Various UI/security-related fixes for 11.1

[GIT PULL 00/15] Various UI/security-related fixes for 11.1

Posted by Marc-André Lureau 1 week, 1 day ago

The following changes since commit eca2c16212ef9dcb0871de39bb9d1c2efebe76be:

  Update version for v11.1.0-rc0 release (2026-07-14 20:36:23 +0100)

are available in the Git repository at:

  https://gitlab.com/marcandre.lureau/qemu.git tags/fix-pr-v1

for you to fetch changes up to f1af81ba2aeec7b5a5ee8529ef55275865aea0c0:

  hw/display/virtio-gpu: Check pixman_image_create_bits() results (2026-07-17 15:52:31 +0400)

----------------------------------------------------------------
Various UI/security-related fixes for 11.1

To: qemu-devel@nongnu.org
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

----------------------------------------------------------------
Akihiko Odaki (3):
      ui/gtk: Narrow DMA-BUF critical section
      hw/display/virtio-gpu: reject strides exceeding INT_MAX
      hw/display/virtio-gpu: Check pixman_image_create_bits() results

Marc-André Lureau (12):
      i386/tdx: fix uninitialized variable warning in tdx_check_features
      ui/vnc: fix OOB write in vnc_refresh_lossy_rect
      ui/vnc: validate color shifts in SetPixelFormat
      ui/vnc: use RFB wire types for client message handlers
      ui/input-barrier: fix off-by-one in keycode bounds check
      ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
      ui/vnc: validate SetPixelFormat field ranges
      hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
      hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
      hw/display/virtio-gpu: validate stride against width on scanout
      hw/display/virtio-gpu: cap submit_3d command buffer allocation
      hw/display/virtio-gpu: handle migration iov allocation failure

 contrib/vhost-user-gpu/vugpu.h   |  9 ++++++
 include/hw/virtio/virtio-gpu.h   |  9 ++++++
 contrib/vhost-user-gpu/virgl.c   |  7 +++++
 hw/display/qxl-render.c          | 28 ++++++++++-------
 hw/display/virtio-gpu-rutabaga.c |  8 +++++
 hw/display/virtio-gpu-udmabuf.c  |  1 +
 hw/display/virtio-gpu-virgl.c    |  8 +++++
 hw/display/virtio-gpu.c          | 57 ++++++++++++++++++++++++++++++++---
 target/i386/kvm/tdx.c            |  2 +-
 ui/gtk-egl.c                     |  6 ++--
 ui/gtk-gl-area.c                 | 23 +-------------
 ui/input-barrier.c               |  2 +-
 ui/vnc.c                         | 65 ++++++++++++++++++++++++----------------
 13 files changed, 157 insertions(+), 68 deletions(-)

Re: [GIT PULL 00/15] Various UI/security-related fixes for 11.1

Posted by Michael Tokarev 6 days, 6 hours ago

On 7/17/26 14:52, Marc-André Lureau wrote:

> Various UI/security-related fixes for 11.1
> 
> ----------------------------------------------------------------
> Akihiko Odaki (3):
>        ui/gtk: Narrow DMA-BUF critical section
>        hw/display/virtio-gpu: reject strides exceeding INT_MAX
>        hw/display/virtio-gpu: Check pixman_image_create_bits() results
> 
> Marc-André Lureau (12):
>        i386/tdx: fix uninitialized variable warning in tdx_check_features
>        ui/vnc: fix OOB write in vnc_refresh_lossy_rect
>        ui/vnc: validate color shifts in SetPixelFormat
>        ui/vnc: use RFB wire types for client message handlers
>        ui/input-barrier: fix off-by-one in keycode bounds check
>        ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
>        ui/vnc: validate SetPixelFormat field ranges
>        hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
>        hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
>        hw/display/virtio-gpu: validate stride against width on scanout
>        hw/display/virtio-gpu: cap submit_3d command buffer allocation
>        hw/display/virtio-gpu: handle migration iov allocation failure

Hi!

Is there anything in there which should *not* go
to the stable qemu series?
(besides fixes for code which is not in releases, if any)

It feels like everything in this pullreq should be picked up
for qemu-stable.

