Hi,
While working on CVE-2026-66020 (which had a few revision on list), I
kept finding several places where virtio-gpu scanout and dmabuf
ownership was unclear.
The CVE comes from using a blob after RESOURCE_DETACH_BACKING has
unmapped its memory. Following that path also found stale dmabuf
references, duplicated scanout bookkeeping, and inconsistent cleanup
between display backends.
Those changes touch a lot of area and I have done basic testing with the
various backends. I would not recommend backporting them all to stable.
The first 2 patches address CVE-2026-66020 in the general case and
should be safe to backport.
thanks
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
Changes in v4:
- replaced "ui: make GL context current before releasing DMA-BUF
textures" with more complete "ui: make GL context current in display
backend callbacks"
- rebase, drop eof line leftover, collect rb trailer
- Link to v3: https://lore.kernel.org/qemu-devel/20260909-virtio-gpu-cleanup-v3-0-99266590e79d@redhat.com
Changes in v3:
- updated "virtio-gpu: fix use-after-free on blob cursor", now "clear res->blob on mapping cleanup"
- always disable GL when clearning scanout in "virtio-gpu: consolidate disabling scanout"
- drop "vhost-user-gpu: release DMA-BUFs on scanout disable" for now
- rebased, collect rb trailers
- Link to v2: https://lore.kernel.org/qemu-devel/20260904-virtio-gpu-cleanup-v2-0-15b5ae6b0023@redhat.com
Changes in v2: addresses Akihiko review
- reorder to have CVE fix first, easily back-portable (but also more
limited fix)
- include virtio_gpu_{simple,virgl}_resource_new() patch, and other sent
separately
- move draw_submitted from QemuDmaBuf to VirtualGfxConsole
- contrib/vhost-user-gpu: disable scanouts on resource unref
- drop rfc, collect rb, adjust commit messages
- Link to v1: https://lore.kernel.org/qemu-devel/20260825-virtio-gpu-cleanup-v1-0-d3bb612b9975@redhat.com
---
Marc-André Lureau (24):
virtio-gpu: disable blob scanouts on mapping cleanup
virtio-gpu: clear res->blob on mapping cleanup
hw/display/virtio-gpu: introduce virtio_gpu_{simple,virgl}_resource_new()
virtio-gpu/virgl: free BHs and timers on renderer reset
hw/display/virtio-gpu: set share_handle for udmabuf blob resources
ui/gtk: move GL fence tracking from QemuDmaBuf to VirtualGfxConsole
ui/gtk: move draw_submitted from QemuDmaBuf to VirtualGfxConsole
ui/dbus: disable scanout iff dmabuf is current
virtio-gpu: store the scanout DMABUF in virtio_gpu_scanout
ui/console: disable GL scanout when dmabuf is the active one
ui/sdl2: clear guest_fb.dmabuf on release
ui/dmabuf: own and close fds on free
ui: make GL context current in display backend callbacks
virtio-gpu: release the dmabuf when a scanout is disabled
contrib/vhost-user-gpu: drop scanout_bitmask bookkeeping
virtio-gpu-rutabaga: fix scanout handling
virtio-gpu: drop scanout_bitmask bookkeeping
virtio-gpu: release dmabuf when switching to a surface
virtio-gpu/virgl: release dmabuf when a texture replaces a scanout
virtio-gpu: consolidate disabling scanout
virtio-gpu: minor refactoring
virtio-gpu/virgl: disable scanouts on resource unref
virtio-gpu: extract virtio_gpu_disable_scanout_for_resource helper
contrib/vhost-user-gpu: disable scanouts on resource unref
contrib/vhost-user-gpu/vhost-user-gpu.c | 28 ++----
contrib/vhost-user-gpu/virgl.c | 12 +++
hw/display/vhost-user-gpu.c | 1 -
hw/display/virtio-gpu-rutabaga.c | 38 ++++----
hw/display/virtio-gpu-udmabuf-stubs.c | 2 +-
hw/display/virtio-gpu-udmabuf.c | 89 ++++++-------------
hw/display/virtio-gpu-virgl.c | 135 +++++++++++++++++-----------
hw/display/virtio-gpu.c | 150 +++++++++++++++++++++-----------
hw/vfio/display.c | 1 -
include/hw/virtio/virtio-gpu.h | 31 ++++---
include/ui/dmabuf.h | 7 --
include/ui/egl-helpers.h | 4 +-
include/ui/gtk.h | 14 ++-
ui/console.c | 3 +
ui/dbus-listener.c | 69 ++++++++++-----
ui/dmabuf.c | 65 ++------------
ui/egl-headless.c | 17 ++++
ui/egl-helpers.c | 15 ++--
ui/gtk-egl.c | 55 +++++++-----
ui/gtk-gl-area.c | 33 ++++---
ui/gtk.c | 43 +++++----
ui/sdl2-gl.c | 7 ++
ui/spice-display.c | 2 +
23 files changed, 452 insertions(+), 369 deletions(-)
---
base-commit: 1df256f5968e9f7c3c4533a1383b071c044a36d6
change-id: 20260825-virtio-gpu-cleanup-dfb2ba185936
Best regards,
--
Marc-André Lureau <marcandre.lureau@redhat.com>