From nobody Tue Aug 25 00:11:12 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785871622; cv=none; d=zohomail.com; s=zohoarc; b=GuwgvQDzSzgkQ68CZP+1htdinsMho/do2lvUOdfzUAZ/MmdWfAUmYRm5mBRz8xnriCdiXeoMa5k2sXwfLTUzwkpdncRXulFevX9BaaLR2C7abYCVUPR9CAQ8nueIAKUqBnYmftd+TF6qtFcTaAzXgl+obWdrEQE115U0NWuADJY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785871622; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=3AnR5+gsJzHOo4gwdjec5GVmM1fFGwyr/nH1Jm5SbeU=; b=JV9uu3nd9KWy3K5qtSLk3O0S//iB3wSk8QIukjmwT80Sv283+A1E/UX+WjVZ8YRUTv2bGpBoMBW+YffKq3qscvjLhKqgRPwI63x5PVN/2Xm6duex8YOxsxdn3fdZJ8rvl1eSFm9K976XL8uQ1pp9bg/+qtlD/6QTR1YDLHorLYw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785871622625149.05186783853992; Tue, 4 Aug 2026 12:27:02 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wrKmZ-00079w-2d; Tue, 04 Aug 2026 15:26:35 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKmX-00079W-Fw for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:26:33 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKmV-000578-Qa for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:26:33 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-610-R7yWLd5WNwqyc_wJKOIBYw-1; Tue, 04 Aug 2026 15:26:24 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B5A19180029F; Tue, 4 Aug 2026 19:26:23 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 2DDB9195608D; Tue, 4 Aug 2026 19:26:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785871591; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3AnR5+gsJzHOo4gwdjec5GVmM1fFGwyr/nH1Jm5SbeU=; b=fAQ8TxxQnsc9YylfKb0JYpKuU63DJfLspHdvCDtO8hgSlPw9HLRTGzLPJ/JSEDufIC11Cr EIaG8C4K97jY4Gb+nTCvSN8eARIppp4losGSJ+DqwTRK+rgCILxsU265W5G5ZEOahXKvXE 4odDlLoNyUmeXqiGtvS1e7KFlYktgKQ= X-MC-Unique: R7yWLd5WNwqyc_wJKOIBYw-1 X-Mimecast-MFC-AGG-ID: R7yWLd5WNwqyc_wJKOIBYw_1785871583 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Tue, 04 Aug 2026 23:21:48 +0400 Subject: [GIT PULL v2 1/9] hw/display/virtio-gpu: validate blob iov size MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260804-fix-v2-1-70e8fe489c9e@redhat.com> References: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> In-Reply-To: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> To: qemu-devel@nongnu.org Cc: stefanha@redhat.com, =?utf-8?q?Alex_Benn=C3=A9e?= , Akihiko Odaki , Dmitry Osipenko , "Michael S. Tsirkin" X-Developer-Signature: v=1; a=openpgp-sha256; l=3166; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=6qeQBZsDpxxlBX+APuClWKzBBwDA/wesXR/QCuI+oMI=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcjzTrJ24WrnX5cQcnTz1mOM2nAxg/RMisUelh zSaUijSwxKJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanI80wAKCRDa6OEJdZac 5YqbEACKmtpoPc4P51KES+0o++gySiFqruH2h87kkwLylLtxsvat4ckRZnUGzOndqSzdvGnWZSm gFl+LxsX+tCHXklrs7SdosLiJsUPydvCSDbtwMlhiFI1mMQjzhFYpoC9JZgkWnOoq7IIkQgj3Xw ou9RRVyFX4j6dgJMYd5BGlspwk+9fPu+nHGrONdwk5NzY3jXoiS9LgCl6k1DGwco/ntibL5Amql MljZsGUKFbXhfRJm1LjzlFel4epalXoT4ae387sArZBif8uo/oF+X2ZhIYbh5soPbHzq/Ja275H wuWKmgyrHHd30CkLkLB0EgnViakXYW+v9214Zw77r3PwwFTjgcATEC51yCzvbHZ7Zhc9W3LfEk+ AIRwyi0X7c1GrBu9cMIDHwovUGwY+7yYGIFEj5qiIej/20x7GhQNfFmVSf4QYNsEQwmft5LPRPG PTd8xN3y3GVBh1WP46tO4Oips5RIVS3B8Bm1dt1jZGSe37U0+O4irpwOroTkWO+fKXj4pmMEbbR aiev3ygv5I71E7MD8PdyuFIUk6kGcqYX3RHo/lC/S4yqK4QUpJ3tTiek42GviQzOc19JLucGJFP S7yx5OYPDYGMacngklqKKQ747fkZyLIt85MiNJtTBXz/swdtYEhu3uJ5tWCbFv9J3ZHQ1bFLNJH 28Re5oQWT03rFig== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -28 X-Spam_score: -2.9 X-Spam_bar: -- X-Spam_report: (-2.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.795, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785871624748158500 virtio_gpu_resource_create_blob() stores the guest-controlled blob_size without checking it against the total size of the iov backing entries. Since both values are independently guest-controlled, a malicious guest can set blob_size much larger than the actual iov backing. Subsequent SET_SCANOUT_BLOB checks bounds against the inflated blob_size, allowing a pixman surface to be created over the undersized buffer. Any display refresh then reads past the actual allocation, potentially crashing QEMU or leaking host memory contents depending on the backing type. Validate that the iov backing is at least as large as the declared blob_size in create_blob (when nr_entries > 0, since the spec permits deferred backing), attach_backing (when attaching to a blob resource), and the blob migration load path. Fixes: CVE-2026-66021 Fixes: e0933d91b1cd ("virtio-gpu: Add virtio_gpu_resource_create_blob") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3945 Reported-by: "sundayjiang(=E8=92=8B=E6=B5=A9=E5=A4=A9)" Reviewed-by: Akihiko Odaki Signed-off-by: Marc-Andr=C3=A9 Lureau Message-ID: <20260729161431.1180691-1-marcandre.lureau@redhat.com> --- hw/display/virtio-gpu.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 4d46a4eb10fa..0206910cc377 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -372,6 +372,17 @@ static void virtio_gpu_resource_create_blob(VirtIOGPU = *g, return; } =20 + if (res->iov_cnt > 0 && + iov_size(res->iov, res->iov_cnt) < res->blob_size) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: backing storage smaller than blob size\n", + __func__); + cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; + virtio_gpu_cleanup_mapping(g, res); + g_free(res); + return; + } + virtio_gpu_init_udmabuf(res); QTAILQ_INSERT_HEAD(&g->reslist, res, next); } @@ -993,6 +1004,15 @@ virtio_gpu_resource_attach_backing(VirtIOGPU *g, return; } =20 + if (iov_size(res->iov, res->iov_cnt) < res->blob_size) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: backing storage smaller than blob size\n", + __func__); + cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; + virtio_gpu_cleanup_mapping(g, res); + return; + } + if (!res->image) { virtio_gpu_init_udmabuf(res); } @@ -1493,6 +1513,14 @@ static int virtio_gpu_blob_load(QEMUFile *f, void *o= paque, size_t size, res->iov[i].iov_len =3D qemu_get_be32(f); } =20 + if (res->iov_cnt > 0 && + iov_size(res->iov, res->iov_cnt) < res->blob_size) { + g_free(res->addrs); + g_free(res->iov); + g_free(res); + return -EINVAL; + } + if (!virtio_gpu_load_restore_mapping(g, res)) { g_free(res); return -EINVAL; --=20 2.55.0 From nobody Tue Aug 25 00:11:12 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785871620; cv=none; d=zohomail.com; s=zohoarc; b=Oam+E0tnwZQ/yF2160hXookf0BNqeWEnZYwCxJB1EmeFk+J4IiGxAWnkxRVlwIT6y/GZ0yTvBBZ//+qE0OIv25m0JYEvzpkmLvB38CLDp4cpW65jBE41J3xyCYzSlldNmI1HWrGduW9lZua+SwvC6ZFuEQWN8qKPR66ZPRRz3/k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785871620; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bXadFxbNPeUF1U0eYN9ts7zWvNYvwxNB1dgDghPB4oc=; b=CnbemKJiISxNZMDdiHHH+oPQo6G+O+/SwryW9QH/Eq7w2JB61/a7iStJPN45M22BlFXQZTL24ymL6xq1CYbMagPtjbRO3Xm6X1dGhmhDrjjA/ydvUNxVGa8m9VVn4Sm0XBU+99I3ZOKMlQry7aCNWNEc8sUp9Wt6V4I+x77CWxc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785871620240169.53094328708596; Tue, 4 Aug 2026 12:27:00 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wrKma-0007Ad-PQ; Tue, 04 Aug 