From nobody Sat Jul 25 11:59:21 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1784531850; cv=none; d=zohomail.com; s=zohoarc; b=OsLZk33m/fmCbQraNMPYU9cTl8R6OW1riLyBmUEmdLj3K0o3Uwy6BH3b7GFt1RFibs2z/44kg0qLhM2VoCI+Hh3G9/6SJrs8+a9e02SGK0kjtEBBbCk/ugdAj8LDIT7qD1Bsv2rpfPB0ycVbjRxfrX0gsPvhRiTWi5tnjeCsmUQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784531850; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=pfScrBn38640llKJwckOWShlKCm58AeclKkJ/RdzCGw=; b=ZyXaKq5tU9ki0RUX6E/hoP/T9T/l9KURfGyBv25nC+oGOQTM5LtkElsKRTmXG3vc1ax/FFg0fQxwrP9qPNoBnZFORwJd3aV56X+4Vf4fVuVPJ1uwE2y2T/Kzv5zTxOH/+94aud7owat1C4/HDz0SI/ggsXysn6n1n66FrD3dLB4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178453185044866.75889033237911; Mon, 20 Jul 2026 00:17:30 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wliF5-0002zP-2r; Mon, 20 Jul 2026 03:16:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wliEm-0002xo-Dd for qemu-devel@nongnu.org; Mon, 20 Jul 2026 03:16:30 -0400 Received: from mail-pj2-x04.google.com ([2607:f8b0:4864:39::4]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1wliEi-0001kX-Ru for qemu-devel@nongnu.org; Mon, 20 Jul 2026 03:16:27 -0400 Received: by mail-pj2-x04.google.com with SMTP id d9443c01a7336-2cabe9335f1so58864245ad.0 for ; Mon, 20 Jul 2026 00:16:23 -0700 (PDT) Received: from VM-210-252-ubuntu.. ([14.116.239.34]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf346db113sm50931775ad.39.2026.07.20.00.16.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 00:16:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784531782; x=1785136582; darn=nongnu.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=pfScrBn38640llKJwckOWShlKCm58AeclKkJ/RdzCGw=; b=ZCN3swTGld0gIj9GhBRBnazVn/Uw2gXeh6KQJzlo9HIWvQ5vMYRBJcnbKtoZYr6sUl BBiadhgYs5Y/3IgUZF6H/yhSw00hEgV4eImpC83HSre64Bv76rq0M6ayMNB+EgG/xnmQ dViWettjunCKnWYUjrIdNkmP1aQi128EvW+ahGAuk7dx9/KJoka8fNTmxh90ZKNbmWb0 ltPo8me3lq8PDWKMTYOFeobJolrp5LW0DNmSfWeax8Pvbkk40JStnik6d5pxiUzojIV0 QpcS8pbvH/vT0J9Tb4XEVm5+n7CmnB4pP36E4LqhXnX8zymZhe2gB4MB4RnQY4eD7S3x QkyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784531782; x=1785136582; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=pfScrBn38640llKJwckOWShlKCm58AeclKkJ/RdzCGw=; b=hGZ0eOkxfOnz2Wsa7TbhiR8GoZoZjGm7X/x/ebIjZpCKQ3BuJazTQ1l3zkTaVqbdsl 5B4V3iGXYuiXq2mI+4GhUAZBcidTjuxiV8jT4HIV03PQ286wkzfa7P8tIhS7lNfeYXM2 0VtypUQSuS1/xUxW0haS+5TnO+sm6RvGDYVPMGGnwW0MKrbifzpWcq/R6MOyClnLnfZL sFyeazl5frLI9sykh6iFNigfA6CuhbrzDHGYcO/ZYaQHFn9oFT2/MNV/o/biOHyJfLB3 CFUD4G/8T9aBITFJt3GhTTBO8UbrUMYK1dpnVMzUkop8IwLT6/mhhqvexwO1iHaxSk8w 63qQ== X-Gm-Message-State: AOJu0YzBSTOfNfUE3cWxlukroaPrf8/ZsQXXO2KJYRClMyicUf8w/suq MzJCJvzGSIOwNwLhO4bSL7z78POILumJHwb7OJu8MofV29qm6s2tO70rYU/AAzOEcXPrY7ef X-Gm-Gg: AfdE7ckuQcusEIAXMNmWtzNC1YbO+rZMTqWhJ3FMv7X22FxkzJ+zLqfVoEFosp7UWGb