3.1.1

1. 41dd30f pvrdma: release ring object in case of an error by Prasad J Pandit · 6 years ago
2. a100176 pvrdma: check return value from pvrdma_idx_ring_has_ routines by Prasad J Pandit · 6 years ago
3. 2a0e6f1 pvrdma: check number of pages when creating rings by Prasad J Pandit · 6 years ago
4. 59a8230 sun4u: add power_mem_read routine by Prasad J Pandit · 6 years ago
5. 3be7eb2 qxl: check release info object by Prasad J Pandit · 6 years ago
6. 4c7f4c4 i2c-ddc: fix oob read by Gerd Hoffmann · 6 years ago
7. 375667a scsi-generic: avoid possible out-of-bounds access to r->buf by Paolo Bonzini · 6 years ago
8. bceff52 pvrdma: add uar_read routine by Prasad J Pandit · 6 years ago
9. 1549e3a pvrdma: release device resources in case of an error by Prasad J Pandit · 6 years ago
10. 43a3a1b hw/block/pflash_cfi01: Add missing DeviceReset() handler by Philippe Mathieu-Daudé · 6 years ago
11. ddacb78 hw: Use PFLASH_CFI0{1,2} and TYPE_PFLASH_CFI0{1,2} by Markus Armbruster · 6 years ago
12. 03f130c pflash: Rename *CFI_PFLASH* to *PFLASH_CFI* by Markus Armbruster · 6 years ago
13. 10b1d60 pflash_cfi01: Log use of flawed "write to buffer" by Markus Armbruster · 6 years ago
14. e634054 pflash_cfi01: Do not exit() on guest aborting "write to buffer" by Markus Armbruster · 6 years ago
15. 13cb31c pflash: Rename pflash_t to PFlashCFI01, PFlashCFI02 by Markus Armbruster · 6 years ago
16. d0cb440 block/pflash_cfi02: Fix memory leak and potential use-after-free by Stephen Checkoway · 6 years ago
17. 21e5c69 hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO by Philippe Mathieu-Daudé · 6 years ago
18. e2ec206 hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO by Philippe Mathieu-Daudé · 6 years ago
19. 1f30e35 hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[] by Philippe Mathieu-Daudé · 6 years ago
20. c6b77a6 virtio-balloon: free pbp more aggressively by Michael S. Tsirkin · 6 years ago
21. 0965d55 virtio-balloon: don't track subpages for the PBP by David Hildenbrand · 6 years ago
22. 14d9028 virtio-balloon: Use temporary PBP only by David Hildenbrand · 6 years ago
23. 2aa5009 virtio-balloon: Rework pbp tracking data by David Hildenbrand · 6 years ago
24. 46275f9 virtio-balloon: Better names for offset variables in inflate/deflate code by David Hildenbrand · 6 years ago
25. b0d6fec virtio-balloon: Simplify deflate with pbp by David Hildenbrand · 6 years ago
26. 07026c3 virtio-balloon: Fix QEMU crashes on pagesize > BALLOON_PAGE_SIZE by David Hildenbrand · 6 years ago
27. 11dd808 virtio-balloon: Fix wrong sign extension of PFNs by David Hildenbrand · 6 years ago
28. f836478 virtio-balloon: Restore MADV_WILLNEED hint on balloon deflate by David Gibson · 6 years ago
29. 38e8e90 virtio-balloon: Fix possible guest memory corruption with inflates & deflates by David Gibson · 6 years ago
30. 80c96a7 virtio-balloon: Don't mismatch g_malloc()/free (CID 1399146) by David Gibson · 6 years ago
31. 1181120 virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host page size by David Gibson · 6 years ago
32. 83cddba virtio-balloon: Use ram_block_discard_range() instead of raw madvise() by David Gibson · 6 years ago
33. 89b0e35 virtio-balloon: Rework ballon_page() interface by David Gibson · 6 years ago