2026 15:26:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKmY-00079f-Cu for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:26:34 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKmW-000572-Kn for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:26:34 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-423-sfh2VBYmON-4ksDE6Y1IzA-1; Tue, 04 Aug 2026 15:26:29 -0400 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id EB611195608B for ; Tue, 4 Aug 2026 19:26:28 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id A6626424; Tue, 4 Aug 2026 19:26:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785871591; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bXadFxbNPeUF1U0eYN9ts7zWvNYvwxNB1dgDghPB4oc=; b=OnamBx/tLYMzIFcrFJ2BEdHp70Cqsyo2KpumdS1O/UgqXWcwbIiDTD0C38DltzjYab//le PzxQB82w9QBSDY6v3CwQjpmsssDCh52Kr4FuyyZLatDteCo6t0a6yBKLEQj83ipOYO3Zzk 6JLV1jc4kphIv+PpKPCFhl6tfwkb1RU= X-MC-Unique: sfh2VBYmON-4ksDE6Y1IzA-1 X-Mimecast-MFC-AGG-ID: sfh2VBYmON-4ksDE6Y1IzA_1785871589 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Tue, 04 Aug 2026 23:21:49 +0400 Subject: [GIT PULL v2 2/9] hw/display/vga: fix panning_buf OOB after text/graphics switch MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260804-fix-v2-2-70e8fe489c9e@redhat.com> References: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> In-Reply-To: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> To: qemu-devel@nongnu.org Cc: stefanha@redhat.com, Gerd Hoffmann X-Developer-Signature: v=1; a=openpgp-sha256; l=2761; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=E7/JuJnX61sx5FrqxASrVT+wu20t+91TLiJoppvHx8w=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcjzTrUxvQztNJk8Fv2ytdDcM2VhsrL/qEqM9A Yy8DiayNQiJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanI80wAKCRDa6OEJdZac 5YJFD/4jRYlJCRp3Clw+CSACTpnZSDdnube3K4/w232+Lz5E2TrqpLw18gv5MK/UFX6Lv0V7fWv rlLvPqI1PBZjmwS4hxCufhveVxnZYj2jYXZkBuTTZKSqaFg3JKe3MZgnRy2rTcLAlJn9kRvnBzl DAMdWTsf6jCDlDu3Twh4s9ZY1httRojlu/O7bdAg6VfvAKL8KlUSzOsv2oWvhpEYNPApkZoNjFZ l7WF1Mk87k6QwQpfrI1ETe6Hv3V0w7DIB8hE63u2vvDMZIeZZQ/botLhbckLCGxxRQTALBTEQG4 /okYa5D9WqG7Eg172Y20jBjXB2nQfYSTQR6wfRX16ADydjffuYSgV9a9e2l398/welWt8ILd2M5 WmHesCQjfWYUw4LKXNBsNDjXkFdve8fbkmCOCNvUqMgOuCyXIb0cyucx2ELIyojcZuO93/eVP5o aTlFYYhVhgc/ZjOy36j8imhYXgU5adnKkC/FML0Zc3WtrjeoXNHk4RHFVjDLog1kdzeElb2NMh+ LH3YewZ/5vrNUBFN8mA/lYX3udVyb2Lkz1HOq6Xl96sBiYkV5xE2NAeFeL4iIu1epdp3ZXDso+Y NCWSiL1FYjebKV1nkDoRNrVtN89inzSRC9Eq1f9slguPMmUP1Mvm6UI6yySld32K013Nr/mwfwS BEm0i278gBW/tYw== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.795, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785871622312158500 The fields last_width and last_height serve two purposes: the text renderer counts in characters, the graphics renderer in pixels. panning_buf reallocation is guarded by geometry-change check, so the unit mismatch can trick it into thinking nothing changed when the resolution actually grew. A guest can trigger this by switching graphics -> text -> graphics: 1. Enter graphics mode with a small width (CR01=3D0x00, 8 pixels). The predicate fires and panning_buf is allocated for that width. 2. Switch to text mode with a large width (CR01=3D0xFF, 256 chars). The text renderer stores 256 into last_width. The text path never touches panning_buf. 3. Switch back to graphics with a width that happens to equal 256 in pixels (CR01=3D0x1F, 32*8 =3D 256). The predicate sees 256 =3D=3D 256 and skips the realloc. With horizontal pel panning enabled, vga_draw_line4() then writes a full 256-pixel scanline into the buffer still sized for 8 pixels -- a 960-byte heap overflow on every scanline, every refresh. Fix it by reallocating unconditionally panning_buf on vga_draw_graphic(). Fixes: CVE-2026-17516 Fixes: 973a724eb006 ("vga: implement horizontal pel panning in graphics mod= es") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4085 Cc: Paolo Bonzini Signed-off-by: Warisjeet Singh [ Marc- Andr=C3=A9 - drop realloc() resize condition & commit message ] Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau Message-ID: <20260728151456.3704099-1-marcandre.lureau@redhat.com> --- hw/display/vga.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/hw/display/vga.c b/hw/display/vga.c index abe3f8e07758..da0c331486eb 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1647,11 +1647,12 @@ static void vga_draw_graphic(VGACommonState *s, int= full_update) s->last_line_offset =3D s->params.line_offset; s->last_depth =3D depth; s->last_byteswap =3D byteswap; - /* 16 extra pixels are needed for double-width planar modes. */ - s->panning_buf =3D g_realloc(s->panning_buf, - (disp_width + 16) * sizeof(uint32_t)); full_update =3D 1; } + + /* 16 extra pixels are needed for double-width planar modes. */ + s->panning_buf =3D g_realloc(s->panning_buf, + (disp_width + 16) * sizeof(uint32_t)); if (surface_data(surface) !=3D s->vram_ptr + (s->params.start_addr * 4) && !surface_is_allocated(surface)) { /* base address changed (page flip) -> shared display surfaces --=20 2.55.0 From nobody Tue Aug 25 00:11:12 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785871625; cv=none; d=zohomail.com; s=zohoarc; b=UtBupkHYJgAzhnPnBeTqv5qqIdVeg0Fp4EQFr3ftSNiQYi6leGQrfYCeQ0dma8QVBSPP1/xkn8OaYGete73TqKytrazAhL0pun1aeWutkwEXGFISwBTivx4+9aGGp63KInBuyBemmiaQoRzcwAXqHryhgyxdWSHKRkJQ1tG/FY8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785871625; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=t13M/Czg5AHMi5OAxhOkC6Djts0zl5Cej5RLjx8EdFY=; b=BVOPPHtZ/LI2hlJY8tMG4Aurrqlxjv76wHYDGKuVTOD/Oo/9/ANvs3LD5s6pYpUYclglsqouNJKCEsolkcbKdcQ/P8hjQ2T5a5zNM2ozkFCgLgMJn0t2COxloeV11X3dC4OQAzTYrknzB8ma94cnxeDNOCIG+HtTCgrYkutmm0I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785871625848830.5773346739936; Tue, 4 Aug 2026 12:27:05 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wrKme-0007BS-KO; Tue, 04 Aug 2026 15:26:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKmd-0007B5-Fa for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:26:39 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKmb-00058V-Q9 for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:26:39 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-103-Aw-uI9aqOi2aEp9hvzMTZA-1; Tue, 04 Aug 2026 15:26:35 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id CDA8D180035C for ; Tue, 4 Aug 2026 19:26:34 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 3D60118004AD; Tue, 4 Aug 2026 19:26:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785871597; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=t13M/Czg5AHMi5OAxhOkC6Djts0zl5Cej5RLjx8EdFY=; b=Ky/oOjfnaaZ+0+zL8xelr2LLFP+66I5Vqy7TSGTMrKVXarseBVWmBYgNhuKijIz3a7upNR sUCniWLuNOeH4cj26jqdVvlwCn+BIsxpRwQJHHqfrS6J9A3wzu7eQBqPDE2eR+L1sshAbn bROZm+Pf8L5VrGNIkTDV6PO307JKiDI= X-MC-Unique: Aw-uI9aqOi2aEp9hvzMTZA-1 X-Mimecast-MFC-AGG-ID: Aw-uI9aqOi2aEp9hvzMTZA_1785871595 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Tue, 04 Aug 2026 23:21:50 +0400 Subject: [GIT PULL v2 3/9] vhost-user-gpu: fix integer overflow in buffer allocation MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260804-fix-v2-3-70e8fe489c9e@redhat.com> References: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> In-Reply-To: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> To: qemu-devel@nongnu.org Cc: stefanha@redhat.com, "Michael S. Tsirkin" , Stefano Garzarella , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Developer-Signature: v=1; a=openpgp-sha256; l=3614; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=uJQIwrzvbpkpuaroaHRi5aMKPCT+/mMRyL4Qh11QYyg=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcjzTek4vmIbEATzR/eV07lzJn5bMAoITPJe91 mf/rx05C9OJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanI80wAKCRDa6OEJdZac 5eVAD/9x1shHXGDHCdNsMaY4ez0E8mOqIXnVBwvRfIEQQGeTicLICNkQOUjziwQBZlaqWUXP1IK u8S4xTUVME3irDMcgvkmSm4VfSkWSIISSXII2PaIZECKcxTBxlzWwT+pLfVY3b52tJj3keEbg0f ky9Zccz0gqFd2h5Pj+BggMibJ7BuXld5XkAs6fjD+cwRAj/uUhgfubplUiM5dmvQ+MFsyhRa4Td m/YRvoDlnDD2kJ/X+zSC0VQmJTuGBzLOuyfIfc2RGCpc2Py+NJPFxXvvuhNwH8N/NhCwvPz20vd xsGTCizTlT6r8fpor0l9hJ8dXefjQF338MVl1EkMEFmG6UZoKa2y+dOE9ry8UTf6UMGi3uBxpB+ /HMEnwABgotZvU4lqfGXYLqf79dttnRJ2zDq8hZ2hoMMUgl7jdhJ3Ey/XGnc34VSfTz04G5zoV5 JEoMCEA+WbLcPjigXixBuN92cC9Von6HqJJQU4k21Wz/GerXTaPbZIcWTSPCGwNwtGqNxqwZA0a niJfCx97owJ/RCvDwf6S4s4KUJOoL84yagqiUCohq5/SDQ8t4XKisvBwxZVo2/e9AY2Dwigj82n 8jfpMTcTff3dXx6YgU4oTxZq9pUSOB2PkEB8fJ/4ajjdnb41mu/MDAGHVge/xzJg+tlZaLaI2jR AjNwWURbawaIabQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -28 X-Spam_score: -2.9 X-Spam_bar: -- X-Spam_report: (-2.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.795, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785871628045158500 A malicious guest can trigger a heap buffer overflow in the vhost-user-gpu backend by sending a VIRTIO_GPU_CMD_RESOURCE_CREATE_2D with large width and height values (e.g. 65537x65537). The allocation size width * height * 4 silently wraps in uint32_t arithmetic, resulting in a much smaller allocation than expected. Subsequent VIRTIO_GPU_CMD_TRANSFER_TO_HOST_2D writes past the heap buffer. The in-tree virtio-gpu device (hw/display/virtio-gpu.c) already handles this via calc_image_hostmem() with uint64_t arithmetic and an overflow check. Apply the same approach to the vhost-user-gpu contrib backend: - Add an overflow check in vugbm_buffer_create() rejecting dimensions where width * height * 4 exceeds UINT32_MAX - Promote the size arithmetic to uint64_t in mem_alloc_bo() and udmabuf_get_size() - Check the return value of vugbm_buffer_create() in vg_resource_create_2d(), which was previously ignored Fixes: CVE-2026-15264 Reported-by: "Vulnerability Report" Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3940 Signed-off-by: Marc-Andre Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 Message-ID: <20260710134720.2317856-1-marcandre.lureau@redhat.com> --- contrib/vhost-user-gpu/vhost-user-gpu.c | 8 +++++++- contrib/vhost-user-gpu/vugbm.c | 11 +++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/contrib/vhost-user-gpu/vhost-user-gpu.c b/contrib/vhost-user-g= pu/vhost-user-gpu.c index bb41758e3454..ee9858c397ce 100644 --- a/contrib/vhost-user-gpu/vhost-user-gpu.c +++ b/contrib/vhost-user-gpu/vhost-user-gpu.c @@ -388,7 +388,13 @@ vg_resource_create_2d(VuGpu *g, cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; return; } - vugbm_buffer_create(&res->buffer, &g->gdev, c2d.width, c2d.height); + if (!vugbm_buffer_create(&res->buffer, &g->gdev, c2d.width, c2d.height= )) { + g_critical("%s: buffer creation failed %d %d %d", + __func__, c2d.resource_id, c2d.width, c2d.height); + g_free(res); + cmd->error =3D VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY; + return; + } res->image =3D pixman_image_create_bits(pformat, c2d.width, c2d.height, diff --git a/contrib/vhost-user-gpu/vugbm.c b/contrib/vhost-user-gpu/vugbm.c index 503d0a4566f8..710d54529779 100644 --- a/contrib/vhost-user-gpu/vugbm.c +++ b/contrib/vhost-user-gpu/vugbm.c @@ -13,7 +13,7 @@ static bool mem_alloc_bo(struct vugbm_buffer *buf) { - buf->mmap =3D g_malloc(buf->width * buf->height * 4); + buf->mmap =3D g_malloc((uint64_t)buf->width * buf->height * 4); buf->stride =3D buf->width * 4; return true; } @@ -53,7 +53,8 @@ struct udmabuf_create { static size_t udmabuf_get_size(struct vugbm_buffer *buf) { - return ROUND_UP(buf->width * buf->height * 4, qemu_real_host_page_size= ()); + return ROUND_UP((uint64_t)buf->width * buf->height * 4, + qemu_real_host_page_size()); } =20 static bool @@ -293,6 +294,12 @@ bool vugbm_buffer_create(struct vugbm_buffer *buffer, struct vugbm_device *dev, uint32_t width, uint32_t height) { + uint64_t size =3D (uint64_t)width * height * 4; + if (size > UINT32_MAX) { + g_warning("buffer dimensions too large: %ux%u", width, height); + return false; + } + buffer->dev =3D dev; buffer->width =3D width; buffer->height =3D height; --=20 2.55.0 From nobody Tue Aug 25 00:11:12 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785871620; cv=none; d=zohomail.com; s=zohoarc; b=d/kvpWytM8NnQPjwnDnShwMuFwfUUoghvTdMcN1qBXKqTL3iCXjgkESz1rsf7J4Du72UB1rpc3Hro5hSq5+j+K9zdF+gqd0fllhPDKNKu2i72Nmr/NM9HvECjkFnPRZyTU032pzAN5Xs2qf4khWnpWjdZUNhsR9mr6RXrR8zX0k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785871620; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JBuZeH/hyIo3fbh1PQfwbL8P51yWnlk8B0Vwt9xpvUY=; b=kVP6PazYO1lAiHN6EYj24E6ka5zngmCcsY3R73FrQqGxVEvcPwZxKT5ixcooAEEOazgmUr3QCDWEuBhmGmpdexWN4xvtO1FcBVno3PVKqPmlqzCZ+Cd0DoX1/HWGXXPvVAJ5HXnUl0p9+UaYJbjgtpM2eUmS/ecS2uMmLwfxFjw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785871620303499.8676750280273; Tue, 4 Aug 2026 12:27:00 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wrKmk-0007CA-9H; Tue, 04 Aug 2026 15:26:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKmj-0007C2-Ay for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:26:45 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKmh-00059d-Nz for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:26:45 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-640-GiRBMkbbNxmgBFjyxatTPQ-1; Tue, 04 Aug 2026 15:26:41 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1AED91956069; Tue, 4 Aug 2026 19:26:40 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id A9D5130001A4; Tue, 4 Aug 2026 19:26:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785871602; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JBuZeH/hyIo3fbh1PQfwbL8P51yWnlk8B0Vwt9xpvUY=; b=Wc4k592nHl0nleoT0AvvElMDeMWySidMzaQQvNbH0KN0rnDN2Dm0+RvCFFLnz2oYFu9yle caBUOHqiQVeUgd0yQu5G5Hebuf29HdSz+3/kXkJkQpntaaPNEpY/EF0SWQ3BJTyV60XHoN hnZxtZjtm8sfY9ietaSidq7Bq8fXFBE= X-MC-Unique: GiRBMkbbNxmgBFjyxatTPQ-1 X-Mimecast-MFC-AGG-ID: GiRBMkbbNxmgBFjyxatTPQ_1785871600 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Tue, 04 Aug 2026 23:21:51 +0400 Subject: [GIT PULL v2 4/9] hw/display/virtio-gpu: fix offset wraparound in scanout_blob_to_fb MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260804-fix-v2-4-70e8fe489c9e@redhat.com> References: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> In-Reply-To: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> To: qemu-devel@nongnu.org Cc: stefanha@redhat.com, "Michael S. Tsirkin" , =?utf-8?q?Alex_Benn=C3=A9e?