From nobody Sun Jul 26 12:38:11 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linux.alibaba.com ARC-Seal: i=1; a=rsa-sha256; t=1782280590; cv=none; d=zohomail.com; s=zohoarc; b=bXEm6lKHvyQWRH0VaoBzrWsL+33OnMjlU3JkibpGYpJD9WfiLgNtnREnIYoKjz++t1XyEmsHqk5P2NoNUTapEq3pb+1uinWhuz/CL3Zy1F/l2AtRIRd/hnUTOfmP2XyJklyc/Ya9j0Dq1fubvzAvuzAtrGgVHQwl5HteNU7AycU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782280590; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=IK9vwdDkouL8wrN92t1Xa5aGiE/m6O0md75byRhvJJ8=; b=KWZcV++vR5G61YMT4ef6PaaDqr0ryDB7h+VNHfRSrlver3eaDegKZ8Gf01V6eK4Shu0h27ni3IoLT3DvULDxyrXk965alNmJRsJLvfTHrY01jMcoyg1vsVM9hXT3ubTxZM4893p2QDBqmcrduOGAIt/OHxwkZPrPjQdpLh/BG2A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782280590166692.846539085724; Tue, 23 Jun 2026 22:56:30 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wcGb3-0002Cd-O5; Wed, 24 Jun 2026 01:56:25 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wcGb0-0001ry-HB for qemu-devel@nongnu.org; Wed, 24 Jun 2026 01:56:22 -0400 Received: from [115.124.30.97] (helo=out30-97.freemail.mail.aliyun.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wcGav-0007IP-EM for qemu-devel@nongnu.org; Wed, 24 Jun 2026 01:56:22 -0400 Received: from localhost(mailfrom:guobin@linux.alibaba.com fp:SMTPD_---0X5X450F_1782280559 cluster:ay36) by smtp.aliyun-inc.com; Wed, 24 Jun 2026 13:55:59 +0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1782280560; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=IK9vwdDkouL8wrN92t1Xa5aGiE/m6O0md75byRhvJJ8=; b=dtByWnLdTclmqkMt2RLZ/ASmbT/uhh8mHUHHSWDNZQTnGnJao6dwqxSGe6kPSn47mbDk/RuekGiDbAZrSvmvGBSsD5lYaXVNJ/FJt462G+pKnbKBIy6bUFvsgV5cK8/ji2fx73nbeeRhvBOuXapGkAKGJma//QPF5tw7iprHMqQ= X-Alimail-AntiSpam: AC=PASS; BC=-1|-1; BR=01201311R281e4; CH=green; DM=||false|; DS=||; FP=0|-1|-1|-1|0|-1|-1|-1; HT=maildocker-contentspam033032089153; MF=guobin@linux.alibaba.com; NM=1; PH=DS; RN=5; SR=0; TI=SMTPD_---0X5X450F_1782280559; From: Bin Guo To: alex.bennee@linaro.org Cc: mst@redhat.com, odaki@rsg.ci.i.u-tokyo.ac.jp, dmitry.osipenko@collabora.com, qemu-devel@nongnu.org Subject: [PATCH 1/3] virtio-gpu-virgl: validate resource existence on ctx attach/detach Date: Wed, 24 Jun 2026 13:55:55 +0800 Message-ID: <32f6f23fb4880a4f1ec3056fde306332d54e442f.1782270919.git.guobin@linux.alibaba.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Host-Lookup-Failed: Reverse DNS lookup failed for 115.124.30.97 (deferred) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=115.124.30.97; envelope-from=guobin@linux.alibaba.com; helo=out30-97.freemail.mail.aliyun.com X-Spam_score_int: -166 X-Spam_score: -16.7 X-Spam_bar: ---------------- X-Spam_report: (-16.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linux.alibaba.com) X-ZM-MESSAGEID: 1782280592425158500 Content-Type: text/plain; charset="utf-8" The CTX_ATTACH_RESOURCE and CTX_DETACH_RESOURCE command handlers forwarded the guest-supplied resource_id directly to virglrenderer without verifying that the resource actually exists. A malicious or buggy guest could reference an invalid resource_id, potentially causing undefined behavior inside virglrenderer. Resolve the long-standing "TODO add security" comments by checking the resource against QEMU's own resource table (virtio_gpu_find_resource) before forwarding the request. This is consistent with how other command handlers in virtio-gpu.c validate resource references. Signed-off-by: Bin Guo Reviewed-by: Marc-Andr=C3=A9 Lureau --- hw/display/virtio-gpu-virgl.