34. b260cde virtio-balloon: Corrections to address verification by David Gibson · 6 years ago
35. 7a31a0a virtio-balloon: Remove unnecessary MADV_WILLNEED on deflate by David Gibson · 6 years ago
36. f0a3343 hw/virtio/virtio-balloon: zero-initialize the virtio_balloon_config struct by Peter Maydell · 6 years ago
37. fc6c2bc i386/acpi: show PCI Express bus on pxb-pcie expanders by Evgeny Yakovlev · 6 years ago
38. 11665ca i386/acpi: fix gint overflow in crs_range_compare by Evgeny Yakovlev · 6 years ago
39. df42bc4 ioapic: kvm: Skip route updates for masked pins by Jan Kiszka · 6 years ago
40. c006359 tpm_emulator: Translate TPM error codes to strings by Stefan Berger · 6 years ago
41. 51ce84e tpm: Exit in reset when backend indicates failure by Stefan Berger · 6 years ago
42. 0318166 vhost: fix vhost_log size overflow during migration by Li Hangjing · 6 years ago
43. f173a43 megasas: fix mapped frame size by Peter Lieven · 6 years ago
44. 6b29db8 usb-mtp: use O_NOFOLLOW and O_CLOEXEC. by Gerd Hoffmann · 7 years ago
45. 11cd30e mac_newworld: use node name instead of alias name for hd device in FWPathProvider by Mark Cave-Ayland · 7 years ago
46. 4a25ba2 mac_oldworld: use node name instead of alias name for hd device in FWPathProvider by Mark Cave-Ayland · 7 years ago
47. 821314a vfio-ap: flag as compatible with balloon by Cornelia Huck · 7 years ago
48. 7c693f0 tpm_tis: fix loop that cancels any seizure by a lower locality by Liam Merwick · 7 years ago
49. c6f2564 hw/rdma: another clang compilation fix by Marcel Apfelbaum · 7 years ago
50. fe87edd tpm: Make sure the locality received from backend is valid by Stefan Berger · 7 years ago
51. 27b0c09 tpm: Make sure new locality passed to tpm_tis_prep_abort() is valid by Stefan Berger · 7 years ago
52. 98cf1bb pc:piix4: Update smbus I/O space after a migration by Corey Minyard · 7 years ago
53. 5363028 pcie: set link state inactive/active after hot unplug/plug by Zheng Xiang · 7 years ago
54. 08c410e i2c: Move typedef of bitbang_i2c_interface to i2c.h by BALATON Zoltan · 7 years ago
55. f2609ff i2c: pm_smbus: check smb_index before block transfer write by Prasad J Pandit · 7 years ago
56. 933cc4b Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181203-pull-request' into staging by Peter Maydell · 7 years ago
57. c52d46e usb-mtp: outlaw slashes in filenames by Gerd Hoffmann · 7 years ago
58. 6de02a1 usb-mtp: fix utf16_to_str by Gerd Hoffmann · 7 years ago
59. 629457a i2c: Add a length check to the SMBus write handling by Corey Minyard · 7 years ago
60. ea066d3 hw/arm/aspeed: Fix build issue with clang 3.4 by Thomas Huth · 7 years ago
61. c566066 Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging by Peter Maydell · 7 years ago
62. 03fee66 vmstate: constify VMStateField by Marc-André Lureau · 7 years ago
63. 59ed3fe Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging by Peter Maydell · 7 years ago
64. 56333e6 lsi: Reselection needed to remove pending commands from queue by George Kennedy · 7 years ago
65. 2264faa hw/virt/arm: Add support for Cortex-A72 in virt by ZhiPeng Lu · 7 years ago
66. 6da0218 nvme: Fix spurious interrupts by Keith Busch · 7 years ago
67. 4822f1e Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181127-pull-request' into staging by Peter Maydell · 7 years ago