= , Akihiko Odaki , Dmitry Osipenko X-Developer-Signature: v=1; a=openpgp-sha256; l=2466; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=FfMPC0vcyAbfCBx4BJKAkGllsY7YFmvTU8YJxb5Uii8=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcjzUh8lofjE6WNnOeaQWHxiFv6J51SI4Q+qdj hRzR467FpuJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanI81AAKCRDa6OEJdZac 5ZxNEACbAeclCDWq0lgJez8AIJ9JBhmDGnxtwBYt+1nkjRpZgzb62YOaSEwtohoL2OTnoIw5zXF AxpauUrKAUNM8Z3Zzkd/Iyy/y8cCjeMtAAzNl2rCbkU0PZVFr6e52Cn/5SAOwT/IYr/PAc1qqz0 PgXMswKa4OD44+BfUw8XgOl7norvF2BxU1eckZdjaZArGnpTgCyNEVW3Znh84gUtOa9uTwugXFO izd5Kvejp7FVcQVb+dfqR8F7yQC2gdvF95lku9rSumY410/FYZJslqzdjowwVTmKdTSvPLBMSDQ bn95SyyaiAoYFBQd3l+FE/Og5YaKe1TQ3DMME49nkKG7VWy9dQ+dX/OTmYgUl65IulUJMhX5ojJ QNlY9a23bdyBaRItFYVaM44LDcvLbmHagUdWHVtCsOpSZFFd5oS7mIs8w3fKfomhZk15p8FFxzD zoJdlaPwwvmAKBiDDK61IbFhERLyMPup9mOZZdcIe+cgDWHEmspfLhtrL91y0CMsGyxOf78Zg+M /l+Juy1c0RDQv6eyXmdMkfieYxAIB0jHcGPa8kM2cbWe4RskiXLZ5GTURQ35oPy8e53egXOAvjx E6PLTv8OUpRK4FwAGhI04gVNEVZIfr2hy+01ORik58fhI1KFJFdHpg6ee+RkVhXn004gkHpdh/M NGnXo7ODaxY8TEQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.795, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785871623445158500 virtio_gpu_scanout_blob_to_fb() computes the framebuffer offset from guest-controlled offsets[0], r.x, r.y and stride using uint32_t arithmetic. When the sum exceeds UINT32_MAX, silent wraparound lets the guest steer the scanout to an arbitrary in-bounds region of the blob instead of the intended rectangle. Compute the offset in uint64_t, reject values exceeding UINT32_MAX (the width of fb->offset), and only store into fb->offset once both range checks pass. ("[PATCH] hw/display/virtio-gpu: Remove the bytes_pp field") Fixes: 32db3c63ae11 ("virtio-gpu: Add virtio_gpu_set_scanout_blob") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3871 Based-on: <20260719-bpp-v1-1-9b91946d6cf3@rsg.ci.i.u-tokyo.ac.jp> Reported-by: Cyber_black Reviewed-by: Akihiko Odaki Signed-off-by: Marc-Andr=C3=A9 Lureau Message-ID: <20260725122734.1775774-1-marcandre.lureau@redhat.com> --- hw/display/virtio-gpu.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 0206910cc377..51592b49c21e 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -777,7 +777,7 @@ bool virtio_gpu_scanout_blob_to_fb(struct virtio_gpu_fr= amebuffer *fb, struct virtio_gpu_set_scanout_blob *ss, uint64_t blob_size) { - uint64_t fbend; + uint64_t fbend, offset; uint32_t bytes_pp; =20 fb->format =3D virtio_gpu_get_pixman_format(ss->format); @@ -807,18 +807,20 @@ bool virtio_gpu_scanout_blob_to_fb(struct virtio_gpu_= framebuffer *fb, return false; } =20 - fb->offset =3D ss->offsets[0] + ss->r.x * bytes_pp + ss->r.y * fb->str= ide; + offset =3D (uint64_t)ss->offsets[0] + (uint64_t)ss->r.x * bytes_pp + + (uint64_t)ss->r.y * fb->stride; =20 - fbend =3D fb->offset; - fbend +=3D (uint64_t) fb->stride * ss->r.height; + fbend =3D offset + (uint64_t)fb->stride * ss->r.height; =20 - if (fbend > blob_size) { + if (offset > UINT32_MAX || fbend > blob_size) { qemu_log_mask(LOG_GUEST_ERROR, - "%s: fb end out of range\n", + "%s: invalid fb bounds\n", __func__); return false; } =20 + fb->offset =3D offset; + return true; } =20 --=20 2.55.0 From nobody Tue Aug 25 00:11:12 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785871685; cv=none; d=zohomail.com; s=zohoarc; b=IrUEdOD2CGYa71veT8rUOjKn89jAM6x+HMAw0Jz31CmMH0I3eMHJmI2PHhIujUhWb4GXJFVRFb2wxUyXSM9oyKxZTjSgV8pe0c0DuJuRbXW5CTd/Hv76VlPD9kHkcowQGL1DFz9xrZlk99PALi9BFqbe63pKfFeFGoZunqA4uLY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785871685; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/YLITtyQZk/29n/Ki+VXTGedtcpRCCASc2TUbUo+E6I=; b=gEm9VN96+OtxK8A/fjagWFldUTMO6pyb0UufTM0bQ/n6Jqq4zp4ut8tpTOz4aSVPpqZS5xgL777ioS0GCqa2gmGzO3ph8zEcNUwGiTMlqsT1R3FM/5aXyWJxaRCwl4nFj31RdUo4mE314j9Of2c64lfwVy9cOh9alVlKhwaZCB8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17858716855551008.2443421442977; Tue, 4 Aug 2026 12:28:05 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wrKmt-0007DB-3w; Tue, 04 Aug 2026 15:26:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKmr-0007Cn-51 for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:26:53 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKmp-0005BF-Px for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:26:52 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-398-E8pNb1lJOBu6hu1nJpfyIg-1; Tue, 04 Aug 2026 15:26:48 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D1836195604F; Tue, 4 Aug 2026 19:26:45 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1B0C71800480; Tue, 4 Aug 2026 19:26:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785871611; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/YLITtyQZk/29n/Ki+VXTGedtcpRCCASc2TUbUo+E6I=; b=M/t0QtBBISSge18zvaovZ7UzHLYIncMMQcyIC1d7LPhW27z4q8MJ0fbB3bDn4SNovoncwh H2iGrDABWw1MOonVBSZ+FG7gWRODbjZreZrxQnW97XhIo0k91W8W+J2qJ4FSAjwQInVZXi L/yhATtcPJ39wbNxPGx4MjqDqubseRc= X-MC-Unique: E8pNb1lJOBu6hu1nJpfyIg-1 X-Mimecast-MFC-AGG-ID: E8pNb1lJOBu6hu1nJpfyIg_1785871606 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Tue, 04 Aug 2026 23:21:52 +0400 Subject: [GIT PULL v2 5/9] hw/display/virtio-gpu: drop redundant node->value NULL checks MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260804-fix-v2-5-70e8fe489c9e@redhat.com> References: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> In-Reply-To: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> To: qemu-devel@nongnu.org Cc: stefanha@redhat.com, =?utf-8?q?Alex_Benn=C3=A9e?= , Akihiko Odaki , Dmitry Osipenko , "Michael S. Tsirkin" X-Developer-Signature: v=1; a=openpgp-sha256; l=1790; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=sjywyeADAIGro/JFp1dJCBH1U0aQQKbRC3WkRHfn7go=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcjzU8/YFVMzcaA0yc9afdkP85xYlBEsw01SOC qtfVxGOERGJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanI81AAKCRDa6OEJdZac 5RqQD/9ZReOeQKPkmXcC1KOTOJXBMrkg4/OzkkI4jEvyGWZGfzfFstlcysjxbQxIsgq8oiw6j10 WUC/POekaMXDnQK411HyXT2v/cR+TXNgb0Tlmok+cqzd55YG+UunQVpYHxE8fyPFQ3K3ErqdDx2 chDAbtkPvOVJZeCOPQR+4LaOxKNJUsKNG7+0SkBi0sNBwZs7pwiudD2HjuvU3tK//xXp4kVK/0p CzS4CnYr1Za+wA1F4YfUg4n6ORoq/TQSNmbgBgRkQekVlGglQ1Iv+Y25I6pp3Qv0hujqYoX4k+g 5szv1UM3t2wpeQA5e4vHEYYpOUqhLVb0MHmWUHHYxRjcobyuklSd3dFjqLKUgEtO8n8QRmIB54e HdQHzXSO3JL0vqx0MZmrnuNFz/uXeGD0WXeq1WWbxaeeUACUEvZRBGtxtlXQvsc7M9bnWO3nibl aIc+E4UxCYdxzoG0ZgIQKrYVoX34HVGcM4hcBXLTxbVYo1WcO6RpH5utKVpLI4yOFAxELUwLHF7 55KNFSwdMdOJKMgkuT/pWbaPGb9Fcsc1shall8YF9russm+a7xjVQZUixvA/ONbxZcXNKCQHrZ+ f1Y3KQACfNDdWkTri+khQqMmzYzwym1Y0ICs2DC+1idn+IoxNcV4E0mxPh7nPa9KFUEG4Tged/A 7AhFBYW//swUFkw== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.795, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785871686796158500 QAPI-generated list visitors guarantee that node->value is never NULL: the input visitor allocates it via g_malloc0() in visit_start_struct(), and on failure the entire list parse is aborted and freed. Remove the unnecessary NULL checks from both callsites