Hi,
While working on CVE-2026-66020 (which had a few revision on list), I
kept finding several places where virtio-gpu scanout and dmabuf
ownership was unclear.
The CVE comes from using a blob after RESOURCE_DETACH_BACKING has
unmapped its memory. Following that path also found stale dmabuf
references, duplicated scanout bookkeeping, and inconsistent cleanup
between display backends.
Those changes touch a lot of area and I have done basic testing with the
various backends. I would not recommend backporting them all to stable.
The first 2 patches address CVE-2026-66020 in the general case and
should be safe to backport.
thanks
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
Changes in v2: addresses Akihiko review
- reorder to have CVE fix first, easily back-portable (but also more
limited fix)
- include virtio_gpu_{simple,virgl}_resource_new() patch, and other sent
separately
- move draw_submitted from QemuDmaBuf to VirtualGfxConsole
- contrib/vhost-user-gpu: disable scanouts on resource unref
- drop rfc, collect rb, adjust commit messages
- Link to v1: https://lore.kernel.org/qemu-devel/20260825-virtio-gpu-cleanup-v1-0-d3bb612b9975@redhat.com
---
Marc-André Lureau (25):
virtio-gpu: disable blob scanouts on mapping cleanup
virtio-gpu: fix use-after-free on blob cursor after detach
hw/display/virtio-gpu: introduce virtio_gpu_{simple,virgl}_resource_new()
virtio-gpu/virgl: free BHs and timers on renderer reset
hw/display/virtio-gpu: set share_handle for udmabuf blob resources
ui/gtk: move GL fence tracking from QemuDmaBuf to VirtualGfxConsole
ui/gtk: move draw_submitted from QemuDmaBuf to VirtualGfxConsole
ui/dbus: disable scanout iff dmabuf is current
virtio-gpu: store the scanout DMABUF in virtio_gpu_scanout
ui/console: disable GL scanout when dmabuf is the active one
ui/sdl2: clear guest_fb.dmabuf on release
ui/dmabuf: own and close fds on free
ui: make GL context current before releasing DMA-BUF textures
virtio-gpu: release the dmabuf when a scanout is disabled
contrib/vhost-user-gpu: drop scanout_bitmask bookkeeping
virtio-gpu-rutabaga: fix scanout handling
virtio-gpu: drop scanout_bitmask bookkeeping
virtio-gpu: release dmabuf when switching to a surface
virtio-gpu/virgl: release dmabuf when a texture replaces a scanout
virtio-gpu: consolidate disabling scanout
virtio-gpu: minor refactoring
virtio-gpu/virgl: disable scanouts on resource unref
virtio-gpu: extract virtio_gpu_disable_scanout_for_resource helper
vhost-user-gpu: release DMA-BUFs on scanout disable, reset and finalize
contrib/vhost-user-gpu: disable scanouts on resource unref
contrib/vhost-user-gpu/vhost-user-gpu.c | 28 ++----
contrib/vhost-user-gpu/virgl.c | 12 +++
hw/display/vhost-user-gpu.c | 19 ++++-
hw/display/virtio-gpu-rutabaga.c | 38 ++++-----
hw/display/virtio-gpu-udmabuf-stubs.c | 2 +-
hw/display/virtio-gpu-udmabuf.c | 89 +++++++------------
hw/display/virtio-gpu-virgl.c | 131 +++++++++++++++++-----------
hw/display/virtio-gpu.c | 147 +++++++++++++++++++++-----------
hw/vfio/display.c | 1 -
include/hw/virtio/virtio-gpu.h | 31 ++++---
include/ui/dmabuf.h | 7 --
include/ui/egl-helpers.h | 4 +-
include/ui/gtk.h | 14 ++-
ui/console.c | 3 +
ui/dbus-listener.c | 69 ++++++++++-----
ui/dmabuf.c | 64 ++------------
ui/egl-headless.c | 2 +
ui/egl-helpers.c | 15 ++--
ui/gtk-egl.c | 55 +++++++-----
ui/gtk-gl-area.c | 33 ++++---
ui/gtk.c | 43 ++++++----
ui/sdl2-gl.c | 6 ++
ui/spice-display.c | 2 +
23 files changed, 449 insertions(+), 366 deletions(-)
---
base-commit: 99e54ab5e7a6efc945af6d5661842155d1f3fc7a
change-id: 20260825-virtio-gpu-cleanup-dfb2ba185936
Best regards,
--
Marc-André Lureau <marcandre.lureau@redhat.com>