From nobody Sat Sep 26 21:38:27 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=rsg.ci.i.u-tokyo.ac.jp ARC-Seal: i=1; a=rsa-sha256; t=1787643049; cv=none; d=zohomail.com; s=zohoarc; b=G32cn4Kw157Py/MCZv9Ry4Kcfmomt+jAl6Ew5AJAqOCFTy9JqM9uyJLfLRimOGXcrWoWHhkI91rh1oMi1wQKV3hrOdVxdife4gA4k0w32thOvqWUw33zLdQPj/CaBIGgXt/sCNg0hmShfbEXp4LDgGZqb6zr82LekGLjQOX91EI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787643049; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=E4hfWxBm6wqd5SXrXy04REShDseQ3XN91pTMGVvRSV0=; b=CtyACbssmj/rjqsSSZV07+Gs+3QBtqo3kBnPQZmXi0kK2M/Z80rjaZjTPHE3cEzwjBqgtln7rfjJx6RFza9JHuHQGxQwF2LojQtZrT9OVu8nVfn+9aNSyZ5+Cj/qCXDQWAPGPwDl8pwDWuwZ2iLU96DLBHvWsHp3LlqSMCRjGys= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1787643049261124.9351343459183; Tue, 25 Aug 2026 00:30:49 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wylbv-0005Hc-MD; Tue, 25 Aug 2026 03:30:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wylbt-0005G9-1E for qemu-devel@nongnu.org; Tue, 25 Aug 2026 03:30:17 -0400 Received: from www3579.sakura.ne.jp ([49.212.243.89]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wylbq-00026q-Dh for qemu-devel@nongnu.org; Tue, 25 Aug 2026 03:30:16 -0400 Received: from h183.csg.ci.i.u-tokyo.ac.jp (h183.csg.ci.i.u-tokyo.ac.jp [133.11.54.183]) (authenticated bits=0) by www3579.sakura.ne.jp (8.16.1/8.16.1) with ESMTPSA id 67P7TsR4057787 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 25 Aug 2026 16:30:03 +0900 (JST) (envelope-from odaki@rsg.ci.i.u-tokyo.ac.jp) DKIM-Signature: a=rsa-sha256; bh=E4hfWxBm6wqd5SXrXy04REShDseQ3XN91pTMGVvRSV0=; c=relaxed/relaxed; d=rsg.ci.i.u-tokyo.ac.jp; h=From:Message-Id:To:Subject:Date; s=rs20250326; t=1787643003; v=1; b=vu+itbHBngqEP8DVtN471B0gCLwN9O1/D748va4GvOiPo07eEJXwEtiX2cmXPn0a dbW1okFS1uE1F070PcoS0tSlqf60iDrwZ7k53rQn9HKAnE3P1lrMGbSoRDembypC IG3t1tENoJdcXYURbs1P2kmo+B+l79dcKQZYYZZYQnfrZ8kLIXjvo5qFuaEsmyXO xnmCbvhI6G23Tcm4sOml0Ptj1X7825m2C7It9QA0ots1f4G+eGXNn0dDUjHb3SNX 2XvPNTuobHL+Ye3Zg+AHWoHzOe/4LfJEnZajq6nD9do5O8bolCCXlt7I0EO+8tLS RiE248scQHf1FSkD7O4lnA== From: Akihiko Odaki Date: Tue, 25 Aug 2026 16:28:47 +0900 Subject: [PATCH v2 1/5] hw/display/virtio-gpu: Avoid creating empty udmabuf MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260825-dmabuf-v2-1-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> References: <20260825-dmabuf-v2-0-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> In-Reply-To: <20260825-dmabuf-v2-0-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> To: qemu-devel@nongnu.org Cc: "Michael S. Tsirkin" , =?utf-8?q?Alex_Benn=C3=A9e?= , Dmitry Osipenko , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Akihiko Odaki X-Mailer: b4 0.16-dev-925f5 X-Developer-Signature: v=1; a=openpgp-sha256; l=5355; i=odaki@rsg.ci.i.u-tokyo.ac.jp; h=from:subject:message-id; bh=mKLvuCDlxGKxhjP68r0N13Lt+Y4djUit3/oL3/Aua9o=; b=owGbwMvMwCWmMbc20y1CyJDxtFoSQ1avS+mRL3MefziXPOv2nqSMjW3Trc78XnjojuzR9dcXl JR8t2ZM7yhlYRDjYpAVU2RJKdrNrRFd+6kwIb4FZg4rE8gQBi5OAZjITwmGf5p7r/+R0jqZt1XH 7sF0mYZNF7kzmKXKfhVuztbn+/HzcDMjw4KvDXai3u0ZdczPdiXG/tV+1OShGK/X7LdLaMrnS5v WMwIA X-Developer-Key: i=odaki@rsg.ci.i.u-tokyo.ac.jp; a=openpgp; fpr=AEDC03C9AF734F2EC26A7BFFA4BAEAA73536753C Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=49.212.243.89; envelope-from=odaki@rsg.ci.i.u-tokyo.ac.jp; helo=www3579.sakura.ne.jp X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @rsg.ci.i.u-tokyo.ac.jp) X-ZM-MESSAGEID: 1787643050890158500 The virtio specification allows creating a blob without backing storage attached. However, virtio-gpu attempts to create an empty udmabuf for such a blob. The ioctl fails with EINVAL and emits a spurious warning. Avoid the invalid ioctl. Fixes: e0933d91b1cd ("virtio-gpu: Add virtio_gpu_resource_create_blob") Fixes: f66767f75c9c ("virtio-gpu: add virtio-gpu/blob vmstate subsection") Signed-off-by: Akihiko Odaki Reviewed-by: Marc-Andr=C3=A9 Lureau --- hw/display/virtio-gpu.c | 94 ++++++++++++++++++++++++++-------------------= ---- 1 