iterating g->conf.outputs. Resolves: Coverity CID 1664272 Fixes: 8dc8449a678f ("hw/display/virtio-gpu: Avoid leaking migration blocke= r") Reviewed-by: Akihiko Odaki Signed-off-by: Marc-Andr=C3=A9 Lureau Message-ID: <20260730114751.3515083-1-marcandre.lureau@redhat.com> --- hw/display/virtio-gpu-base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/display/virtio-gpu-base.c b/hw/display/virtio-gpu-base.c index 946e56b42f61..270fbaae1029 100644 --- a/hw/display/virtio-gpu-base.c +++ b/hw/display/virtio-gpu-base.c @@ -69,7 +69,7 @@ virtio_gpu_base_generate_edid(VirtIOGPUBase *g, int scano= ut, =20 for (output_idx =3D 0, node =3D g->conf.outputs; output_idx <=3D scanout && node; output_idx++, node =3D node->nex= t) { - if (output_idx =3D=3D scanout && node->value && node->value->name)= { + if (output_idx =3D=3D scanout && node->value->name) { info.name =3D node->value->name; break; } @@ -206,7 +206,7 @@ virtio_gpu_base_device_realize(DeviceState *qdev, error_setg(errp, "invalid outputs > %d", g->conf.max_outputs); return false; } - if (node->value && node->value->name && + if (node->value->name && strlen(node->value->name) > EDID_NAME_MAX_LENGTH) { error_setg(errp, "invalid output name '%s' > %d", node->value->name, EDID_NAME_MAX_LENGTH); --=20 2.55.0 From nobody Tue Aug 25 00:11:12 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785871685; cv=none; d=zohomail.com; s=zohoarc; b=n3h9vPY25mukC3QNUpA2OAYOFKpJ+w8lMi6YBVfZ6o/382pTalzC1DMcethEALEtYqIMdkk5o9GQBFVOYftJeMc6N5Q+z3pFrEfT2Sc5iZahbhB/scSNQibcppMfi0pKvxMgIKZNl4LOarYxXGUhpZ+AdyN6RVK2Bp0DcIk3rpA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785871685; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wNWmILZwFWSVOBT+K3q1P++MAHNFRvmHfS+/HStvrNI=; b=b88iJPqyNPK0XfR13Qs8P3O28166/teR1LQTyc0OKPiSP/v9CD6GTxyLVBFl1CMTC8KVYFtdLKlyx18Lkxaq1zBXr9MHSj2pVU2Wl+UztZuZa0gtsmbZgt7hkdjtP3rnbRXDDfpyvWqcKTXp2x2ezN0kWci/51XueCAJm/NVAnw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785871685669979.9789104189529; Tue, 4 Aug 2026 12:28:05 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wrKnK-0007jb-5H; Tue, 04 Aug 2026 15:27:22 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKnB-0007Zi-FA for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:27:14 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKn9-0005E8-Mx for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:27:13 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-408-KsC5UmLBP0CactbRIayPNw-1; Tue, 04 Aug 2026 15:26:52 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id F028318002E6; Tue, 4 Aug 2026 19:26:50 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id D0C3830001B9; Tue, 4 Aug 2026 19:26:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785871631; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wNWmILZwFWSVOBT+K3q1P++MAHNFRvmHfS+/HStvrNI=; b=btWmnD76AfUcc5xMNiXP7IeuDEF0hxZhFepOY3T8r49xQ6Ao08qjhLqJLNQVsh4lbgoNlV vc8AimTzMpxcAI3E8yZC3Sx1XxV83pL8EYlgnqA2kvg4px75BQAX6qSE2KgpsuvUUjAeKV 3dj1iYhx3Vi4OaSRtVvbuabtA3S81/k= X-MC-Unique: KsC5UmLBP0CactbRIayPNw-1 X-Mimecast-MFC-AGG-ID: KsC5UmLBP0CactbRIayPNw_1785871611 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Tue, 04 Aug 2026 23:21:53 +0400 Subject: [GIT PULL v2 6/9] virtio-gpu: reject requests with short/truncated control headers MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260804-fix-v2-6-70e8fe489c9e@redhat.com> References: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> In-Reply-To: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> To: qemu-devel@nongnu.org Cc: stefanha@redhat.com, "Michael S. Tsirkin" , Stefano Garzarella , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , =?utf-8?q?Alex_Benn=C3=A9e?= , Akihiko Odaki , Dmitry Osipenko X-Developer-Signature: v=1; a=openpgp-sha256; l=4438; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=Jvo9QYSq6zsmJiKDJ8EM3lJlgrmnG9EU88vt9eYApWc=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcjzUSzRdq2xcbpcFflA5eI9OK84C3Gz0Z/w+v dFZ+gDQvHSJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanI81AAKCRDa6OEJdZac 5fYoD/9E9Zu553vTJ6AtlekbQ2q1fZz/bMlJ/bap3e/M0u/Fc6JGIltjqcLzSOFQD1UsXhD0E5Z v5BWAdsrEm7HozPfKOFrcO/An+25NooUputFjL/onmoJCnRIT3/4CEOtkFtLXksIcjrbUyu+8Cf qnozHwPaItuqqhbcXLFhFnawF/MsUJ/AFtENcgstp7LnnRhsokAO1kyNx3sQH/RIhkmyuSP2tqe MqARGMtw1BKDGZxYX9ceLyCqAMUxK7pIVdU7GpLZWl6paEPqOQZSubbJMPkfBuXhIo8OMe8Em9Z S86ffE0CqA9PWbFw3OehIH9Qmmtcxj8uy2SNkVWcgduNi/gsqCsBC7j7I4CrXlmQ80uP+MPkMU9 kSw0+6aNRpSXGY1oFKnIs+kjYOU357FMinznBXHZarBWu1U9MDcGYU9S+QyxVildtw/8lj9by6r VaBNvYrA1Azan/rdLd0DcRz/GNayUuy+unvRwyvsfJqG6ETqBErF5NdHKWA3eq1qsko5n3ORoWa es8iBLtCRhphA8YEuAXPYS8Brhr2NTzwxw+ymlcKIEwyuQYdDbPKSumlobUSn9dcbcE1w1h7iK/ 3gvxTWy52QrWve6M1y1b2zEJTP8w++CreOiJZnZtOXq5vAB4U/5PFreEKB9FrmikRUte5KrZrOz kDW09ELB8MyWWVA== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -28 X-Spam_score: -2.9 X-Spam_bar: -- X-Spam_report: (-2.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.795, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785871686816158500 From: Ankur Saini A short control request can leave command data partially initialized. For the common header, guest-controlled flags can then cause stale fence metadata to be returned to the guest. The command fill helpers detect a short copy but only log and return. For the common header this leaves the request without any completion; for type-specific commands the caller still completes the request but reports VIRTIO_GPU_RESP_OK_NODATA, masking the error. Make VIRTIO_GPU_FILL_CMD() clear the partially copied object and complete the request with ERR_INVALID_PARAMETER. Make VUGPU_FILL_CMD() report the same error through the existing vhost-user-gpu dispatcher. This also rejects truncated type-specific commands. The vhost-user-gpu common header is copied outside VUGPU_FILL_CMD(), so clear it and complete the request directly when that copy is short. Fixes: CVE-2026-18054 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4094 Reported-by: Ankur Saini Suggested-by: Akihiko Odaki Signed-off-by: Ankur Saini Reviewed-by: Akihiko Odaki Reviewed-by: Marc-Andr=C3=A9 Lureau Message-ID: <20260803-virtio-gpu-short-header-v3-1-936c1daa8e61@gmail.com> --- contrib/vhost-user-gpu/vugpu.h | 1 + include/hw/virtio/virtio-gpu.h | 3 +++ contrib/vhost-user-gpu/vhost-user-gpu.c | 21 ++++++++++++--------- 3 files changed, 16 insertions(+), 9 deletions(-) diff --git a/contrib/vhost-user-gpu/vugpu.h b/contrib/vhost-user-gpu/vugpu.h index 2374eb90cb9b..aaf2870cb24d 100644 --- a/contrib/vhost-user-gpu/vugpu.h +++ b/contrib/vhost-user-gpu/vugpu.h @@ -179,6 +179,7 @@ struct virtio_gpu_ctrl_command { if (vugpufillcmd_s_ !