From: Marc-André Lureau <marcandre.lureau@redhat.com>
The following changes since commit 257bf4f160c50ca8c4ebd603f519f5c786013fb7:
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2026-09-10 11:08:04 +0100)
are available in the Git repository at:
https://gitlab.com/marcandre.lureau/qemu.git tags/virtio-gpu-pr-v2
for you to fetch changes up to d6e516555805b95a7a935c3fd74568dabf7796f2:
contrib/vhost-user-gpu: disable scanouts on resource unref (2026-09-10 19:59:43 +0400)
----------------------------------------------------------------
Various virtio-gpu/dmabuf related fixes
While working on CVE-2026-66020 (which had a few revision on list), I
kept finding several places where virtio-gpu scanout and dmabuf
ownership was unclear.
The CVE comes from using a blob after RESOURCE_DETACH_BACKING has
unmapped its memory. Following that path also found stale dmabuf
references, duplicated scanout bookkeeping, and inconsistent cleanup
between display backends.
Those changes touch a lot of area and I have done basic testing with the
various backends. I would not recommend backporting them all to stable.
The first 2 patches address CVE-2026-66020 in the general case and
should be safe to backport.
----------------------------------------------------------------
Marc-André Lureau (24):
virtio-gpu: disable blob scanouts on mapping cleanup
virtio-gpu: clear res->blob on mapping cleanup
hw/display/virtio-gpu: introduce virtio_gpu_{simple,virgl}_resource_new()
virtio-gpu/virgl: free BHs and timers on renderer reset
hw/display/virtio-gpu: set share_handle for udmabuf blob resources
ui/gtk: move GL fence tracking from QemuDmaBuf to VirtualGfxConsole
ui/gtk: move draw_submitted from QemuDmaBuf to VirtualGfxConsole
ui/dbus: disable scanout iff dmabuf is current
virtio-gpu: store the scanout DMABUF in virtio_gpu_scanout
ui/console: disable GL scanout when dmabuf is the active one
ui/sdl2: clear guest_fb.dmabuf on release
ui/dmabuf: own and close fds on free
ui: make GL context current in display backend callbacks
virtio-gpu: release the dmabuf when a scanout is disabled
contrib/vhost-user-gpu: drop scanout_bitmask bookkeeping
virtio-gpu-rutabaga: fix scanout handling
virtio-gpu: drop scanout_bitmask bookkeeping
virtio-gpu: release dmabuf when switching to a surface
virtio-gpu/virgl: release dmabuf when a texture replaces a scanout
virtio-gpu: consolidate disabling scanout
virtio-gpu: minor refactoring
virtio-gpu/virgl: disable scanouts on resource unref
virtio-gpu: extract virtio_gpu_disable_scanout_for_resource helper
contrib/vhost-user-gpu: disable scanouts on resource unref
contrib/vhost-user-gpu/vhost-user-gpu.c | 28 ++----
contrib/vhost-user-gpu/virgl.c | 12 +++
hw/display/vhost-user-gpu.c | 1 -
hw/display/virtio-gpu-rutabaga.c | 38 ++++----
hw/display/virtio-gpu-udmabuf-stubs.c | 2 +-
hw/display/virtio-gpu-udmabuf.c | 89 +++++++------------
hw/display/virtio-gpu-virgl.c | 135 ++++++++++++++++++-----------
hw/display/virtio-gpu.c | 148 +++++++++++++++++++++-----------
hw/vfio/display.c | 1 -
include/hw/virtio/virtio-gpu.h | 31 ++++---
include/ui/dmabuf.h | 7 --
include/ui/egl-helpers.h | 4 +-
include/ui/gtk.h | 14 ++-
ui/console.c | 3 +
ui/dbus-listener.c | 69 ++++++++++-----
ui/dmabuf.c | 65 ++------------
ui/egl-headless.c | 17 ++++
ui/egl-helpers.c | 15 ++--
ui/gtk-egl.c | 55 +++++++-----
ui/gtk-gl-area.c | 33 ++++---
ui/gtk.c | 43 ++++++----
ui/sdl2-gl.c | 7 ++
ui/spice-display.c | 2 +
23 files changed, 450 insertions(+), 369 deletions(-)