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c index 60c78af06a..b992ffc44e 100644 --- a/hw/display/virtio-gpu-virgl.c +++ b/hw/display/virtio-gpu-virgl.c @@ -743,6 +743,14 @@ static void virgl_cmd_ctx_attach_resource(VirtIOGPU *g, trace_virtio_gpu_cmd_ctx_res_attach(att_res.hdr.ctx_id, att_res.resource_id); =20 + if (!virtio_gpu_find_resource(g, att_res.resource_id)) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: invalid resource %d for ctx %d\n", + __func__, att_res.resource_id, att_res.hdr.ctx_id); + cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; + return; + } + virgl_renderer_ctx_attach_resource(att_res.hdr.ctx_id, att_res.resourc= e_id); } =20 @@ -755,6 +763,14 @@ static void virgl_cmd_ctx_detach_resource(VirtIOGPU *g, trace_virtio_gpu_cmd_ctx_res_detach(det_res.hdr.ctx_id, det_res.resource_id); =20 + if (!virtio_gpu_find_resource(g, det_res.resource_id)) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: invalid resource %d for ctx %d\n", + __func__, det_res.resource_id, det_res.hdr.ctx_id); + cmd->error =3D VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID; + return; + } + virgl_renderer_ctx_detach_resource(det_res.hdr.ctx_id, det_res.resourc= e_id); } =20 @@ -1073,11 +1089,9 @@ void virtio_gpu_virgl_process_cmd(VirtIOGPU *g, virgl_cmd_resource_unref(g, cmd, &cmd_suspended); break; case VIRTIO_GPU_CMD_CTX_ATTACH_RESOURCE: - /* TODO add security */ virgl_cmd_ctx_attach_resource(g, cmd); break; case VIRTIO_GPU_CMD_CTX_DETACH_RESOURCE: - /* TODO add security */ virgl_cmd_ctx_detach_resource(g, cmd); break; case VIRTIO_GPU_CMD_GET_CAPSET_INFO: --=20 2.50.1 (Apple Git-155) From nobody Sun Jul 26 12:38:11 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linux.alibaba.com ARC-Seal: i=1; a=rsa-sha256; t=1782280585; cv=none; d=zohomail.com; s=zohoarc; b=WuQXp3pU3fGrz3QsoGdHNTO379DH52LqOaUKbIoWRX1hSvDO1li3n1L5Pvb1sdtzIHkb5vHhk+km4zHyH+t7HTZ4I+YL3in/OZR6LHoQATJjybToQserkB6RaR8TsyhDUGMECvfhFKPtt3e39BzAzSCNMBmwxs1rzt3GewErP/M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782280585; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=T4uWiRcqmfp/zJHVubCWRZy63xO5YRIuhLOjvS7bc+k=; b=BZWJaRyBEseMecsaV6bM1eCyV0V4P7IKb20KuuMoEeW3Oa0keUA43OuLtdKa3DrKcwEPN4xM66XMhSzFHjCHYrSqd/TbmDVsWhXgQXvC9ucMWSu7f1H/FNKELwplD6iemyU01zUOOSDBHHBnHtW3qpLb7v+URNu2F3hXa1urHPQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782280585767935.3460055060714; Tue, 23 Jun 2026 22:56:25 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wcGb1-0001vE-ML; Wed, 24 Jun 2026 01:56:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wcGay-0001gb-Tc for qemu-devel@nongnu.org; Wed, 24 Jun 2026 01:56:21 -0400 Received: from [115.124.30.99] (helo=out30-99.freemail.mail.aliyun.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wcGav-0007Ia-DR for qemu-devel@nongnu.org; Wed, 24 Jun 2026 01:56:20 -0400 Received: from localhost(mailfrom:guobin@linux.alibaba.com fp:SMTPD_---0X5X3L9G_1782280560 cluster:ay36) by smtp.aliyun-inc.com; Wed, 24 Jun 2026 13:56:00 +0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1782280561; h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type; bh=T4uWiRcqmfp/zJHVubCWRZy63xO5YRIuhLOjvS7bc+k=; b=HFhLX5kDX2pWd6MogC+FViAnxPLhzBATCeuDt33Uu2zNWrsOt4YuqVfzvmbW9C5JAiy0HythfeoxR9epaAaRct9Z9EUM58xiNsgf8FZTzXlPihH2kr733Y8qIWdj/zi9N/AlzUzO8x4pkneQhIwnFQ81mXA4cQNBA6SaBMTu0DA= X-Alimail-AntiSpam: AC=PASS; BC=-1|-1; BR=01201311R121e4; CH=green; DM=||false|; DS=||; FP=0|-1|-1|-1|0|-1|-1|-1; HT=maildocker-contentspam033037033178; MF=guobin@linux.alibaba.com; NM=1; PH=DS; RN=5; SR=0; TI=SMTPD_---0X5X3L9G_1782280560; From: Bin Guo To: alex.bennee@linaro.org Cc: mst@redhat.com, odaki@rsg.ci.i.u-tokyo.ac.jp, dmitry.osipenko@collabora.com, qemu-devel@nongnu.org Subject: [PATCH 2/3] virtio-gpu-virgl: replace fprintf(stderr) with qemu_log_mask and trace events Date: Wed, 24 Jun 2026 13:55:56 +0800 Message-ID: X-Mailer: git-send-email 2.50.1 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Host-Lookup-Failed: Reverse DNS lookup failed for 115.124.30.99 (deferred) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=115.124.30.99; envelope-from=guobin@linux.alibaba.com; helo=out30-99.freemail.mail.aliyun.com X-Spam_score_int: -166 X-Spam_score: -16.7 X-Spam_bar: ---------------- X-Spam_report: (-16.