=3D sizeof(out)) { \ g_critical("%s: command size incorrect %zu vs %zu", \ __func__, vugpufillcmd_s_, sizeof(out)); \ + cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; \ return; \ } \ } while (0) diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h index 2f60c72078b3..f965defa6b25 100644 --- a/include/hw/virtio/virtio-gpu.h +++ b/include/hw/virtio/virtio-gpu.h @@ -315,6 +315,9 @@ struct VirtIOGPURutabaga { qemu_log_mask(LOG_GUEST_ERROR, \ "%s: command size incorrect %zu vs %zu\n", \ __func__, virtiogpufillcmd_s_, sizeof(out)); \ + memset(&out, 0, sizeof(out)); \ + virtio_gpu_ctrl_response_nodata( \ + g, cmd, VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER); \ return; \ } \ } while (0) diff --git a/contrib/vhost-user-gpu/vhost-user-gpu.c b/contrib/vhost-user-g= pu/vhost-user-gpu.c index ee9858c397ce..786488150932 100644 --- a/contrib/vhost-user-gpu/vhost-user-gpu.c +++ b/contrib/vhost-user-gpu/vhost-user-gpu.c @@ -930,16 +930,19 @@ vg_handle_ctrl(VuDev *dev, int qidx) if (len !=3D sizeof(cmd->cmd_hdr)) { g_warning("%s: command size incorrect %zu vs %zu\n", __func__, len, sizeof(cmd->cmd_hdr)); - } - - virtio_gpu_ctrl_hdr_bswap(&cmd->cmd_hdr); - g_debug("%d %s\n", cmd->cmd_hdr.type, - vg_cmd_to_string(cmd->cmd_hdr.type)); - - if (vg->virgl) { - vg_virgl_process_cmd(vg, cmd); + memset(&cmd->cmd_hdr, 0, sizeof(cmd->cmd_hdr)); + vg_ctrl_response_nodata( + vg, cmd, VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER); } else { - vg_process_cmd(vg, cmd); + virtio_gpu_ctrl_hdr_bswap(&cmd->cmd_hdr); + g_debug("%d %s\n", cmd->cmd_hdr.type, + vg_cmd_to_string(cmd->cmd_hdr.type)); + + if (vg->virgl) { + vg_virgl_process_cmd(vg, cmd); + } else { + vg_process_cmd(vg, cmd); + } } =20 if (cmd->state !=3D VG_CMD_STATE_FINISHED) { --=20 2.55.0 From nobody Tue Aug 25 00:11:12 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785871697; cv=none; d=zohomail.com; s=zohoarc; b=PB9EZ1MT0V6unbAZts9gO1uNwpCQVOMhGX0WDQfOQs6i2PMQL2J6oReldIbxviWg51CP4fHfnqJl6v7uex4pmk4zsNLRsHn72abBtl9KgmVTIC2dxYifipuF7RTROwDTgc+2KU4dC8wmz4KRopVV/9b8Ug/E4rFe8Af7rGjsUPk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785871697; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=aULtpVcVtyCMV62+QOgZRcxVB09PF0BdgKmsWwfe87k=; b=leIn2XMgJqgquTqFxe2iAC1NO8LXrZPCpPlDot85MYMk3nfNWVX8U3UabuxCy+10jtEyKOAHq6w7v2X4XDE1sNdhj1y00MdOdftevTHdlQ+gTz/i9gMYmXyLndt/15A+A16/q4hkYB5hYof4QqHe3pOkJRyguh3hs1m0yztKlH8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785871697506823.078557865366; Tue, 4 Aug 2026 12:28:17 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wrKn2-0007Oz-W9; Tue, 04 Aug 2026 15:27:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKn1-0007OF-HD for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:27:03 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKmz-0005Cd-QC for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:27:03 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-180-udWmfHzmOv2CzEqFc-gymg-1; Tue, 04 Aug 2026 15:26:57 -0400 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 477181956050; Tue, 4 Aug 2026 19:26:56 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id D12A8180044F; Tue, 4 Aug 2026 19:26:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785871621; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aULtpVcVtyCMV62+QOgZRcxVB09PF0BdgKmsWwfe87k=; b=PObb58lvyhWABZKGv93cZIHXksBwsNSIigWFLLNOsOd46rai894UnX7V757boqq1reb1KT B1XhKRLNtZ3e1aaCLxAMTw5RUi1uiO1QEqw+F87HcL4ELtafO1TEkGqfsES6zrOw2yUvM5 pBQchVV6qncLJzPjeR9parqA93dxXoE= X-MC-Unique: udWmfHzmOv2CzEqFc-gymg-1 X-Mimecast-MFC-AGG-ID: udWmfHzmOv2CzEqFc-gymg_1785871616 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Tue, 04 Aug 2026 23:21:54 +0400 Subject: [GIT PULL v2 7/9] hw/display/virtio-gpu: Always reject invalid scanout bounds MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260804-fix-v2-7-70e8fe489c9e@redhat.com> References: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> In-Reply-To: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> To: qemu-devel@nongnu.org Cc: stefanha@redhat.com, =?utf-8?q?Alex_Benn=C3=A9e?= , Akihiko Odaki , Dmitry Osipenko , "Michael S. Tsirkin" X-Developer-Signature: v=1; a=openpgp-sha256; l=7071; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=lPEGPLPQO9o4Iq92ww7DSP/izILyow8FYE5uhd9yQZc=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcjzUIqDqLY40uS979+CYdcrX0QvxY6fMyf+iy 3X5FBYgOiqJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanI81AAKCRDa6OEJdZac 5WTdD/9SM9yHKtV5QlsYp/tblRA4hwpcBm1ySxc+F6HkgPsrWqU5x9yCwiYJ1VVg7eAXCWbnYPM PxAf4ukCc5XLOuwebVxvAT1wiF/gvlVY6en+9WL+vDePqmMhGhEsM141zWghw+q0kt9SaA0Q7F1 Wzght4MjdQxK7JjCLIaY+MGDRJrM6o99SQSlOHb4hs8dQzacIXPYqqLOp02XQlm3QZ1ea9QNXCd oUgM13qKwTzF0DS7+Z6Ab9GOmUf091IHqZl9Mvf20bTuYgfowzMdfx2wlxGPkHi3zScAq8OsQCu QSgWm0hp4+t+xOhNLztZEV+9gvfNGzRQH5rLv5LcnsVxuuVHpJQbDYz0e3ubEGyvxgdcgLjYL+f uBV0Tsx8i4b/UhfjzGMDELpJ4NMDkgtB+opWaWY6lv3x1XcWwEVO1FT228PUy96QVoZ0MONg60F tBw9ACe2QdCgFCWKEaPVZAfSNIfW/P0faPNVBf0YiaGCBRNAk2YRFhGkHcz+iJgLZOKOUHngAvB LeyuW6nCbIkVuNTjQcVDRElM6x8A+UHZpGAVKGCtyhZt3xCCtb0vK3hDUiANHxWHglNRMN867we B3OH2mmwoF/YPkY5ocZHEyFgWAmUqYOMrzdaoCt1xEV2+MlLA1bgpdxVR9klElQQCjgJqrrwx0q I7IuFu9UUwblj/Q== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.795, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785871698501158501 From: Akihiko Odaki virtio-gpu does not consistently check scanout bounds with wraparound handling. In the unchecked virgl SET_SCANOUT path, guest dimensions reach qemu_console_resize(), qemu_create_displaysurface(), and ultimately qemu_pixman_image_new_shareable(..., &error_abort), so an invalid rectangle can terminate QEMU. Implement a check with proper wraparound handling and apply it consistently. Fixes: 9d9e152136bd ("virtio-gpu: add 3d mode and virgl rendering support.") Fixes: 32db3c63ae11 ("virtio-gpu: Add virtio_gpu_set_scanout_blob") Fixes: 7c092f17ccee ("virtio-gpu: Handle resource blob commands") Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstre= am") Signed-off-by: Akihiko Odaki Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Marc-Andr=C3=A9 Lureau Message-ID: <20260803-scanout-v1-1-c9831dafdab2@rsg.ci.i.u-tokyo.ac.jp> --- include/hw/virtio/virtio-gpu.h | 5 +++++ hw/display/virtio-gpu-rutabaga.c | 6 ++++++ hw/display/virtio-gpu-virgl.c | 20 +++++++++----------- hw/display/virtio-gpu.c | 36 ++++++++++++++++++++++-------------- 4 files changed, 42 insertions(+), 25 deletions(-) diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h index f965defa6b25..220231ec9d43 100644 --- a/include/hw/virtio/virtio-gpu.h +++ b/include/hw/virtio/virtio-gpu.h @@ -366,6 +366,11 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g, struct virtio_gpu_scanout *s, uint32_t resource_id); =20 +bool virtio_gpu_check_scanout_bounds(uint32_t scanout_id, uint32_t resourc= e_id, + uint32_t width, uint32_t height, + const struct virtio_gpu_rect *r, + uint32_t *error); + /** * virtio_gpu_scanout_blob_to_fb() - fill out fb based on scanout data * fb: the frame-buffer descriptor to fill out diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutab= aga.c index e28aad94eead..a054f8117f14 100644 --- a/hw/display/virtio-gpu-rutabaga.c +++ b/hw/display/virtio-gpu-rutabaga.c @@ -315,6 +315,12 @@ rutabaga_cmd_set_scanout(VirtIOGPU *g, struct virtio_g= pu_ctrl_command *cmd) res =3D virtio_gpu_find_resource(g, ss.resource_id); CHECK(res, cmd); =20 + if (!virtio_gpu_check_scanout_bounds(ss.scanout_id, ss.resource_id, + res->width, res->height, &ss.r, + &cmd->error)) { + return; + } + if (!res->image) { pixman_format_code_t pformat; pformat =3D virtio_gpu_get_pixman_format(res->format); diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c index d9e5b0110497..6e298f997d66 100644 --- a/hw/display/virtio-gpu-virgl.c +++ b/hw/display/virtio-gpu-virgl.c @@ -560,7 +560,7 @@ static void virgl_cmd_set_scanout(VirtIOGPU *g, } g->parent_obj.enable =3D 1; =20 - if (ss.resource_id && ss.r.width && ss.r.height) { + if (ss.resource_id) { struct virgl_renderer_resource_info info; void *d3d_tex2d =3D NULL; =20 @@ -581,6 +581,11 @@ static void virgl_cmd_set_scanout(VirtIOGPU *g, cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; return; } + if (!virtio_gpu_check_scanout_bounds(ss.scanout_id, ss.resource_id, + info.width, info.height, &ss.