Thanks,

/mjt

>   contrib/vhost-user-gpu/vugpu.h   |  9 ++++++
>   include/hw/virtio/virtio-gpu.h   |  9 ++++++
>   contrib/vhost-user-gpu/virgl.c   |  7 +++++
>   hw/display/qxl-render.c          | 28 ++++++++++-------
>   hw/display/virtio-gpu-rutabaga.c |  8 +++++
>   hw/display/virtio-gpu-udmabuf.c  |  1 +
>   hw/display/virtio-gpu-virgl.c    |  8 +++++
>   hw/display/virtio-gpu.c          | 57 ++++++++++++++++++++++++++++++++---
>   target/i386/kvm/tdx.c            |  2 +-
>   ui/gtk-egl.c                     |  6 ++--
>   ui/gtk-gl-area.c                 | 23 +-------------
>   ui/input-barrier.c               |  2 +-
>   ui/vnc.c                         | 65 ++++++++++++++++++++++++----------------
>   13 files changed, 157 insertions(+), 68 deletions(-)

Re: [GIT PULL 00/15] Various UI/security-related fixes for 11.1

Posted by Stefan Hajnoczi 5 days, 3 hours ago

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

Re: [GIT PULL 00/15] Various UI/security-related fixes for 11.1

Posted by Michael Tokarev 5 days, 2 hours ago

On 7/17/26 14:52, Marc-André Lureau wrote:
...
> Akihiko Odaki (3):
>        ui/gtk: Narrow DMA-BUF critical section
>        hw/display/virtio-gpu: reject strides exceeding INT_MAX
>        hw/display/virtio-gpu: Check pixman_image_create_bits() results
> 
> Marc-André Lureau (12):
>        i386/tdx: fix uninitialized variable warning in tdx_check_features
>        ui/vnc: fix OOB write in vnc_refresh_lossy_rect
>        ui/vnc: validate color shifts in SetPixelFormat
>        ui/vnc: use RFB wire types for client message handlers
>        ui/input-barrier: fix off-by-one in keycode bounds check
>        ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
>        ui/vnc: validate SetPixelFormat field ranges
>        hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
>        hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
>        hw/display/virtio-gpu: validate stride against width on scanout
>        hw/display/virtio-gpu: cap submit_3d command buffer allocation
>        hw/display/virtio-gpu: handle migration iov allocation failure

 From this batch, I'm NOT picking up for stable:

         i386/tdx: fix uninitialized variable warning in tdx_check_features
         ui/vnc: use RFB wire types for client message handlers
           (this one I'm not certain, maybe I should pick it up too)

queued, waiting for an addiitonal fix to land:

         hw/display/virtio-gpu: validate stride against width on scanout
           (as discussed)
         hw/display/virtio-gpu: reject strides exceeding INT_MAX
           (context depends on the previous one)

the rest are queued up for 10.0.x and 11.0.x.

BTW, a few of them, namely:

        hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
        hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure

has already been merged through misc tree.

Thanks,

/mjt

Re: [GIT PULL 00/15] Various UI/security-related fixes for 11.1

Posted by Michael Tokarev 6 days, 6 hours ago

[Resending with the correct email of Akihiko Odaki, please excuse the duplicate]

On 7/17/26 14:52, Marc-André Lureau wrote:

> Various UI/security-related fixes for 11.1
> 
> ----------------------------------------------------------------
> Akihiko Odaki (3):
>        ui/gtk: Narrow DMA-BUF critical section
>        hw/display/virtio-gpu: reject strides exceeding INT_MAX
>        hw/display/virtio-gpu: Check pixman_image_create_bits() results
> 
> Marc-André Lureau (12):
>        i386/tdx: fix uninitialized variable warning in tdx_check_features
>        ui/vnc: fix OOB write in vnc_refresh_lossy_rect
>        ui/vnc: validate color shifts in SetPixelFormat
>        ui/vnc: use RFB wire types for client message handlers
>        ui/input-barrier: fix off-by-one in keycode bounds check
>        ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
>        ui/vnc: validate SetPixelFormat field ranges
>        hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
>        hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
>        hw/display/virtio-gpu: validate stride against width on scanout
>        hw/display/virtio-gpu: cap submit_3d command buffer allocation
>        hw/display/virtio-gpu: handle migration iov allocation failure

Hi!

Is there anything in there which should *not* go
to the stable qemu series?
(besides fixes for code which is not in releases, if any)

It feels like everything in this pullreq should be picked up
for qemu-stable.