file changed, 49 insertions(+), 45 deletions(-) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index fbb6fec7a0ad..ccfc1814d514 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -363,27 +363,29 @@ static void virtio_gpu_resource_create_blob(VirtIOGPU= *g, res->resource_id =3D cblob.resource_id; res->blob_size =3D cblob.size; =20 - ret =3D virtio_gpu_create_mapping_iov(g, cblob.nr_entries, sizeof(cblo= b), - cmd, &res->addrs, &res->iov, - &res->iov_cnt); - if (ret < 0) { - cmd->error =3D VIRTIO_GPU_RESP_ERR_UNSPEC; - g_free(res); - return; - } + if (cblob.nr_entries) { + ret =3D virtio_gpu_create_mapping_iov(g, cblob.nr_entries, sizeof(= cblob), + cmd, &res->addrs, &res->iov, + &res->iov_cnt); + if (ret < 0) { + cmd->error =3D VIRTIO_GPU_RESP_ERR_UNSPEC; + g_free(res); + return; + } =20 - if (res->iov_cnt > 0 && - iov_size(res->iov, res->iov_cnt) < res->blob_size) { - qemu_log_mask(LOG_GUEST_ERROR, - "%s: backing storage smaller than blob size\n", - __func__); - cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; - virtio_gpu_cleanup_mapping(g, res); - g_free(res); - return; + if (iov_size(res->iov, res->iov_cnt) < res->blob_size) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: backing storage smaller than blob size\n", + __func__); + cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; + virtio_gpu_cleanup_mapping(g, res); + g_free(res); + return; + } + + virtio_gpu_init_udmabuf(res); } =20 - virtio_gpu_init_udmabuf(res); QTAILQ_INSERT_HEAD(&g->reslist, res, next); } =20 @@ -1369,8 +1371,6 @@ static bool virtio_gpu_load_restore_mapping(VirtIOGPU= *g, } } =20 - QTAILQ_INSERT_HEAD(&g->reslist, res, next); - g->hostmem +=3D res->hostmem; return true; } =20 @@ -1449,6 +1449,8 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque,= size_t size, return -EINVAL; } =20 + QTAILQ_INSERT_HEAD(&g->reslist, res, next); + g->hostmem +=3D hostmem; resource_id =3D qemu_get_be32(f); } =20 @@ -1508,36 +1510,38 @@ static int virtio_gpu_blob_load(QEMUFile *f, void *= opaque, size_t size, res->blob_size =3D qemu_get_be32(f); res->iov_cnt =3D qemu_get_be32(f); =20 - res->addrs =3D g_try_new(uint64_t, res->iov_cnt); - res->iov =3D g_try_new(struct iovec, res->iov_cnt); - if (res->iov_cnt && (!res->addrs || !res->iov)) { - g_free(res->addrs); - g_free(res->iov); - g_free(res); - return -EINVAL; - } + if (res->iov_cnt) { + res->addrs =3D g_try_new(uint64_t, res->iov_cnt); + res->iov =3D g_try_new(struct iovec, res->iov_cnt); + if (!res->addrs || !res->iov) { + g_free(res->addrs); + g_free(res->iov); + g_free(res); + return -EINVAL; + } =20 - /* read data */ - for (i =3D 0; i < res->iov_cnt; i++) { - res->addrs[i] =3D qemu_get_be64(f); - res->iov[i].iov_len =3D qemu_get_be32(f); - } + /* read data */ + for (i =3D 0; i < res->iov_cnt; i++) { + res->addrs[i] =3D qemu_get_be64(f); + res->iov[i].iov_len =3D qemu_get_be32(f); + } =20 - if (res->iov_cnt > 0 && - iov_size(res->iov, res->iov_cnt) < res->blob_size) { - g_free(res->addrs); - g_free(res->iov); - g_free(res); - return -EINVAL; - } + if (iov_size(res->iov, res->iov_cnt) < res->blob_size) { + g_free(res->addrs); + g_free(res->iov); + g_free(res); + return -EINVAL; + } =20 - if (!virtio_gpu_load_restore_mapping(g, res)) { - g_free(res); - return -EINVAL; - } + if (!virtio_gpu_load_restore_mapping(g, res)) { + g_free(res); + return -EINVAL; + } =20 - virtio_gpu_init_udmabuf(res); + virtio_gpu_init_udmabuf(res); + } =20 + QTAILQ_INSERT_HEAD(&g->reslist, res, next); resource_id =3D qemu_get_be32(f); } =20 --=20 2.55.0 From nobody Sat Sep 26 21:38:27 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=rsg.ci.i.u-tokyo.ac.jp ARC-Seal: i=1; a=rsa-sha256; t=1787643064; cv=none; d=zohomail.com; s=zohoarc; b=Jkq6gM8uun3kJbjweivSRBy0wa+tLv6im0UL23JLw/3vhL308eAYEKpPMnww07nKH5phvIDLtLhdJFjHfwQrpu7wCNb6dAVa5wvMpanxG65xYHlhHFEyxoByZQp7gFnVkBetPqchNYLBqlMj3+xipTIm4sCFmRCZhGRpe8m+SAw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787643064; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=xh6gmNUOMB/uRD2IO04yxiOH9Eb2pUt5NpbNm8V5uRc=; b=P6fx+0+sCVAllJM09mR6XohKWGOCBBWdminQlXLIQfHXqv2jBsBTuo3ra4zerQzaBL0VYuNxlbx0dpzr+94WqVTbzmQ46RLzV1PMT2MAQuzNe8oW1OHL2O5XDEMg4G3oPtKQy0JbSzbhT29wDmCK5/2cWp0ic4FMm490+46ZpQI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1787643064093769.0261210513942; Tue, 