= r, + &cmd->error)) { + return; + } qemu_console_resize(g->parent_obj.scanout[ss.scanout_id].con, ss.r.width, ss.r.height); virgl_renderer_force_ctx_0(); @@ -987,16 +992,9 @@ static void virgl_cmd_set_scanout_blob(VirtIOGPU *g, return; } =20 - if (ss.width < 16 || - ss.height < 16 || - ss.r.x + ss.r.width > ss.width || - ss.r.y + ss.r.height > ss.height) { - qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout %d bounds for" - " resource %d, rect (%d,%d)+%d,%d, fb %d %d\n", - __func__, ss.scanout_id, ss.resource_id, - ss.r.x, ss.r.y, ss.r.width, ss.r.height, - ss.width, ss.height); - cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; + if (!virtio_gpu_check_scanout_bounds(ss.scanout_id, ss.resource_id, + ss.width, ss.height, &ss.r, + &cmd->error)) { return; } =20 diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 51592b49c21e..c15d4b527d0e 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -633,6 +633,26 @@ static uint32_t virtio_gpu_format_bytes_pp(pixman_form= at_code_t format) return DIV_ROUND_UP(PIXMAN_FORMAT_BPP(format), 8); } =20 +bool virtio_gpu_check_scanout_bounds(uint32_t scanout_id, uint32_t resourc= e_id, + uint32_t width, uint32_t height, + const struct virtio_gpu_rect *r, + uint32_t *error) +{ + if (r->width < 16 || + r->height < 16 || + (uint64_t)r->x + r->width > width || + (uint64_t)r->y + r->height > height) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout %d bounds for" + " resource %d, fb %d %d, rect (%d,%d)+%d,%d\n", + __func__, scanout_id, resource_id, width, height, + r->x, r->y, r->width, r->height); + *error =3D VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; + return false; + } + + return true; +} + static bool virtio_gpu_do_set_scanout(VirtIOGPU *g, uint32_t scanout_id, struct virtio_gpu_framebuffer *fb, @@ -646,20 +666,8 @@ static bool virtio_gpu_do_set_scanout(VirtIOGPU *g, =20 scanout =3D &g->parent_obj.scanout[scanout_id]; =20 - if (r->x > fb->width || - r->y > fb->height || - r->width < 16 || - r->height < 16 || - r->width > fb->width || - r->height > fb->height || - r->x + r->width > fb->width || - r->y + r->height > fb->height) { - qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout %d bounds for" - " resource %d, rect (%d,%d)+%d,%d, fb %d %d\n", - __func__, scanout_id, res->resource_id, - r->x, r->y, r->width, r->height, - fb->width, fb->height); - *error =3D VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; + if (!virtio_gpu_check_scanout_bounds(scanout_id, res->resource_id, + fb->width, fb->height, r, error))= { return false; } =20 --=20 2.55.0 From nobody Tue Aug 25 00:11:12 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785871690; cv=none; d=zohomail.com; s=zohoarc; b=VS/tHWJWxPGvPC6PbsGvKFGi6KMPiu4pwa4VjQJ29GA4WeWL4mAS3md7JWuV0cCcfP2cHeheO7pqiMWH6I0L6vVsIRCtZZU774JTotE5SuCQl4MIz37eK1DLTAdL/h4ITtqelJ030WroMx2UGQGv/6OPgs5X4li6L24QA+FQ43E= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785871690; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=xLTgyxY9t4cPAN5vmpA9Vq9M1u5pAtCooxqyWOTxbao=; b=idZrGHuzu37m+lWVbBa9E+Gw1qJtFErHIrdovfNNzwvENkaMA0Sn3asSeAhS07nGxzuBIJ6qL+7xsMqcyMqfa7SmVoCURq/VlJKyqfyp3yAYajJ0UJI1MY053wIluuBdyvnJmkRFBvek66C7ttc193HxtyhY2kG9p7KCPn/Q4do= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785871690632572.6338713243242; Tue, 4 Aug 2026 12:28:10 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wrKn5-0007S0-W0; Tue, 04 Aug 2026 15:27:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKn4-0007Rh-RB for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:27:06 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKn3-0005DC-DA for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:27:06 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-437-A2ZBicCbO3SA7IeR12RGEg-1; Tue, 04 Aug 2026 15:27:03 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 9549B195605A; Tue, 4 Aug 2026 19:27:01 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 4ADC51800480; Tue, 4 Aug 2026 19:26:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785871624; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xLTgyxY9t4cPAN5vmpA9Vq9M1u5pAtCooxqyWOTxbao=; b=BZ7fjWGR0cwFZeR7bi8k3TjE4wM/HKb1VRMBnn0XhKdDdGp8mHD7jDBZ9J8007g7ZHIxtd keQ6AWS97+sEoi6VbuRntwx3v0vCEalNfdVktHdTDQIxX3ZKM8gj2WIUOD1wiVvl/Ut+Cz O+fsZpBSEydwrnvJEEEiGHFGVojVoiE= X-MC-Unique: A2ZBicCbO3SA7IeR12RGEg-1 X-Mimecast-MFC-AGG-ID: A2ZBicCbO3SA7IeR12RGEg_1785871621 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Tue, 04 Aug 2026 23:21:55 +0400 Subject: [GIT PULL v2 8/9] hw/display/virtio-gpu: Unmap DMA regions on reset MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260804-fix-v2-8-70e8fe489c9e@redhat.com> References: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> In-Reply-To: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> To: qemu-devel@nongnu.org Cc: stefanha@redhat.com, =?utf-8?q?Alex_Benn=C3=A9e?= , Akihiko Odaki , Dmitry Osipenko , "Michael S. Tsirkin" X-Developer-Signature: v=1; a=openpgp-sha256; l=1303; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=6pt76Ocwcwq2ZkN5Bq1JB7UBUtXQ0SHmKMc3+x+kQHk=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcjzU5SkQjwevxdQylNPx5QMdtgQj1u6XJ6DHq X5zSZPitaWJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanI81AAKCRDa6OEJdZac 5afUD/9FQ223J8O1WWGooXi68HMQH5jk/Sh7XGp6BipqNGpFxTOxtJ/Tz1MBfKVlx3o1sMqnzj4 8omGaUs27Vg0e1Ex3TAo3qXoLTeUItTtGH+5mr4Hzh252od6Deze0nkE7p2RTB48vbk6CtTwLvg FWUg6ZD3ghwOz2yNUhE1hRpHtE0IpVtAOotwcnevfvJWHWymS9rqQ+z2rT4JNqHNmm/jY9ITd7c yZXS2oGfw22QqfxNAAJyUAhX/qvENDBQu65iV7iH4SxuV1G3dTwsq2hmdLPXJKciayZy3FzJSPe prt7DPB0qutAYkUpSheD7t4RHpcz37Wlgm1hLyUZ63GcE1LQbHdOEBTTW5AbIqTayOGFCMV8z9F CUkmtjCTnBio9lwg6GngqX1ncRqQ8THLTDZwqS5kE3+xmaQ9K5+uWxFQnnoCZnwXFV50Ica99+1 sHdI/2/OEFr6y6taPyN/TuOJxeFPUDenk6gapbM80jTjTatV0slbYuQi+Iqa9UlDdzKzlUdEfuv MOyrs3y+649B0J9eGKdNIYWFQ+dQ+EZjifr/dyVqEQ9XtL97TnEss/puD3oJOP9v0olTEsOpvR6 au8WhaXqp5bG86gHXev729mCRaioe6jKwdXxlMzxuU/RDoVFoB6hjHQI6YaECXfpVMFs9yOZA60 AJjDn+J+APHE/uQ== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.795, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785871692404158500 From: Bin Guo virtio_gpu_reset() freed in-flight commands without unmapping the DMA regions acquired by virtqueue_pop(). Call virtqueue_detach_element() before g_free() in both drain loops. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3467 Cc: qemu-stable@nongnu.org Signed-off-by: Bin Guo Reviewed-by: Akihiko Odaki Reviewed-by: Marc-Andr=C3=A9 Lureau Message-ID: <20260803082158.62998-1-guobin@linux.alibaba.com> --- hw/display/virtio-gpu.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index c15d4b527d0e..fbb6fec7a0ad 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -1725,12 +1725,14 @@ void virtio_gpu_reset(VirtIODevice *vdev) while (!QTAILQ_EMPTY(&g->cmdq)) { cmd =3D QTAILQ_FIRST(&g->cmdq); QTAILQ_REMOVE(&g->cmdq, cmd, next); + virtqueue_detach_element(cmd->vq, &cmd->elem, 0); g_free(cmd); } =20 while (!QTAILQ_EMPTY(&g->fenceq)) { cmd =3D QTAILQ_FIRST(&g->fenceq); QTAILQ_REMOVE(&g->fenceq, cmd, next); + virtqueue_detach_element(cmd->vq, &cmd->elem, 0); g->inflight--; g_free(cmd); } --=20 2.55.0 From nobody Tue Aug 25 00:11:12 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1785871642; cv=none; d=zohomail.com; s=zohoarc; b=MlpBRY2VHA/e6aKFOnD44Z+BkmCovhWQ10+8Xxmj6tzBjWvjAjbV72mwAGga5ltapkY7adadYHRkl+3rzvExhvqPGD5dCdvhnvpi82keMlChHekoV/ii6+xOGdUhd2oWrwyleLnwS9zBMpYYrXAZIr/DmZjVV2x/Ym9Fzlb+GWA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785871642; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=l+5DIBFkHj3MpvRH+EMQbVA7d1EFloNPTRZrCzMHzlM=; b=ZwHpxbAcPhScAPxfn3MA3wDGwWqxNRIujUqS/hoYo5nQvPYMXsQv8+86p9FK8S38l9O9ZKRxiZCEDoQq879O+l/5RtbEeUooXV3z/jfOyIpqnTrdjQuHT9J6pA+GkJOGvmdE6i7iFP6rW7JOcBLTdRSxkLUtz8XvNrjp4Px3enU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785871642519439.5098379743712; Tue, 4 Aug 2026 12:27:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wrKnA-0007Ws-JN; Tue, 04 Aug 2026 15:27:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKn9-0007Sl-0P for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:27:11 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wrKn7-0005Dm-GZ for qemu-devel@nongnu.org; Tue, 04 Aug 2026 15:27:10 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-44-rwx_Ch1JNR2GoY7FVw2Xww-1; Tue, 04 Aug 2026 15:27:07 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DCCFE19560A1 for ; Tue, 4 Aug 2026 19:27:06 +0000 (UTC) Received: from localhost (unknown [10.44.22.2]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 8B1FA1956087; Tue, 4 Aug 2026 19:27:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785871628; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=l+5DIBFkHj3MpvRH+EMQbVA7d1EFloNPTRZrCzMHzlM=; b=DeP+dib5dyx6p4gr8KYpycrgirLWzICuL/RhIjm8Pn6EEofSM0RaJH2tXi1OvhvjoNINx4 rNwwmHfPcUazrGGivNBPIQdnmBRNcK5KI7DMbYAheLv2RyfdqIWVWbQUiU8HPHe15GtKR7 Lhe2Z2ecxUgz7HxtjpyyGkwF1sZjUuE= X-MC-Unique: rwx_Ch1JNR2GoY7FVw2Xww-1 X-Mimecast-MFC-AGG-ID: rwx_Ch1JNR2GoY7FVw2Xww_1785871627 From: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Date: Tue, 04 Aug 2026 23:21:56 +0400 Subject: [GIT PULL v2 9/9] qapi/dump: add allowed-by-guest feature to win-dmp MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260804-fix-v2-9-70e8fe489c9e@redhat.com> References: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> In-Reply-To: <20260804-fix-v2-0-70e8fe489c9e@redhat.com> To: qemu-devel@nongnu.org Cc: stefanha@redhat.com, =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Ani Sinha , Eric Blake , Markus Armbruster X-Developer-Signature: v=1; a=openpgp-sha256; l=2712; i=marcandre.lureau@redhat.com; h=from:subject:message-id; bh=MW7OVd74nIo16HSj5Bdl5yYs6LiN+vBhp4QxuK4O7gg=; b=owEBbQKS/ZANAwAKAdro4Ql1lpzlAcsmYgBqcjzUKC+0tlJewrUwimVj1MsxjSR5lz1y32TEU qKbrsAjdBWJAjMEAAEKAB0WIQSHqb2TP4fGBtJ29i3a6OEJdZac5QUCanI81AAKCRDa6OEJdZac 5X1bD/kBAat/kP6dRvFQWmW4yzLmFD/tn3HaMBtEEoTQtaJiSUCHQrQVfFocR+xvirEtoqChi+E iqB25JLTtG5nw4amuCplGwniGHgrur7Mb7P6RC9VByK+Mgiox1lhI1SX2f30sAcOdNA8e+8vcIf XgxiSueojWPEaKsQqZxLP7lFgQPlVbHG4yoKPsBlLrOw7lKgMdDkbkr8ZfW0OU3FG/x+YZmI06v uEdVI16auVD4xX8qLKG78Ww+Pi0mjJ+k0VkTq3DPRkTCtNJk3r0rvZKyysJi+QLJSC26K3+Z7Dp HIQpkUL8nzDwIsFhufDaBufcSL7a5xnQssS6Nj6RsjTCuzMkUni1UOtCXM5mGM7Uwwa1OfX3NBW fbUvv3SGqr8c4TjjZ++sNTbubl83Qq4Ftx/Qo1003KP92cKYQI0SOAWgGxng0r4NUWCALLqhrJq cEn1r3LNXcmZ7YaS4Owx8PBWs2oNDjLJQpNWCEnkIcATc515O9jrL+Mw2QErdTnygW/EktrqvnA i+SXstovAJstVK9LYdFoQEDkI3/+ioRo412TX6uMBH8fOnwmNXIRoCiIEthE+5RGAthvBRvGZLZ BrevtIoQYQOhAw8HGI/nDOjPFgbx9CUnQpw2kPZGqPjMIhP406kcieSMVIUjlKCMAljNPBdFT2U hca1E6Ev3YLID+A== X-Developer-Key: i=marcandre.lureau@redhat.com; a=openpgp; fpr=87A9BD933F87C606D276F62DDAE8E10975969CE5 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 4 X-Spam_score: 0.4 X-Spam_bar: / X-Spam_report: (0.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.795, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1785871644223158500 From: "Denis V. Lunev" Commit 1c0e259c5a35 ("dump: make win_dump_available() check vmcoreinfo for a Windows dump header") changed two things in a way that is visible to QMP clients but not to introspection: query-dump-guest-memory-capability now lists win-dmp only for a guest that has published a Windows dump header through the vmcoreinfo device, and dump-guest-memory, which shares win_dump_available(), rejects the format otherwise. Before that, both accepted win-dmp on any x86 machine. A client that wants to select win-dmp automatically therefore cannot trust the capability query on its own: on an older QEMU it reports win-dmp for every x86 guest, Linux ones included, where the resulting dump is useless. libvirt ran into exactly this while picking a format for on_crash and watchdog triggered dumps, and has no way to tell the two behaviours apart. Add an 'allowed-by-guest' feature to the win-dmp member of DumpGuestMemoryFormat so the fixed behaviour becomes discoverable. DumpGuestMemoryFormat is reachable from both query-dump-guest-memory-capability's return type and dump-guest-memory's arguments, so a single flag covers both halves of the change. Where the feature is absent, a reported win-dmp says nothing about the guest, and a client that needs the dump to be loadable afterwards should fall back to elf. CC: Eric Blake CC: Markus Armbruster CC: "Marc-Andr=C3=A9 Lureau" Suggested-by: Daniel P. Berrang=C3=A9 Signed-off-by: Denis V. Lunev Reviewed-by: Daniel P. Berrang=C3=A9 Reviewed-by: Marc-Andr=C3=A9 Lureau Message-ID: <20260731155001.1204103-1-den@openvz.org> --- qapi/dump.json | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/qapi/dump.json b/qapi/dump.json index 726b5208703c..690f3963fe15 100644 --- a/qapi/dump.json +++ b/qapi/dump.json @@ -38,6 +38,13 @@ # @win-dmp: Windows full crashdump format, can be used instead of ELF # converting (since 2.13) # +# Features: +# +# @allowed-by-guest: If present, @win-dmp is listed by +# `query-dump-guest-memory-capability`, and accepted by +# `dump-guest-memory`, only when the guest has published a Windows +# dump header through the vmcoreinfo device (since 11.1) +# # Since: 2.0 ## { 'enum': 'DumpGuestMemoryFormat', @@ -45,7 +52,7 @@ 'elf', 'kdump-zlib', 'kdump-lzo', 'kdump-snappy', 'kdump-raw-zlib', 'kdump-raw-lzo', 'kdump-raw-snappy', - 'win-dmp' ] } + { 'name': 'win-dmp', 'features': ['allowed-by-guest'] } ] } =20 ## # @dump-guest-memory: --=20 2.55.0