Thanks,

/mjt

>   contrib/vhost-user-gpu/vugpu.h   |  9 ++++++
>   include/hw/virtio/virtio-gpu.h   |  9 ++++++
>   contrib/vhost-user-gpu/virgl.c   |  7 +++++
>   hw/display/qxl-render.c          | 28 ++++++++++-------
>   hw/display/virtio-gpu-rutabaga.c |  8 +++++
>   hw/display/virtio-gpu-udmabuf.c  |  1 +
>   hw/display/virtio-gpu-virgl.c    |  8 +++++
>   hw/display/virtio-gpu.c          | 57 ++++++++++++++++++++++++++++++++---
>   target/i386/kvm/tdx.c            |  2 +-
>   ui/gtk-egl.c                     |  6 ++--
>   ui/gtk-gl-area.c                 | 23 +-------------
>   ui/input-barrier.c               |  2 +-
>   ui/vnc.c                         | 65 ++++++++++++++++++++++++----------------
>   13 files changed, 157 insertions(+), 68 deletions(-)

Re: [GIT PULL 00/15] Various UI/security-related fixes for 11.1

Posted by Akihiko Odaki 6 days, 5 hours ago

On 2026/07/19 16:33, Michael Tokarev wrote:
> [Resending with the correct email of Akihiko Odaki, please excuse the 
> duplicate]
> 
> On 7/17/26 14:52, Marc-André Lureau wrote:
> 
>> Various UI/security-related fixes for 11.1
>>
>> ----------------------------------------------------------------
>> Akihiko Odaki (3):
>>        ui/gtk: Narrow DMA-BUF critical section
>>        hw/display/virtio-gpu: reject strides exceeding INT_MAX
>>        hw/display/virtio-gpu: Check pixman_image_create_bits() results
>>
>> Marc-André Lureau (12):
>>        i386/tdx: fix uninitialized variable warning in tdx_check_features
>>        ui/vnc: fix OOB write in vnc_refresh_lossy_rect
>>        ui/vnc: validate color shifts in SetPixelFormat
>>        ui/vnc: use RFB wire types for client message handlers
>>        ui/input-barrier: fix off-by-one in keycode bounds check
>>        ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
>>        ui/vnc: validate SetPixelFormat field ranges
>>        hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
>>        hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
>>        hw/display/virtio-gpu: validate stride against width on scanout
>>        hw/display/virtio-gpu: cap submit_3d command buffer allocation
>>        hw/display/virtio-gpu: handle migration iov allocation failure
> 
> Hi!

Hi Michael, Marc-André,

> 
> Is there anything in there which should *not* go
> to the stable qemu series?
> (besides fixes for code which is not in releases, if any)
> 
> It feels like everything in this pullreq should be picked up
> for qemu-stable.

The hw/display/virtio-gpu patches are generally good for stable, with 
one exception:

"hw/display/virtio-gpu: validate stride against width on scanout"

This patch doesn't account for the late feedback I sent here:
https://lore.kernel.org/qemu-devel/ec997fca-6dc4-4268-9269-0e4be676b0fb@rsg.ci.i.u-tokyo.ac.jp/

Marc-André: My apologies for the timing, but please check the linked 
thread.

Michael: You may holding off on that specific patch for qemu-stable 
until we clear up that edge case, but at least it's not harmful. I think 
my patches and the other virtio-gpu patches are ready.

Regards,
Akihiko Odaki

Re: [GIT PULL 00/15] Various UI/security-related fixes for 11.1

Posted by Marc-André Lureau 6 days, 5 hours ago

Hi

On Sun, Jul 19, 2026 at 11:51 AM Akihiko Odaki
<odaki@rsg.ci.i.u-tokyo.ac.jp> wrote:
>
> On 2026/07/19 16:33, Michael Tokarev wrote:
> > [Resending with the correct email of Akihiko Odaki, please excuse the
> > duplicate]
> >
> > On 7/17/26 14:52, Marc-André Lureau wrote:
> >
> >> Various UI/security-related fixes for 11.1
> >>
> >> ----------------------------------------------------------------
> >> Akihiko Odaki (3):
> >>        ui/gtk: Narrow DMA-BUF critical section
> >>        hw/display/virtio-gpu: reject strides exceeding INT_MAX
> >>        hw/display/virtio-gpu: Check pixman_image_create_bits() results
> >>
> >> Marc-André Lureau (12):
> >>        i386/tdx: fix uninitialized variable warning in tdx_check_features
> >>        ui/vnc: fix OOB write in vnc_refresh_lossy_rect
> >>        ui/vnc: validate color shifts in SetPixelFormat
> >>        ui/vnc: use RFB wire types for client message handlers
> >>        ui/input-barrier: fix off-by-one in keycode bounds check
> >>        ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
> >>        ui/vnc: validate SetPixelFormat field ranges
> >>        hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
> >>        hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
> >>        hw/display/virtio-gpu: validate stride against width on scanout
> >>        hw/display/virtio-gpu: cap submit_3d command buffer allocation
> >>        hw/display/virtio-gpu: handle migration iov allocation failure
> >
> > Hi!
>
> Hi Michael, Marc-André,
>
> >
> > Is there anything in there which should *not* go
> > to the stable qemu series?
> > (besides fixes for code which is not in releases, if any)
> >
> > It feels like everything in this pullreq should be picked up
> > for qemu-stable.
>
> The hw/display/virtio-gpu patches are generally good for stable, with
> one exception:
>
> "hw/display/virtio-gpu: validate stride against width on scanout"
>
> This patch doesn't account for the late feedback I sent here:
> https://lore.kernel.org/qemu-devel/ec997fca-6dc4-4268-9269-0e4be676b0fb@rsg.ci.i.u-tokyo.ac.jp/
>
> Marc-André: My apologies for the timing, but please check the linked
> thread.
>