25 Aug 2026 00:31:04 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wylbw-0005Iw-Bu; Tue, 25 Aug 2026 03:30:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wylbu-0005Gr-Ay for qemu-devel@nongnu.org; Tue, 25 Aug 2026 03:30:18 -0400 Received: from www3579.sakura.ne.jp ([49.212.243.89]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wylbq-00026w-Is for qemu-devel@nongnu.org; Tue, 25 Aug 2026 03:30:17 -0400 Received: from h183.csg.ci.i.u-tokyo.ac.jp (h183.csg.ci.i.u-tokyo.ac.jp [133.11.54.183]) (authenticated bits=0) by www3579.sakura.ne.jp (8.16.1/8.16.1) with ESMTPSA id 67P7TsR5057787 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 25 Aug 2026 16:30:03 +0900 (JST) (envelope-from odaki@rsg.ci.i.u-tokyo.ac.jp) DKIM-Signature: a=rsa-sha256; bh=xh6gmNUOMB/uRD2IO04yxiOH9Eb2pUt5NpbNm8V5uRc=; c=relaxed/relaxed; d=rsg.ci.i.u-tokyo.ac.jp; h=From:Message-Id:To:Subject:Date; s=rs20250326; t=1787643003; v=1; b=bdSPo48dNpUnH0oH6XK0mghqWR9OR3/C1b/uLOyP6w8/6QTIHqVqVWRq6SIt3b4S CY0ib9sn+9YEI82b7+CUhOnna6sDwA8vtcrjg4PE3InPZMKs/bG2gXkkYuZt4ko2 Zjj8dy8Pr6lVaTBYP4GSY3fIWck/HH4VLKJjaFffwik3/6MX7TClbHpINVanr6z+ BaJbXKCZs9b9pHHQmsef8yKkSMLLFBv4uzRDg6RtrY03+UbrRbJOeoe89oUWUqQd DEeMjwqZXei8lJ6qRaYISq5CSEng7QTMse6JdBEUdMfnt91SzyALCM1/gShydvlN 52lruBK+nxRym/Bb8tJCCQ== From: Akihiko Odaki Date: Tue, 25 Aug 2026 16:28:48 +0900 Subject: [PATCH v2 2/5] hw/display/virtio-gpu: Avoid mmap() for empty blob MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260825-dmabuf-v2-2-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> References: <20260825-dmabuf-v2-0-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> In-Reply-To: <20260825-dmabuf-v2-0-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> To: qemu-devel@nongnu.org Cc: "Michael S. Tsirkin" , =?utf-8?q?Alex_Benn=C3=A9e?= , Dmitry Osipenko , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Akihiko Odaki X-Mailer: b4 0.16-dev-925f5 X-Developer-Signature: v=1; a=openpgp-sha256; l=955; i=odaki@rsg.ci.i.u-tokyo.ac.jp; h=from:subject:message-id; bh=5ko48SofRq+K9N11681tLZ5DmDH0UWyoMwo7G18yb5s=; b=owGbwMvMwCWmMbc20y1CyJDxtFoSQ1avS5mhRvTlMj6pOObZzy3YDlj8nurx6pSd1TG/o/3zq hse5U/vKGVhEONikBVTZEkp2s2tEV37qTAhvgVmDisTyBAGLk4BmEhcJSPDveBLGR7nT591i9w1 d+VNgbvXRBzne/H/N/yyRb5sl7P4eYZ/uppSLiUJD313++Tpb9MoCDkxw1D99la9m20i4h+1RRs YAQ== X-Developer-Key: i=odaki@rsg.ci.i.u-tokyo.ac.jp; a=openpgp; fpr=AEDC03C9AF734F2EC26A7BFFA4BAEAA73536753C Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=49.212.243.89; envelope-from=odaki@rsg.ci.i.u-tokyo.ac.jp; helo=www3579.sakura.ne.jp X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @rsg.ci.i.u-tokyo.ac.jp) X-ZM-MESSAGEID: 1787643066507158500 Calling mmap() for an empty blob fails with EINVAL, causing QEMU to emit a spurious warning. Fixes: e0933d91b1cd ("virtio-gpu: Add virtio_gpu_resource_create_blob") Signed-off-by: Akihiko Odaki Reviewed-by: Marc-Andr=C3=A9 Lureau --- hw/display/virtio-gpu-udmabuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabu= f.c index 5f08c855dde1..0377a9bcb406 100644 --- a/hw/display/virtio-gpu-udmabuf.c +++ b/hw/display/virtio-gpu-udmabuf.c @@ -136,7 +136,7 @@ void virtio_gpu_init_udmabuf(struct virtio_gpu_simple_r= esource *res) if (res->iov_cnt =3D=3D 1 && res->iov[0].iov_len < 4096) { pdata =3D res->iov[0].iov_base; - } else { + } else if (res->blob_size) { virtio_gpu_create_udmabuf(res); if (res->dmabuf_fd < 0) { return; --=20 2.55.0 From nobody Sat Sep 26 21:38:27 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=rsg.ci.i.u-tokyo.ac.jp ARC-Seal: