel/ebpf_rss.rst b/docs/devel/ebpf_rss.rst index ed5d337..85ef547 100644 --- a/docs/devel/ebpf_rss.rst +++ b/docs/devel/ebpf_rss.rst
@@ -31,7 +31,7 @@ Note: currently, eBPF RSS does not support hash reporting. -eBPF RSS turned on by different combinations of vhost-net, vitrio-net and tap configurations: +eBPF RSS turned on by different combinations of vhost-net, virtio-net and tap configurations: - eBPF is used:
diff --git a/docs/devel/multi-process.rst b/docs/devel/multi-process.rst index 4ef539c..cafe2aa 100644 --- a/docs/devel/multi-process.rst +++ b/docs/devel/multi-process.rst
@@ -158,7 +158,7 @@ the guest virtio device to DMA to or from is not a guest physical address. This case is handled by having vhost code within QEMU register as a listener for IOMMU mapping changes. The vhost application maintains -a cache of IOMMMU translations: sending translation requests back to +a cache of IOMMU translations: sending translation requests back to QEMU on cache misses, and in turn receiving flush requests from QEMU when mappings are purged. @@ -573,7 +573,7 @@ When a remote process receives a live migration indication from QEMU, it will set up a channel using the received file descriptor with ``qio_channel_socket_new_fd()``. This channel will be used to create a -*QEMUfile* that can be passed to ``qemu_save_device_state()`` to send +*QEMUFile* that can be passed to ``qemu_save_device_state()`` to send the process's device state back to QEMU. This method will be reversed on restore - the channel will be passed to ``qemu_loadvm_state()`` to restore the device state. @@ -853,7 +853,7 @@ The irq descriptors are created by the proxy object ``using event_notifier_init()`` to create the irq and re-sampling -*eventds*, and ``kvm_vm_ioctl(KVM_IRQFD)`` to bind them to an interrupt. +*eventfds*, and ``kvm_vm_ioctl(KVM_IRQFD)`` to bind them to an interrupt. The interrupt route can be found with ``pci_device_route_intx_to_irq()``.
diff --git a/docs/devel/submitting-a-patch.rst b/docs/devel/submitting-a-patch.rst index 5ccd09a..cd08881 100644 --- a/docs/devel/submitting-a-patch.rst +++ b/docs/devel/submitting-a-patch.rst
@@ -241,7 +241,7 @@ ~~~~~~ The `b4`_ tool, used for Linux kernel development, can also be used for QEMU -development. It is packaged in most distros and PyPi. The QEMU source tree +development. It is packaged in most distros and PyPI. The QEMU source tree includes a ``b4`` project configuration file at the root: ``.b4-config``. Example workflow to prepare a patch series:
diff --git a/docs/interop/vfio-user.rst b/docs/interop/vfio-user.rst index b49781a..bdd73f4 100644 --- a/docs/interop/vfio-user.rst +++ b/docs/interop/vfio-user.rst
@@ -1583,7 +1583,7 @@ -------------------------------- This message can be used to coalesce multiple device write operations -into a single messgage. It is only used as an optimization when the +into a single message. It is only used as an optimization when the outgoing message queue is relatively full. Request
diff --git a/docs/specs/ppc-spapr-hcalls.rst b/docs/specs/ppc-spapr-hcalls.rst index 6cdcef2..550026e 100644 --- a/docs/specs/ppc-spapr-hcalls.rst +++ b/docs/specs/ppc-spapr-hcalls.rst
@@ -20,7 +20,7 @@ ``H_RTAS (0xf000)`` =================== -RTAS stands for Run-Time Abstraction Sercies and is a set of runtime services +RTAS stands for Run-Time Abstraction Services and is a set of runtime services generally provided by the firmware inside the guest to the operating system. It predates the existence of hypervisors (it was originally an extension to Open Firmware) and is still used by PAPR and LoPAR to provide various services that
diff --git a/docs/specs/ppc-spapr-xive.rst b/docs/specs/ppc-spapr-xive.rst index f47f739..8b83942 100644 --- a/docs/specs/ppc-spapr-xive.rst +++ b/docs/specs/ppc-spapr-xive.rst
@@ -171,7 +171,7 @@ - ``reg`` contains the base address and size of the thread interrupt - managnement areas (TIMA), for the User level and for the Guest OS + management areas (TIMA), for the User level and for the Guest OS level. Only the Guest OS level is taken into account today. - ``ibm,xive-eq-sizes``
diff --git a/docs/system/security.rst b/docs/system/security.rst index e211fdd..92a5d87 100644 --- a/docs/system/security.rst +++ b/docs/system/security.rst
@@ -107,7 +107,7 @@ possibility of large memory peaks and apply countermeasures to provide continuity of host operations. It is typical for the Linux OOM killer to reap the process triggering host memory overcommit - in the case of exccessive usage, offering a degree of protection. + in the case of excessive usage, offering a degree of protection. As such, bugs which can lead to excessive/unbounded memory allocations will usually not be classified as security flaws, but should be fixed as hardening bugs.
