db51dfc (HEAD -> stable-2.5, tag: v2.5.1.1, origin/stable-2.5) Update version for 2.5.1.1 release
5b7236f cadence_uart: bounds check write offset
0bcdb63 Revert "ehci: make idt processing more robust"
706bab6 ehci: apply limit to iTD/sidt descriptors
44b86aa vga: make sure vga register setup for vbe stays intact (CVE-2016-3712).
a6e5e5d vga: update vga register setup on vbe changes
2f2f74e vga: factor out vga register setup
46aff2c vga: add vbe_enabled() helper
4f0323d vga: fix banked access bounds checking (CVE-2016-3710)
a58047f (tag: v2.5.1) Update version for 2.5.1 release
5f409b1 hyperv: cpu hotplug fix with HyperV enabled
078de11 vmdk: Fix converting to streamOptimized
acea76c vmdk: Create streamOptimized as version 3
80b6e57 usb: check USB configuration descriptor object
9bddb45 usb: check RNDIS message length
e3a2cdf usb: check RNDIS buffer offsets & length
4dcd2f1 usb: check page select value while processing iTD
38e0921 net: ne2000: fix bounds check in ioport operations
d0ee85b net: check packet payload length
4f046a6 ide: ahci: reset ncq object to unused on error
b47809c i386: avoid null pointer dereference
24fe899 hmp: fix sendkey out of bounds write (CVE-2015-8619)
aaf4fb6 ahci: Do not unmap NULL addresses
a2ae168 migration: allow machine to enforce configuration section migration
bad094d vl.c: Fix regression in machine error message
4b0b1ec quorum: Fix crash in quorum_aio_cb()
cab1cc7 target-arm: Make reserved ranges in ID_AA64* spaces RAZ, not UNDEF
9ae0217 vhost-user: don't merge regions with different fds
3092979 fw_cfg: unbreak migration compatibility for 2.4 and earlier machines
c5c9841 hw/virtio: group virtio flags into an enum
6b62303 hw/virtio: fix double use of a virtio flag
c06f342 spapr: skip configuration section during migration of older machines
cb873ea e1000: eliminate infinite loops on out-of-bounds transfer start
4853a5a block: qemu-iotests - add test for snapshot, commit, snapshot bug
a375e0b block: set device_list.tqe_prev to NULL on BDS removal
a38a283 qmp: Fix reference-counting of qnull on empty output visit
225d50f cpus: use broadcast on qemu_pause_cond
020282d fw_cfg: avoid calculating invalid current entry pointer
091af18 s390x/css: fix control flags during csch
d983923 s390x/ioinst: set type and len for SEI response
643c8d8 block/raw-posix: avoid bogus fixup for cylinders on DASD disks
3ede27d ehci: update irq on reset
9849b19 net: set endianness on all backend devices
fe90bdc net: ne2000: check ring buffer control registers
aaa5271 net/filter: fix nf->netdev_id leak
abda95c net/dump: fix nfds->filename leak
6a49a71 blockdev: Fix 'change' for slot devices
e1a8a09 block: Add blk_dev_has_tray()
7a2c1c8 net: rocker: fix an incorrect array bounds check
702a8d1 ivshmem: remove redundant assignment, fix crash with msi=off
3e96d5d ivshmem: no need for opaque argument
16a2875 scsi: initialise info object with appropriate size
4588b0d virtio-9p: use accessor to get thread_pool
ff083d3 xenfb: avoid reading twice the same fields from the shared page
4d59e78 xen/blkif: Avoid double access to src->nr_segments
52a7b27 configure: Fix shell syntax to placate OpenBSD's pdksh
d4aed70 target-ppc: kvm: fix floating point registers sync on little-endian hosts
42ae4a3 net: vmxnet3: avoid memory leakage in activate_device
0d33580 ehci: make idt processing more robust