i=1; a=rsa-sha256; t=1787643052; cv=none; d=zohomail.com; s=zohoarc; b=QcYHvPHIOPgWIi8scFRAgx3YD5dNdJJ/3Lz1ZJ2yKRnyCRKHhlSt/YHXyJh9ASjmxckWpaW7tQjtTSIkVS6DqArp2IDgO80a3r1AfZuPvS8jZU/3MVbzMzU0767+hvT2ieh3FisWjsAt6T0HUyZx9F4BmoHckAlKQ1C6NRP2in0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787643052; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=yUYMM0YdYU9biQU1v1iHfxVEvKUAgeW3ASfc6dRuCWg=; b=eOahnq8nVv8Pz3z6qHircTddOSPa90XEjL6jtB6WgoCLpSGT3iDPB69i2V6E6QGiWFit+zFe0fZKqWHp/U1bNT+CZBKyta8HQ+1h5qS+wkSLRHPj7DI+El2MDrCElhFHj0V3erT508FNeQutAvl0gFfDtVwT8NjgqoI/GRtHuKQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1787643052523668.2165155145492; Tue, 25 Aug 2026 00:30:52 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wylbw-0005J7-Ey; Tue, 25 Aug 2026 03:30:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wylbu-0005Gz-Gx for qemu-devel@nongnu.org; Tue, 25 Aug 2026 03:30:18 -0400 Received: from www3579.sakura.ne.jp ([49.212.243.89]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wylbq-00026p-Dj for qemu-devel@nongnu.org; Tue, 25 Aug 2026 03:30:18 -0400 Received: from h183.csg.ci.i.u-tokyo.ac.jp (h183.csg.ci.i.u-tokyo.ac.jp [133.11.54.183]) (authenticated bits=0) by www3579.sakura.ne.jp (8.16.1/8.16.1) with ESMTPSA id 67P7TsR6057787 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 25 Aug 2026 16:30:03 +0900 (JST) (envelope-from odaki@rsg.ci.i.u-tokyo.ac.jp) DKIM-Signature: a=rsa-sha256; bh=yUYMM0YdYU9biQU1v1iHfxVEvKUAgeW3ASfc6dRuCWg=; c=relaxed/relaxed; d=rsg.ci.i.u-tokyo.ac.jp; h=From:Message-Id:To:Subject:Date; s=rs20250326; t=1787643003; v=1; b=SJsUvLuUMJLlY0VTW6VKpVqlVkiTrfGNvMjjWNXz7+NJv11flXPqnyW07G1Amh1y 3CFtRUQ+ll6GOqthdFf4gJNk/Umc81vJvBnhNpVQn+aB7qrxn8iWJIvOpETwhG9G vtovI4ZHoatdfX0BziMtgm8dNj2OsputuN+R6uH7D+8+01sX3bHyUxuGOg/fijFg 78dVm1CzXJN20AA5FX5Ggk0cdMTWUgb+Ezfpwp7466ULIFMBsgZt2dO2cN3w6qAz eXsoBacUCkx2Rw50jYydbM8im+o4/jxzO+N1Ao3GB8cCQaPPDlMQjFPKw2j4vQ0L VSa3Gf9QJHmgbHvlDefqaw== From: Akihiko Odaki Date: Tue, 25 Aug 2026 16:28:49 +0900 Subject: [PATCH v2 3/5] hw/display/virtio-gpu: Propagate udmabuf errors MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260825-dmabuf-v2-3-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> References: <20260825-dmabuf-v2-0-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> In-Reply-To: <20260825-dmabuf-v2-0-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> To: qemu-devel@nongnu.org Cc: "Michael S. Tsirkin" , =?utf-8?q?Alex_Benn=C3=A9e?= , Dmitry Osipenko , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Akihiko Odaki X-Mailer: b4 0.16-dev-925f5 X-Developer-Signature: v=1; a=openpgp-sha256; l=4526; i=odaki@rsg.ci.i.u-tokyo.ac.jp; h=from:subject:message-id; bh=Q+bid3gBAYRIkuq3uxIs11EDNoyxTXFIZmCvHAsYJwg=; b=owGbwMvMwCWmMbc20y1CyJDxtFoSQ1avS3mojMdkJuWrjN93L3H+d8pZjzHkQLFgjYbPquy6B UKMCZwdpSwMYlwMsmKKLClFu7k1oms/FSbEt8DMYWUCGcLAxSkAE/ESYmRoPv+tKIkx5dpRof13 plW18Bo1ye5OCLJO1uL+oX7UxG0XI8Pqf9ZR+hzB51MnfP/K8i/xmYH6jBeqCVLpoecWLDZdtZM VAA== X-Developer-Key: i=odaki@rsg.ci.i.u-tokyo.ac.jp; a=openpgp; fpr=AEDC03C9AF734F2EC26A7BFFA4BAEAA73536753C Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=49.212.243.89; envelope-from=odaki@rsg.ci.i.u-tokyo.ac.jp; helo=www3579.sakura.ne.jp X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @rsg.ci.i.u-tokyo.ac.jp) X-ZM-MESSAGEID: 1787643054273158500 Propagate udmabuf errors so that the requested operation will be canceled instead of producing an incomplete result and the user can notice the failure. Fixes: e0933d91b1cd ("virtio-gpu: Add virtio_gpu_resource_create_blob") Fixes: f66767f75c9c ("virtio-gpu: add virtio-gpu/blob vmstate subsection") Fixes: 4ae1c5c7d6f3 ("hw/display/virtio-gpu: Initialize blob mapping for AT= TACH_BACKING") Signed-off-by: Akihiko Odaki Reviewed-by: Marc-Andr=C3=A9 Lureau --- include/hw/virtio/virtio-gpu.h | 2 +- hw/display/virtio-gpu-udmabuf-stubs.c | 3 ++- hw/display/virtio-gpu-udmabuf.c | 8 +++++--- hw/display/virtio-gpu.c | 18 ++++++++++++++---- 4 files changed, 22 insertions(+), 9 deletions(-) diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h index 220231ec9d43..69b5ee2e382f 100644 --- a/include/hw/virtio/virtio-gpu.h +++ b/include/hw/virtio/virtio-gpu.h @@ -388,7 +388,7 @@ bool virtio_gpu_scanout_blob_to_fb(struct virtio_gpu_fr= amebuffer *fb, =20 /* virtio-gpu-udmabuf.c */ bool virtio_gpu_have_udmabuf(void); -void virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res); +bool virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res); void virtio_gpu_fini_udmabuf(VirtIOGPU *g, struct virtio_gpu_simple_resource *res); int virtio_gpu_update_dmabuf(VirtIOGPU *g, diff --git a/hw/display/virtio-gpu-udmabuf-stubs.c b/hw/display/virtio-gpu-= udmabuf-stubs.c index 85d03935a332..0883bf05fac1 100644 --- a/hw/display/virtio-gpu-udmabuf-stubs.c +++ b/hw/display/virtio-gpu-udmabuf-stubs.c @@ -7,9 +7,10 @@ bool virtio_gpu_have_udmabuf(void) return false; } =20 -void virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res) +bool virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res) { /* nothing (stub) */ + return false; } =20 void virtio_gpu_fini_udmabuf(VirtIOGPU *g, struct virtio_gpu_simple_resour= ce *res) diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabu= f.c index 0377a9bcb406..399b71c9c4fb 100644 --- a/hw/display/virtio-gpu-udmabuf.c +++ b/hw/display/virtio-gpu-udmabuf.c @@ -128,7 +128,7 @@ bool virtio_gpu_have_udmabuf(void) return memfd_backend; } =20 -void virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res) +bool virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res) { void *pdata =3D NULL; =20 @@ -139,17 +139,19 @@ void virtio_gpu_init_udmabuf(struct virtio_gpu_simple= _resource *res) } else if (res->blob_size) { virtio_gpu_create_udmabuf(res); if (res->dmabuf_fd < 0) { - return; + return false; } virtio_gpu_remap_udmabuf(res); if (!res->remapped) { virtio_gpu_destroy_udmabuf(res); - return; + return false; } pdata =3D res->remapped; } =20 res->blob =3D pdata; + + return true; } =20 static void virtio_gpu_free_dmabuf(VirtIOGPU *g, VGPUDMABuf *dmabuf) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index ccfc1814d514..de911c9dcb41 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -383,7 +383,12 @@ static void virtio_gpu_resource_create_blob(VirtIOGPU = *g, return; } =20 - virtio_gpu_init_udmabuf(res); + if (!virtio_gpu_init_udmabuf(res)) { + cmd->error =3D VIRTIO_GPU_RESP_ERR_UNSPEC; + virtio_gpu_cleanup_mapping(g, res); + g_free(res); + return; + } } =20 QTAILQ_INSERT_HEAD(&g->reslist, res, next); @@ -1025,8 +1030,9 @@ virtio_gpu_resource_attach_backing(VirtIOGPU *g, return; } =20 - if (!res->image) { - virtio_gpu_init_udmabuf(res); + if (!res->image && !virtio_gpu_init_udmabuf(res)) { + cmd->error =3D VIRTIO_GPU_RESP_ERR_UNSPEC; + virtio_gpu_cleanup_mapping(g, res); } } =20 @@ -1538,7 +1544,11 @@ static int virtio_gpu_blob_load(QEMUFile *f, void *o= paque, size_t size, return -EINVAL; } =20 - virtio_gpu_init_udmabuf(res); + if (!virtio_gpu_init_udmabuf(res)) { + virtio_gpu_cleanup_mapping(g, res); + g_free(res); + return -EINVAL; + } } =20 QTAILQ_INSERT_HEAD(&g->reslist, res, next); --=20 2.55.0 From nobody Sat Sep 26 21:38:27 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=rsg.ci.i.u-tokyo.ac.jp ARC-Seal: i=1; a=rsa-sha256; t=1787643051; cv=none; d=zohomail.com; s=zohoarc; b=aw7lM4JFOVfJf06sZbtL+I0l0GYBlYispmQiqWMTyjr8byJyPzGFgwVnCYgaVwxkLrlLayNZ/zgqXV3yupTL+D2kdoaEambalHIzN7uImE1vnum7ZGjwzCRv8wUHMc6G9R4Id8SaAEJcqWx/X1bqVgrEygcS3EkNaPM/0tS7glE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787643051; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=+tedqNUpD4aU4Xzq5l784VRnDhtj7s9qLdUrVG3rBcE=; b=Q8DBLLLU7Vou12lDEXVPiOpmE9hlrqM39CBxU8YmYQXI7Du8p2fW8KHZKMsquekq8oZVe/E3i2kiBzN3MjdBnWNpPKCFREmqtcR3boUDRxCZuPD3Us0/3kvV7NbAD3kcis7/EuF1TjPsvJzYnIVc2lVnGQwTMCWAvmNvxExbeXc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1787643050770546.7643491216388; Tue, 25 Aug 2026 00:30:50 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wylbw-0005IS-1R; Tue, 25 Aug 2026 03:30:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wylbu-0005Gs-AV for qemu-devel@nongnu.org; Tue, 25 