diff --git a/docs/user/main.rst b/docs/user/main.rst index a8ddf91..aef33bf 100644 --- a/docs/user/main.rst +++ b/docs/user/main.rst
@@ -23,7 +23,7 @@ System calls are the principle interface between user-space and the kernel. Generally the same system calls exist on all versions of the kernel so QEMU includes a generic system call translator. The -translator takes care of adjusting endianess, 32/64 bit parameter size +translator takes care of adjusting endianness, 32/64 bit parameter size and then calling the equivalent host system call. QEMU can also adjust device specific ``ioctl()`` calls in a similar
diff --git a/hw/audio/fmopl.c b/hw/audio/fmopl.c index a63ad0f..91fe806 100644 --- a/hw/audio/fmopl.c +++ b/hw/audio/fmopl.c
@@ -607,26 +607,10 @@ double pom; /* allocate dynamic tables */ - if( (TL_TABLE = malloc(TL_MAX*2*sizeof(int32_t))) == NULL) - return 0; - if( (SIN_TABLE = malloc(SIN_ENT*4 *sizeof(int32_t *))) == NULL) - { - free(TL_TABLE); - return 0; - } - if( (AMS_TABLE = malloc(AMS_ENT*2 *sizeof(int32_t))) == NULL) - { - free(TL_TABLE); - free(SIN_TABLE); - return 0; - } - if( (VIB_TABLE = malloc(VIB_ENT*2 *sizeof(int32_t))) == NULL) - { - free(TL_TABLE); - free(SIN_TABLE); - free(AMS_TABLE); - return 0; - } + TL_TABLE = g_new(int32_t, TL_MAX * 2); + SIN_TABLE = g_new(int32_t *, SIN_ENT * 4); + AMS_TABLE = g_new(int32_t, AMS_ENT * 2); + VIB_TABLE = g_new(int32_t, VIB_ENT * 2); ENV_CURVE = g_new(int32_t, 2 * EG_ENT + 1); /* make total level table */ for (t = 0;t < EG_ENT-1 ;t++){ @@ -695,11 +679,11 @@ static void OPLCloseTable( void ) { - g_free(ENV_CURVE); - free(TL_TABLE); - free(SIN_TABLE); - free(AMS_TABLE); - free(VIB_TABLE); + g_clear_pointer(&ENV_CURVE, g_free); + g_clear_pointer(&TL_TABLE, g_free); + g_clear_pointer(&SIN_TABLE, g_free); + g_clear_pointer(&AMS_TABLE, g_free); + g_clear_pointer(&VIB_TABLE, g_free); } /* CSM Key Control */ @@ -1081,11 +1065,8 @@ /* allocate OPL state space */ state_size = sizeof(FM_OPL); state_size += sizeof(OPL_CH)*max_ch; - /* allocate memory block */ - ptr = malloc(state_size); - if(ptr==NULL) return NULL; - /* clear */ - memset(ptr,0,state_size); + /* allocate memory block and zero-initialize */ + ptr = g_malloc0(state_size); OPL = (FM_OPL *)ptr; ptr+=sizeof(FM_OPL); OPL->P_CH = (OPL_CH *)ptr; ptr+=sizeof(OPL_CH)*max_ch; /* set channel state pointer */ @@ -1128,7 +1109,7 @@ } #endif OPL_UnLockTable(); - free(OPL); + g_free(OPL); } /* ---------- Option handlers ---------- */
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c index 3d361a4..431deb2 100644 --- a/hw/audio/intel-hda.c +++ b/hw/audio/intel-hda.c
@@ -1303,8 +1303,8 @@ }; /* - * create intel hda controller with codec attached to it, - * so '-soundhw hda' works. + * Create intel hda controller with codec attached to it, + * so '-audio model=hda' works. */ static void intel_hda_and_codec_init(const char *audiodev) {
diff --git a/io/channel-file.c b/io/channel-file.c index 4c9da66..2487ada 100644 --- a/io/channel-file.c +++ b/io/channel-file.c
@@ -261,12 +261,24 @@ { QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc); - if (qemu_close(fioc->fd) < 0) { + int ret = qemu_close(fioc->fd); + /* + * Set fioc->fd to -1, to prevent qio_channel_file_finalize() from + * closing it again. + * + * POSIX.1-2024 specifies that the fd is closed even when close() + * returns an error, except when the error is EINTR. The systems that + * QEMU supports however violate the standard and always close the fd, + * even when returning EINTR. If the fd was actually closed, we must not + * try to close it a second time as we could accidentally close someone + * else's fd. + */ + fioc->fd = -1; + if (ret < 0) { error_setg_errno(errp, errno, - "Unable to close file"); + "Got an error while closing file"); return -1; } - fioc->fd = -1; return 0; }