Tampering with migration stream is still being discussed, in the
meantime the patch fixes malicious guest gpu usage. Can you send a
follow up patch?

> Michael: You may holding off on that specific patch for qemu-stable
> until we clear up that edge case, but at least it's not harmful. I think
> my patches and the other virtio-gpu patches are ready.
>
> Regards,
> Akihiko Odaki
>

Re: [GIT PULL 00/15] Various UI/security-related fixes for 11.1

Posted by Akihiko Odaki 6 days, 1 hour ago

On 2026/07/19 17:07, Marc-André Lureau wrote:
> Hi
> 
> On Sun, Jul 19, 2026 at 11:51 AM Akihiko Odaki
> <odaki@rsg.ci.i.u-tokyo.ac.jp> wrote:
>>
>> On 2026/07/19 16:33, Michael Tokarev wrote:
>>> [Resending with the correct email of Akihiko Odaki, please excuse the
>>> duplicate]
>>>
>>> On 7/17/26 14:52, Marc-André Lureau wrote:
>>>
>>>> Various UI/security-related fixes for 11.1
>>>>
>>>> ----------------------------------------------------------------
>>>> Akihiko Odaki (3):
>>>>         ui/gtk: Narrow DMA-BUF critical section
>>>>         hw/display/virtio-gpu: reject strides exceeding INT_MAX
>>>>         hw/display/virtio-gpu: Check pixman_image_create_bits() results
>>>>
>>>> Marc-André Lureau (12):
>>>>         i386/tdx: fix uninitialized variable warning in tdx_check_features
>>>>         ui/vnc: fix OOB write in vnc_refresh_lossy_rect
>>>>         ui/vnc: validate color shifts in SetPixelFormat
>>>>         ui/vnc: use RFB wire types for client message handlers
>>>>         ui/input-barrier: fix off-by-one in keycode bounds check
>>>>         ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
>>>>         ui/vnc: validate SetPixelFormat field ranges
>>>>         hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
>>>>         hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
>>>>         hw/display/virtio-gpu: validate stride against width on scanout
>>>>         hw/display/virtio-gpu: cap submit_3d command buffer allocation
>>>>         hw/display/virtio-gpu: handle migration iov allocation failure
>>>
>>> Hi!
>>
>> Hi Michael, Marc-André,
>>
>>>
>>> Is there anything in there which should *not* go
>>> to the stable qemu series?
>>> (besides fixes for code which is not in releases, if any)
>>>
>>> It feels like everything in this pullreq should be picked up
>>> for qemu-stable.
>>
>> The hw/display/virtio-gpu patches are generally good for stable, with
>> one exception:
>>
>> "hw/display/virtio-gpu: validate stride against width on scanout"
>>
>> This patch doesn't account for the late feedback I sent here:
>> https://lore.kernel.org/qemu-devel/ec997fca-6dc4-4268-9269-0e4be676b0fb@rsg.ci.i.u-tokyo.ac.jp/
>>
>> Marc-André: My apologies for the timing, but please check the linked
>> thread.
>>
> 
> Tampering with migration stream is still being discussed, in the
> meantime the patch fixes malicious guest gpu usage. Can you send a
> follow up patch?

I sent one:
https://lore.kernel.org/qemu-devel/20260719-bpp-v1-1-9b91946d6cf3@rsg.ci.i.u-tokyo.ac.jp/
("[PATCH] hw/display/virtio-gpu: Remove the bytes_pp field")

> 
>> Michael: You may holding off on that specific patch for qemu-stable
>> until we clear up that edge case, but at least it's not harmful. I think
>> my patches and the other virtio-gpu patches are ready.

One correction: we need to apply "hw/display/virtio-gpu: validate stride 
against width on scanout" and the follow up patch at the same time. 
Otherwise we will have a user of the bytes_pp field, which the follow up 
patch drops.

Regards,
Akihiko Odaki