Aug 2026 03:30:18 -0400 Received: from www3579.sakura.ne.jp ([49.212.243.89]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wylbq-00026r-Iv for qemu-devel@nongnu.org; Tue, 25 Aug 2026 03:30:17 -0400 Received: from h183.csg.ci.i.u-tokyo.ac.jp (h183.csg.ci.i.u-tokyo.ac.jp [133.11.54.183]) (authenticated bits=0) by www3579.sakura.ne.jp (8.16.1/8.16.1) with ESMTPSA id 67P7TsR7057787 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 25 Aug 2026 16:30:03 +0900 (JST) (envelope-from odaki@rsg.ci.i.u-tokyo.ac.jp) DKIM-Signature: a=rsa-sha256; bh=+tedqNUpD4aU4Xzq5l784VRnDhtj7s9qLdUrVG3rBcE=; c=relaxed/relaxed; d=rsg.ci.i.u-tokyo.ac.jp; h=From:Message-Id:To:Subject:Date; s=rs20250326; t=1787643003; v=1; b=tpLadZHI70isrCj/N0YlE5fjkbr0Cgs8Td9hYf9I4qCVe1tMHqBeUtTLWYdyvHju 3ikZS1VDzo3VbvMPsbxyoZGFli/2bdZzq2dNzgg62gutgWvSDKMmoJggt183qgV5 lltS6TOAHV0N4DTkRdnlxA+hmlJ+e3jBROoXNWbmMARq8sFpj+1KnQv0xvmIxjoE tQO85csubNTockQJCuEILMieKs7JtsNiLICo5n1aM9YLuuMNjDMTGCJ2X8rhWc2h n+2PX86ZNSPSPe0kHSZDIjItBDYPuw8drQa76r6AQsmRe3qW+tScuQLsi0uj/jHj /nEsJ6PlYOJpk/0xyZeaHA== From: Akihiko Odaki Date: Tue, 25 Aug 2026 16:28:50 +0900 Subject: [PATCH v2 4/5] hw/display/virtio-gpu: Check cursor data presence MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260825-dmabuf-v2-4-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> References: <20260825-dmabuf-v2-0-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> In-Reply-To: <20260825-dmabuf-v2-0-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> To: qemu-devel@nongnu.org Cc: "Michael S. Tsirkin" , =?utf-8?q?Alex_Benn=C3=A9e?= , Dmitry Osipenko , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Akihiko Odaki X-Mailer: b4 0.16-dev-925f5 X-Developer-Signature: v=1; a=openpgp-sha256; l=970; i=odaki@rsg.ci.i.u-tokyo.ac.jp; h=from:subject:message-id; bh=JoA5X9mZI/ARseZrjgcqnw4E0S+G+XaCWj+pyTFZgXk=; b=owGbwMvMwCWmMbc20y1CyJDxtFoSQ1avS0WCwIqmhcoZ59+o5N1o88oUnKEVsFj3pXXtFAYHY 6O1+dc6SlkYxLgYZMUUWVKKdnNrRNd+KkyIb4GZw8oEMoSBi1MAJmImzPCHZ//5HfIm/HJrFpXn +F7x+85VlHbt9I1Mm8gl4hF2T14ZMDL8jVz1kfP0PR9p+adau08/z+WUyprovPTKupAbgiyNtl8 4AA== X-Developer-Key: i=odaki@rsg.ci.i.u-tokyo.ac.jp; a=openpgp; fpr=AEDC03C9AF734F2EC26A7BFFA4BAEAA73536753C Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=49.212.243.89; envelope-from=odaki@rsg.ci.i.u-tokyo.ac.jp; helo=www3579.sakura.ne.jp X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @rsg.ci.i.u-tokyo.ac.jp) X-ZM-MESSAGEID: 1787643054289158500 Reject a blob that lacks the backing storage for VIRTIO_GPU_CMD_UPDATE_CURSOR. Fixes: bdd53f739273 ("virtio-gpu: Update cursor data using blob") Signed-off-by: Akihiko Odaki --- hw/display/virtio-gpu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index de911c9dcb41..996b77829511 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -63,8 +63,8 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g, } data =3D pixman_image_get_data(res->image); } else { - if (res->blob_size < (s->current_cursor->width * - s->current_cursor->height * 4)) { + if (!res->iov || res->blob_size < (s->current_cursor->width * + s->current_cursor->height * 4))= { return; } data =3D res->blob; --=20 2.55.0 From nobody Sat Sep 26 21:38:27 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=rsg.ci.i.u-tokyo.ac.jp ARC-Seal: i=1; a=rsa-sha256; t=1787643048; cv=none; d=zohomail.com; s=zohoarc; b=OdVw83OYGWqva2oMksWpoJs44aIyPOy6F7XpaNB/oZHzWCTfbN+KApNRM9hNbC/vnwAhZtbJ0SJJVT278mj11vB/9pA8roEBwNG3G1iVfgLJ5/b+M+k6P/p4GFvEypjplO6d5G7fFCR6lvm49V7WURXAEnrJosAiDgJ5QBMPCuk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787643048; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Ey//3aZEUk1CHNP0liGSL2vNkzrBp48N4daGv/uWJLU=; b=Pc8houbSzYr4A3X+9SYpNc5NrQsePsLgl/DomvC+gJwJgE2aknQ1GNv0VFEVSxQdVnFmQoVjNzqdOJnYG/Elic9OEBcYU7ktklfkBdPKeEuUSF1drNhAl5Zu8db4kLl2moY/t5S2lkXGJ6zC2NQHO5C9IT22ROiQktIKRdUzqgY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1787643048004756.1374830012967; Tue, 25 Aug 2026 00:30:48 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wylbx-0005K1-Qc; Tue, 