Merge tag 'misc-fixes-pull-request' of https://gitlab.com/berrange/qemu into staging

Merge crypto, I/O and misc fixes

 * Deprecated the AF_ALG crypto backend
 * Improve checkpatch output in CI jobs
 * Document security policy for uninitialized stack variables
 * Fix multiple denial of service flaws in websockets
 * Fix error handling in some x509 APIs

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEOSEivHoFu8YQee2OpU5XPKwd8GwFAmqel3UACgkQpU5XPKwd
# 8Gz2UA//S261uNlByPmh6kiDLWy0o1pNOu3Xfr2LD//WMG7Uota5MBl3C09Jy1in
# pxTIPGp6xIhxDFFRVTSG3qkezsVFMEHQf5fp29nYlk4Q0q+JO7on558Xn7o10+99
# jdgSWNB7FMeVHkknSyQuei4h6iIdtpJjtWcH/jABF80z4DGo27PKWpUQJKsCh0wZ
# FiOkgEqk/YQBre0ziZ+tDxgNyDl25JWdMAsV3tRaXnkNvzXOqYXzr0M97jJO45yZ
# Fti0Krg96dAFwT7F8boxP+5Rn1rQcfPrZwuXQg5wC1RyQiQqnmh2bhC4DbMWujGc
# s7bo40BSmp/z4rhLw5zPHMaVwokls28Nk4ocEsAUhqejL+MntxEs7xSa23EVKO4F
# mvevSz1mtLPL7fyXCCfRSL5AFy4kMdfCflhpYUpk15cBuXBY9hnzBNiq9kFtf4lI
# heCdnxJka6WUQrxWaHT9Bs3FDdaQ4Cw+yXLHn9XNK65J5sF2yOKkhyXbnuiy87KO
# dAdCb/sL3Zg0wFA8j8YkgygBizS3FU+X1tq3Rj0WrNUNWrbUkSamnS+foi+uRjI0
# kotXIrr3pgFXq4CaS+XyWvn1Xk0veh/xw2FIDYRN9l1BBYP6f/svcq8L0h423KGg
# GZzmUCkG89+uUJ56fgih62G5AgHFAfTB1BKGGW5jcoY8QOJ4MR4=
# =BVbi
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon Sep  7 11:52:37 2026 BST
# gpg:                using RSA key 392122BC7A05BBC61079ED8EA54E573CAC1DF06C
# gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>" [full]
# gpg:                 aka "Daniel P. Berrange <berrange@redhat.com>" [full]
# Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E  8E3F BE86 EBB4 1510 4FDF
#      Subkey fingerprint: 3921 22BC 7A05 BBC6 1079  ED8E A54E 573C AC1D F06C

* tag 'misc-fixes-pull-request' of https://gitlab.com/berrange/qemu:
  docs/system/security: exclude uninitialized stack variables as bugs
  gitlab: use --emacs --quiet for checkpatch.pl instead of --terse
  crypto: deprecate the AF_ALG crypto backend
  tests/unit: cover blocked IO during the websock handshake
  io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading
  tests/unit: add websock handshake test
  io/channel-websock: handle a blocked write during the handshake
  io/channel-websock: send an HTTP 400 when the greeting has no space
  io/channel-socket: do not treat a zero length write as an error
  crypto/x509-utils: propagate the error
  crypto/x509-utils: don't double set errp
  crypto: Use g_autofree

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

1 files changed, 3 insertions, 7 deletions

diff --git a/crypto/hmac-glib.c b/crypto/hmac-glib.c
index b845133a05..1f17769c1c 100644
--- a/crypto/hmac-glib.c
+++ b/crypto/hmac-glib.c
@@ -46,7 +46,7 @@ void *qcrypto_hmac_ctx_new(QCryptoHashAlgo alg,
                            const uint8_t *key, size_t nkey,
                            Error **errp)
 {
-    QCryptoHmacGlib *ctx;
+    g_autofree QCryptoHmacGlib *ctx = NULL;
 
     if (!qcrypto_hmac_supports(alg)) {
         error_setg(errp, "Unsupported hmac algorithm %s",
@@ -60,14 +60,10 @@ void *qcrypto_hmac_ctx_new(QCryptoHashAlgo alg,
                             (const uint8_t *)key, nkey);
     if (!ctx->ghmac) {
         error_setg(errp, "Cannot initialize hmac and set key");
-        goto error;
+        return NULL;
     }
 
-    return ctx;
-
-error:
-    g_free(ctx);
-    return NULL;
+    return g_steal_pointer(&ctx);
 }
 
 static void