d6/IcCVnRDB1Dow7Ti3TyOq02xHVv0I+dDDLkGtf68kU0yIcQjN2GMWkL6c5a+vMejAeF9BuKZc RktLB4RUruzcE64NavWG6WEJdJpygYerSn6o9EOMJieqDskORdeD3kCuTlC/ta9++tX+oRLEw59 nhnfLsmavu+nj/t4k8ZKiE58+JuVhaALC0G9/rhMBZVqcWy8bYUzd5HVIQRpVEcN8wtX16zVaH/ wFM0EsNN/Lu1UU1KJ712juZ/s+blMtXv22/ume0kE+Z+lkU98M/qtHBNyuRSW6hVbCQ7wZRnFOX 48aygHNFg2QVduLLbE5otzVgKG78e4V3X9iVWgkDQRAXFxSBX309vs7D+o+bm6k9rH7F80oR496 t6N+MxKZEOOotD9QtJMOU9v+j2h1EKRgsb0Qa9lJNA1+gUXuPTBh2frln7ampsn90lxLRg/GDPE t1eAKxf0KZUqgzaP8fEEc5EG8oBVw== X-Received: by 2002:a17:902:ce89:b0:2bf:9760:b94d with SMTP id d9443c01a7336-2cf3485ea4emr138122105ad.15.1784531782054; Mon, 20 Jul 2026 00:16:22 -0700 (PDT) From: jianghaotian.sunday@gmail.com To: qemu-devel@nongnu.org Cc: mst@redhat.com, alex.bennee@linaro.org, odaki@rsg.ci.i.u-tokyo.ac.jp, dmitry.osipenko@collabora.com, qemu-stable@nongnu.org, Haotian Jiang Subject: [PATCH v2] virtio-gpu: fix NULL deref in rutabaga set_scanout Date: Mon, 20 Jul 2026 15:15:56 +0800 Message-Id: <20260720071556.106003-1-jianghaotian.sunday@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2607:f8b0:4864:39::4; envelope-from=jianghaotian.sunday@gmail.com; helo=mail-pj2-x04.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1784531853026158500 Content-Type: text/plain; charset="utf-8" From: Haotian Jiang rutabaga_cmd_set_scanout() checks scanout_id < VIRTIO_GPU_MAX_SCANOUTS (16), but does not check scanout_id < conf.max_outputs like the base class (virtio-gpu.c) and virgl backend (virtio-gpu-virgl.c) do. With the default max_outputs=3D1, virtio_gpu_base_device_realize only initializes scanout[0].con. A guest submitting SET_SCANOUT with scanout_id >=3D 1 takes the con=3DNULL path, and qemu_console_set_surface(NULL, NULL) dereferences con->ds, crashing QEMU. Replace VIRTIO_GPU_MAX_SCANOUTS with vb->conf.max_outputs in the CHECK, since realization already ensures max_outputs <=3D VIRTIO_GPU_MAX_SCANOUTS. Fixes: 1dcc6adbc1 ("gfxstream + rutabaga: add initial support for gfxstream= ") Reported-by: Haotian Jiang of Tencent Security (Yunding Lab) Signed-off-by: Haotian Jiang Cc: qemu-stable@nongnu.org Reviewed-by: Marc-Andr=C3=A9 Lureau --- hw/display/virtio-gpu-rutabaga.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutab= aga.c index 6ff1263901..3f78899442 100644 --- a/hw/display/virtio-gpu-rutabaga.c +++ b/hw/display/virtio-gpu-rutabaga.c @@ -302,7 +302,7 @@ rutabaga_cmd_set_scanout(VirtIOGPU *g, struct virtio_gp= u_ctrl_command *cmd) trace_virtio_gpu_cmd_set_scanout(ss.scanout_id, ss.resource_id, ss.r.width, ss.r.height, ss.r.x, ss.r= .y); =20 - CHECK(ss.scanout_id < VIRTIO_GPU_MAX_SCANOUTS, cmd); + CHECK(ss.scanout_id < vb->conf.max_outputs, cmd); scanout =3D &vb->scanout[ss.scanout_id]; =20 if (ss.resource_id =3D=3D 0) { --=20 2.34.1