25 Aug 2026 03:30:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wylbu-0005HZ-Oc for qemu-devel@nongnu.org; Tue, 25 Aug 2026 03:30:18 -0400 Received: from www3579.sakura.ne.jp ([49.212.243.89]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wylbq-00026s-Dh for qemu-devel@nongnu.org; Tue, 25 Aug 2026 03:30:18 -0400 Received: from h183.csg.ci.i.u-tokyo.ac.jp (h183.csg.ci.i.u-tokyo.ac.jp [133.11.54.183]) (authenticated bits=0) by www3579.sakura.ne.jp (8.16.1/8.16.1) with ESMTPSA id 67P7TsR8057787 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 25 Aug 2026 16:30:03 +0900 (JST) (envelope-from odaki@rsg.ci.i.u-tokyo.ac.jp) DKIM-Signature: a=rsa-sha256; bh=Ey//3aZEUk1CHNP0liGSL2vNkzrBp48N4daGv/uWJLU=; c=relaxed/relaxed; d=rsg.ci.i.u-tokyo.ac.jp; h=From:Message-Id:To:Subject:Date; s=rs20250326; t=1787643003; v=1; b=WeYW7aFE4frLezdR7eH7VJD0PW5wpkSwsmD8BDD22cimVRR7GfK/5dQfMvqf/ElF yaOwM1vxlBNMIQL3z1HGTyOeick48citcHFoh01dL8yGrHcKl6J/Qso7hey1DcuI JJU6xdfLGVOuf9ibCq3ZFphW0fiHjHzHwxFdew8WTL3+MEIQB+PPFlGXYNT7fXeR XdkwIOGR+dK4VWUkCushwXY2rVCeE+jE9UWgJP8/eXeBtGG9/dVc9tiD4AG3slqJ Z+kN7cvZFacjjPabzg7P+1cWtfNAJl54sLgoLuEpfv89IBJWNIDa0+hfX/y9eh8a EQsfDmshN9zg52O4sZPotw== From: Akihiko Odaki Date: Tue, 25 Aug 2026 16:28:51 +0900 Subject: [PATCH v2 5/5] hw/display/virtio-gpu: Validate resource per command MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260825-dmabuf-v2-5-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> References: <20260825-dmabuf-v2-0-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> In-Reply-To: <20260825-dmabuf-v2-0-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp> To: qemu-devel@nongnu.org Cc: "Michael S. Tsirkin" , =?utf-8?q?Alex_Benn=C3=A9e?= , Dmitry Osipenko , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Akihiko Odaki X-Mailer: b4 0.16-dev-925f5 X-Developer-Signature: v=1; a=openpgp-sha256; l=6562; i=odaki@rsg.ci.i.u-tokyo.ac.jp; h=from:subject:message-id; bh=XLOWap4IH1BFMIQ4K12ZuKog1w1EqIoUjH+qNTIahxA=; b=kA0DAAoWKJ19aUZYEjEByyZiAGqNRHmh7T5CZ5kOxsqXSHKZ2EReQdA1i+i1VXGvZ54aPQcOD oh1BAAWCgAdFiEEZHK7CyhbffJxYF+EKJ19aUZYEjEFAmqNRHkACgkQKJ19aUZYEjHs0AD/R2/T IzvijtvV0J/62bKtteUlQJp1UdbsmMs+0aidN04A/RwgoJhO5lFHupYzTP3AHDyQRsATLdNJGWR omDcl8qEM X-Developer-Key: i=odaki@rsg.ci.i.u-tokyo.ac.jp; a=openpgp; fpr=AEDC03C9AF734F2EC26A7BFFA4BAEAA73536753C Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=49.212.243.89; envelope-from=odaki@rsg.ci.i.u-tokyo.ac.jp; helo=www3579.sakura.ne.jp X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @rsg.ci.i.u-tokyo.ac.jp) X-ZM-MESSAGEID: 1787643050830158500 virtio_gpu_find_check_resource() checks if the resource has backing storage if require_backing is true, but the condition conflates backing storage attachment with host representation; it checks !res->iov || (!res->image && !res->blob), but !res->iov is sufficient. Furthermore, its callers passing true as require_backing have different requirements: - virtio_gpu_transfer_to_host_2d() requires a non-blob with backing storage. - virtio_gpu_set_scanout() requires a non-blob but does not require backing storage. - virtio_gpu_set_scanout_blob() requires a blob with backing storage. - virtio_gpu_resource_detach_backing() accepts any resource. Remove the require_backing parameter and open-code checks appropriate for each function instead. Fixes: 25c001a40346 ("virtio-gpu: Add virtio_gpu_find_check_resource") Fixes: e0933d91b1cd ("virtio-gpu: Add virtio_gpu_resource_create_blob") Fixes: 32db3c63ae11 ("virtio-gpu: Add virtio_gpu_set_scanout_blob") Signed-off-by: Akihiko Odaki --- hw/display/virtio-gpu.c | 66 +++++++++++++++++++++++++++++++++------------= ---- 1 file changed, 45 insertions(+), 21 deletions(-) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 996b77829511..d9305fd5af5f 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -37,7 +37,6 @@ =20 static struct virtio_gpu_simple_resource * virtio_gpu_find_check_resource(VirtIOGPU *g, uint32_t resource_id, - bool