The following changes since commit 257bf4f160c50ca8c4ebd603f519f5c786013fb7:
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2026-09-10 11:08:04 +0100)
are available in the Git repository at:
https://gitlab.com/marcandre.lureau/qemu.git tags/virtio-gpu-pr-v1
for you to fetch changes up to d26343c12d84227263b8d2fc89bac7632a98e00d:
contrib/vhost-user-gpu: disable scanouts on resource unref (2026-09-10 17:29:47 +0400)
----------------------------------------------------------------
Various virtio-gpu/dmabuf related fixes
Hi,
While working on CVE-2026-66020 (which had a few revision on list), I
kept finding several places where virtio-gpu scanout and dmabuf
ownership was unclear.
The CVE comes from using a blob after RESOURCE_DETACH_BACKING has
unmapped its memory. Following that path also found stale dmabuf
references, duplicated scanout bookkeeping, and inconsistent cleanup
between display backends.
Those changes touch a lot of area and I have done basic testing with the
various backends. I would not recommend backporting them all to stable.
The first 2 patches address CVE-2026-66020 in the general case and
should be safe to backport.
thanks
To: qemu-devel@nongnu.org
Cc: Alex Bennée <alex.bennee@linaro.org>
Cc: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Stefano Garzarella <sgarzare@redhat.com>
Cc: Alex Williamson <alex@shazbot.org>
Cc: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
Changes in v5:
- EDITME: describe what is new in this series revision.
- EDITME: use bulletpoints and terse descriptions.
- Link to v4: https://lore.kernel.org/qemu-devel/20260910-virtio-gpu-cleanup-v4-0-7d623714bd71@redhat.com
Changes in v4:
- replaced "ui: make GL context current before releasing DMA-BUF
textures" with more complete "ui: make GL context current in display
backend callbacks"
- rebase, drop eof line leftover, collect rb trailer
- Link to v3: https://lore.kernel.org/qemu-devel/20260909-virtio-gpu-cleanup-v3-0-99266590e79d@redhat.com
Changes in v3:
- updated "virtio-gpu: fix use-after-free on blob cursor", now "clear res->blob on mapping cleanup"
- always disable GL when clearning scanout in "virtio-gpu: consolidate disabling scanout"
- drop "vhost-user-gpu: release DMA-BUFs on scanout disable" for now
- rebased, collect rb trailers
- Link to v2: https://lore.kernel.org/qemu-devel/20260904-virtio-gpu-cleanup-v2-0-15b5ae6b0023@redhat.com
Changes in v2: addresses Akihiko review
- reorder to have CVE fix first, easily back-portable (but also more
limited fix)
- include virtio_gpu_{simple,virgl}_resource_new() patch, and other sent
separately
- move draw_submitted from QemuDmaBuf to VirtualGfxConsole
- contrib/vhost-user-gpu: disable scanouts on resource unref
- drop rfc, collect rb, adjust commit messages
- Link to v1: https://lore.kernel.org/qemu-devel/20260825-virtio-gpu-cleanup-v1-0-d3bb612b9975@redhat.com
----------------------------------------------------------------
Marc-André Lureau (24):
virtio-gpu: disable blob scanouts on mapping cleanup
virtio-gpu: clear res->blob on mapping cleanup
hw/display/virtio-gpu: introduce virtio_gpu_{simple,virgl}_resource_new()
virtio-gpu/virgl: free BHs and timers on renderer reset
hw/display/virtio-gpu: set share_handle for udmabuf blob resources
ui/gtk: move GL fence tracking from QemuDmaBuf to VirtualGfxConsole
ui/gtk: move draw_submitted from QemuDmaBuf to VirtualGfxConsole
ui/dbus: disable scanout iff dmabuf is current
virtio-gpu: store the scanout DMABUF in virtio_gpu_scanout
ui/console: disable GL scanout when dmabuf is the active one
ui/sdl2: clear guest_fb.dmabuf on release
ui/dmabuf: own and close fds on free
ui: make GL context current in display backend callbacks
virtio-gpu: release the dmabuf when a scanout is disabled
contrib/vhost-user-gpu: drop scanout_bitmask bookkeeping
virtio-gpu-rutabaga: fix scanout handling
virtio-gpu: drop scanout_bitmask bookkeeping
virtio-gpu: release dmabuf when switching to a surface
virtio-gpu/virgl: release dmabuf when a texture replaces a scanout
virtio-gpu: consolidate disabling scanout
virtio-gpu: minor refactoring
virtio-gpu/virgl: disable scanouts on resource unref
virtio-gpu: extract virtio_gpu_disable_scanout_for_resource helper
contrib/vhost-user-gpu: disable scanouts on resource unref
contrib/vhost-user-gpu/vhost-user-gpu.c | 28 ++----
contrib/vhost-user-gpu/virgl.c | 12 +++
hw/display/vhost-user-gpu.c | 1 -
hw/display/virtio-gpu-rutabaga.c | 38 ++++----
hw/display/virtio-gpu-udmabuf-stubs.c | 2 +-
hw/display/virtio-gpu-udmabuf.c | 89 +++++++------------
hw/display/virtio-gpu-virgl.c | 135 ++++++++++++++++++-----------
hw/display/virtio-gpu.c | 148 +++++++++++++++++++++-----------
hw/vfio/display.c | 1 -
include/hw/virtio/virtio-gpu.h | 31 ++++---
include/ui/dmabuf.h | 7 --
include/ui/egl-helpers.h | 4 +-
include/ui/gtk.h | 14 ++-
ui/console.c | 3 +
ui/dbus-listener.c | 69 ++++++++++-----
ui/dmabuf.c | 65 ++------------
ui/egl-headless.c | 17 ++++
ui/egl-helpers.c | 15 ++--
ui/gtk-egl.c | 55 +++++++-----
ui/gtk-gl-area.c | 33 ++++---
ui/gtk.c | 43 ++++++----
ui/sdl2-gl.c | 7 ++
ui/spice-display.c | 2 +
23 files changed, 450 insertions(+), 369 deletions(-)