From nobody Sun Jul 26 10:13:37 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=rsg.ci.i.u-tokyo.ac.jp ARC-Seal: i=1; a=rsa-sha256; t=1784963651; cv=none; d=zohomail.com; s=zohoarc; b=Bn3J/+v6FO35rtRyNUM3G2VyhwnI6JwcV5HrIhNJZ6d8K0acLDVG3v2JfSdsjcbVfVYYyG7WrGLgskMEQXiWBJKcYn7ibRDJ0hmPYBYT8vhgSZc+m2RLTNwFATll2WRVOesSA+3qBkuyJGE5GOTYV67ay+XdFtR//B/59ueqgqA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784963651; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qvnRG6XZ1a67sXlfpkEnQXxN9+P0U7A3YZitAXNEJCw=; b=FszeIrhielzfkWn1osuxVRblIDDCVBam5WEd8h8X1IbmYznxTyn1d25JSGDCkB6KvnbKWojNhHNNLcafOgueId1x9f+aVYtNjw4/MvzkLUEkA25wg93Iv+UOunwAuET8rxX61+Zlx6r9KItMxELBokvnLHva8BBxjyL8ra2jepM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784963651694710.8746776967497; Sat, 25 Jul 2026 00:14:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wnWa1-0001UO-Gt; Sat, 25 Jul 2026 03:13:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wnWZz-0001TO-Sx for qemu-devel@nongnu.org; Sat, 25 Jul 2026 03:13:51 -0400 Received: from www3579.sakura.ne.jp ([49.212.243.89]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wnWZy-0002MS-4F for qemu-devel@nongnu.org; Sat, 25 Jul 2026 03:13:51 -0400 Received: from h183.csg.ci.i.u-tokyo.ac.jp (h183.csg.ci.i.u-tokyo.ac.jp [133.11.54.183]) (authenticated bits=0) by www3579.sakura.ne.jp (8.16.1/8.16.1) with ESMTPSA id 66P7DdL4073060 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 25 Jul 2026 16:13:44 +0900 (JST) (envelope-from odaki@rsg.ci.i.u-tokyo.ac.jp) DKIM-Signature: a=rsa-sha256; bh=qvnRG6XZ1a67sXlfpkEnQXxN9+P0U7A3YZitAXNEJCw=; c=relaxed/relaxed; d=rsg.ci.i.u-tokyo.ac.jp; h=From:Message-Id:To:Subject:Date; s=rs20250326; t=1784963624; v=1; b=JYzagT+osF/65HuPWTKuBWT5ReknQvQRYitNAp+3E9/oGILE1SZE9clT5L4YCHQS BFvqTuC/z+Vw8WYfI/p31WWMylJbAAtdypmQVn+UfPN+OWyOhcE1WmTen59u6dwG XSg47PR1LaggERgEeTxnVN1LtXBZ3ei36jq+HTLVz47jiXDCfhx/5zynOr0HR6jk M/v8O+z2XCJtqO4NnKy4sdi967cdQIL6hBmQZSDH9WA8Q4wuopuME+yFw81Lkp3H yVOflhfuppxxdIdYW2DFJknKVtyCby2bgNF0ApN+/UM+Fb1eZMWd99/dGVkQ07US Dbyrb/rdzOs6dwZ7RfqVIg== From: Akihiko Odaki Date: Sat, 25 Jul 2026 16:13:35 +0900 Subject: [PATCH] hw/display/virtio-gpu: Reject non-migratable large blobs MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260725-blob-v1-1-f643fbd76398@rsg.ci.i.u-tokyo.ac.jp> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/6tWKk4tykwtVrJSqFYqSi3LLM7MzwNyDHUUlJIzE vPSU3UzU4B8JSMDIzMDcyNT3aSc/CRdi0SzRMNEC1MzA8NEJaDSgqLUtMwKsDHRsRB+cWlSVmp yCUivUm0tAEPhBPVoAAAA X-Change-ID: 20260725-blob-8a6a1a85601a To: qemu-devel@nongnu.org Cc: =?utf-8?q?Alex_Benn=C3=A9e?= , Dmitry Osipenko , "Michael S. Tsirkin" , Akihiko Odaki X-Mailer: b4 0.16-dev-925f5 X-Developer-Signature: v=1; a=openpgp-sha256; l=1434; i=odaki@rsg.ci.i.u-tokyo.ac.jp; h=from:subject:message-id; bh=+OIh1VzS35u+Naul3OrQ1LB36UCHyZtD7rdKxbCoFDM=; b=owGbwMvMwCWmMbc20y1CyJDxtFoSQ1ZKkjrzhwvVohER26Sari0S/q03obRgp+ONf9x8NmVnD 5WXedzsKGVhEONikBVTZEkp2s2tEV37qTAhvgVmDisTyBAGLk4BmEhENsP/HLcKxz+Hkn5t1FGY wXB4c2KmsWXfRkv+6ndHV06zCvzqzMiwoT/6oKb2nn6WV1b3fHLvmtS0XmB79Dj/8GOWj7c17r5 hAAA= X-Developer-Key: i=odaki@rsg.ci.i.u-tokyo.ac.jp; a=openpgp; fpr=AEDC03C9AF734F2EC26A7BFFA4BAEAA73536753C Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=49.212.243.89; envelope-from=odaki@rsg.ci.i.u-tokyo.ac.jp; helo=www3579.sakura.ne.jp X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @rsg.ci.i.u-tokyo.ac.jp) X-ZM-MESSAGEID: 1784963654693154100 The blob size is encoded as a 64-bit integer in the virtio protocol, but it is encoded as a 32-bit integer in the migration stream, and a large blob whose size cannot be expressed in a 32-bit integer will be corrupted after migration. Deny creating such large blobs. Fixes: 10b9ddbc83b9 ("Revert "virtio-gpu: block migration of VMs with blob= =3Dtrue"") Signed-off-by: Akihiko Odaki --- hw/display/virtio-gpu.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 718ba3039290..a5aa37aebd0e 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -352,6 +352,14 @@ static void virtio_gpu_resource_create_blob(VirtIOGPU = *g, return; } =20 + if (cblob.size > UINT32_MAX) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: blob too large (%" PRIu64 "> %" PRIu32 ")\n", + __func__, cblob.size, UINT32_MAX); + cmd->error =3D VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY; + return; + } + if (virtio_gpu_find_resource(g, cblob.resource_id)) { qemu_log_mask(LOG_GUEST_ERROR, "%s: resource already exists %d\n", __func__, cblob.resource_id); --- base-commit: 006a22cb26998998385b104db1ff9466ef2f3153 change-id: 20260725-blob-8a6a1a85601a Best regards, -- =20 Akihiko Odaki