require_backing, const char *caller, uint32_t *error); =20 static void virtio_gpu_reset_bh(void *opaque); @@ -50,8 +49,7 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g, uint32_t pixels; void *data; =20 - res =3D virtio_gpu_find_check_resource(g, resource_id, false, - __func__, NULL); + res =3D virtio_gpu_find_check_resource(g, resource_id, __func__, NULL); if (!res) { return; } @@ -128,7 +126,6 @@ virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resourc= e_id) =20 static struct virtio_gpu_simple_resource * virtio_gpu_find_check_resource(VirtIOGPU *g, uint32_t resource_id, - bool require_backing, const char *caller, uint32_t *error) { struct virtio_gpu_simple_resource *res; @@ -143,17 +140,6 @@ virtio_gpu_find_check_resource(VirtIOGPU *g, uint32_t = resource_id, return NULL; } =20 - if (require_backing) { - if (!res->iov || (!res->image && !res->blob)) { - qemu_log_mask(LOG_GUEST_ERROR, "%s: no backing storage %d\n", - caller, resource_id); - if (error) { - *error =3D VIRTIO_GPU_RESP_ERR_UNSPEC; - } - return NULL; - } - } - return res; } =20 @@ -474,9 +460,24 @@ static void virtio_gpu_transfer_to_host_2d(VirtIOGPU *= g, virtio_gpu_t2d_bswap(&t2d); trace_virtio_gpu_cmd_res_xfer_toh_2d(t2d.resource_id); =20 - res =3D virtio_gpu_find_check_resource(g, t2d.resource_id, true, + res =3D virtio_gpu_find_check_resource(g, t2d.resource_id, __func__, &cmd->error); - if (!res || res->blob) { + if (!res) { + return; + } + + if (!res->image) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: resource %d is a blob\n", + __func__, t2d.resource_id); + cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; + return; + } + + if (!res->iov) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: resource %d has no backing storage\n", + __func__, t2d.resource_id); + cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; return; } =20 @@ -533,7 +534,7 @@ static void virtio_gpu_resource_flush(VirtIOGPU *g, trace_virtio_gpu_cmd_res_flush(rf.resource_id, rf.r.width, rf.r.height, rf.r.x, rf.r.y= ); =20 - res =3D virtio_gpu_find_check_resource(g, rf.resource_id, false, + res =3D virtio_gpu_find_check_resource(g, rf.resource_id, __func__, &cmd->error); if (!res) { return; @@ -771,12 +772,19 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g, return; } =20 - res =3D virtio_gpu_find_check_resource(g, ss.resource_id, true, + res =3D virtio_gpu_find_check_resource(g, ss.resource_id, __func__, &cmd->error); if (!res) { return; } =20 + if (!res->image) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: resource %d is a blob\n", + __func__, ss.resource_id); + cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; + return; + } + fb.format =3D pixman_image_get_format(res->image); bytes_pp =3D virtio_gpu_format_bytes_pp(fb.format); fb.width =3D pixman_image_get_width(res->image); @@ -866,12 +874,28 @@ static void virtio_gpu_set_scanout_blob(VirtIOGPU *g, return; } =20 - res =3D virtio_gpu_find_check_resource(g, ss.resource_id, true, + res =3D virtio_gpu_find_check_resource(g, ss.resource_id, __func__, &cmd->error); if (!res) { return; } =20 + if (res->image) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: resource %d is not a blob\n", + __func__, ss.resource_id); + cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; + return; + } + + if (!res->iov) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: resource %d has no backing storage\n", + __func__, ss.resource_id); + cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; + return; + } + if (!virtio_gpu_scanout_blob_to_fb(&fb, &ss, res->blob_size)) { cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; return; @@ -1047,7 +1071,7 @@ virtio_gpu_resource_detach_backing(VirtIOGPU *g, virtio_gpu_bswap_32(&detach, sizeof(detach)); trace_virtio_gpu_cmd_res_back_detach(detach.resource_id); =20 - res =3D virtio_gpu_find_check_resource(g, detach.resource_id, true, + res =3D virtio_gpu_find_check_resource(g, detach.resource_id, __func__, &cmd->error); if (!res) { return; --=20 2.55.0