68. 933d2d4 usb-host: set ifs.detached as true if kernel driver is not active by linzhecheng · 7 years ago
69. 7ec9106 audio/hda: fix guest triggerable assert by Gerd Hoffmann · 7 years ago
70. b7ee9e4 cirrus_vga/migration: update the bank offset before use by Wang Xin · 7 years ago
71. d2e550a ps2kbd: default to scan enabled after reset by Hervé Poussineau · 7 years ago
72. 30a759b hw/hyperv: fix NULL dereference with pure-kvm SynIC by Roman Kagan · 7 years ago
73. 58102ce net: cadence_gem: Remove incorrect assert() by Edgar E. Iglesias · 7 years ago
74. 72138f9 Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging by Peter Maydell · 7 years ago
75. b05730a Merge remote-tracking branch 'remotes/xtensa/tags/20181125-xtensa' into staging by Peter Maydell · 7 years ago
76. 57ac4a7 fmops: fix off-by-one in AR_TABLE and DR_TABLE array size by Gerd Hoffmann · 7 years ago
77. 1d20398 9p: fix QEMU crash when renaming files by Greg Kurz · 7 years ago
78. ad3a7e4 nvme: fix bug with PCI IRQ pins on teardown by Logan Gunthorpe · 7 years ago
79. 71a86dd nvme: fix CMB endianness confusion by Paolo Bonzini · 7 years ago
80. 2067d39 Revert "nvme: fix oob access issue(CVE-2018-16847)" by Kevin Wolf · 7 years ago
81. 87ad860 nvme: fix out-of-bounds access to the CMB by Paolo Bonzini · 7 years ago
82. 6bf7463 nvme: call blk_drain in NVMe reset code to avoid lockups by Igor Druzhinin · 7 years ago
83. 1c7f618 scsi-disk: Fix crash if underlying host file or disk returns error by Richard W.M. Jones · 7 years ago
84. 59b5e9b target/xtensa: xtfpga: provide default memory sizes by Max Filippov · 7 years ago
85. 4a93722 hw/i386: add pc-i440fx-3.1 & pc-q35-3.1 by Marc-André Lureau · 7 years ago
86. 5b3c77a 9p: take write lock on fid path updates (CVE-2018-19364) by Greg Kurz · 7 years ago
87. 9e6e924 hw/block/onenand: use qemu_log_mask() for reporting by Peter Maydell · 7 years ago
88. fcf5787 hw/block/onenand: Fix off-by-one error allowing out-of-bounds read by Peter Maydell · 7 years ago
89. dd5d693 hw/arm/stm32f205: Fix the UART and Timer region size by Seth Kintigh · 7 years ago
90. 441f669 fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabled by Mark Cave-Ayland · 7 years ago
91. 5e3c022 nvme: fix oob access issue(CVE-2018-16847) by Li Qiang · 7 years ago
92. d064910 Merge remote-tracking branch 'remotes/riscv/tags/riscv-for-master-3.1-rc2' into staging by Peter Maydell · 7 years ago
93. d835c61 Merge remote-tracking branch 'remotes/stefanberger/tags/pull-tpm-2018-11-15-1' into staging by Peter Maydell · 7 years ago
94. 6a50bb9 tpm: use loop iterator to set sts data field by Prasad J Pandit · 7 years ago
95. 632fb27 hw/riscv/virt: Free the test device tree node name by Alistair Francis · 7 years ago
96. b6e67ec s390x/pci: properly fail if the zPCI device cannot be created by David Hildenbrand · 7 years ago
97. e9ac8e8 hw/arm/sysbus-fdt: Only call match_fn callback if the type matches by Eric Auger · 7 years ago
98. a883d6a nvme: free cmbuf in nvme_exit by Li Qiang · 7 years ago
99. 20faf0f nvme: don't unref ctrl_mem when device unrealized by Li Qiang · 7 years ago
100. 5704c36 Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181112-pull-request' into staging by Peter Maydell · 7 years ago