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linux.alibaba.com) X-ZM-MESSAGEID: 1782280586723158500 Three places in virtio-gpu-virgl.c used fprintf(stderr) directly, bypassing QEMU's logging and tracing infrastructure: 1. Command error reporting in virgl_cmd_process() =E2=80=94 replace with qemu_log_mask(LOG_GUEST_ERROR, ...) so the message is filtered via -d guest_errors, consistent with virtio-gpu.c. 2. Statistics output in virtio_gpu_print_stats() =E2=80=94 replace with trace_virtio_gpu_virgl_stats() so the data is captured by the tracing subsystem instead of unconditionally hitting stderr. 3. Idle statistics message =E2=80=94 replace with trace_virtio_gpu_virgl_stats_idle() to preserve the existing "idle" indication without stderr pollution. Add the two new trace events to hw/display/trace-events. Signed-off-by: Bin Guo Reviewed-by: Marc-Andr=C3=A9 Lureau --- hw/display/trace-events | 2 ++ hw/display/virtio-gpu-virgl.c | 15 +++++++-------- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/hw/display/trace-events b/hw/display/trace-events index 4bfc457fba..cf1e852b45 100644 --- a/hw/display/trace-events +++ b/hw/display/trace-events @@ -58,6 +58,8 @@ virtio_gpu_fence_resp(uint64_t fence) "fence 0x%" PRIx64 virtio_gpu_inc_inflight_fences(uint32_t inflight) "in-flight+ %u" virtio_gpu_dec_inflight_fences(uint32_t inflight) "in-flight- %u" virtio_gpu_cmd_suspended(uint32_t cmd) "cmd 0x%x" +virtio_gpu_virgl_stats(int requests, int max_inflight, int req_3d, int byt= es_3d) "stats: vq req %d, max_inflight %d -- 3D %d (%d bytes)" +virtio_gpu_virgl_stats_idle(void) "stats: idle" =20 # qxl.c disable qxl_io_write_vga(int qid, const char *mode, uint32_t addr, uint32_= t val) "%d %s addr=3D%u val=3D%u" diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c index b992ffc44e..afb0d0984a 100644 --- a/hw/display/virtio-gpu-virgl.c +++ b/hw/display/virtio-gpu-virgl.c @@ -1129,8 +1129,8 @@ void virtio_gpu_virgl_process_cmd(VirtIOGPU *g, return; } if (cmd->error) { - fprintf(stderr, "%s: ctrl 0x%x, error 0x%x\n", __func__, - cmd->cmd_hdr.type, cmd->error); + qemu_log_mask(LOG_GUEST_ERROR, "%s: ctrl 0x%x, error 0x%x\n", + __func__, cmd->cmd_hdr.type, cmd->error); virtio_gpu_ctrl_response_nodata(g, cmd, cmd->error); return; } @@ -1370,17 +1370,16 @@ static void virtio_gpu_print_stats(void *opaque) VirtIOGPUGL *gl =3D VIRTIO_GPU_GL(g); =20 if (g->stats.requests) { - fprintf(stderr, "stats: vq req %4d, %3d -- 3D %4d (%5d)\n", - g->stats.requests, - g->stats.max_inflight, - g->stats.req_3d, - g->stats.bytes_3d); + trace_virtio_gpu_virgl_stats(g->stats.requests, + g->stats.max_inflight, + g->stats.req_3d, + g->stats.bytes_3d); g->stats.requests =3D 0; g->stats.max_inflight =3D 0; g->stats.req_3d =3D 0; g->stats.bytes_3d =3D 0; } else { - fprintf(stderr, "stats: idle\r"); + trace_virtio_gpu_virgl_stats_idle(); } timer_mod(gl->print_stats, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 100= 0); } --=20 2.50.1 (Apple Git-155) From nobody Sun Jul 26 12:38:11 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linux.alibaba.com ARC-Seal: i=1; a=rsa-sha256; t=1782280595; cv=none; d=zohomail.com; s=zohoarc; b=IX65VekqTAbjmhzD8RrbZpTg9VKe9hq+EIQRagL23JxBLuTv6w3G72Si+C2tM7wU3sJqrY90CghSTpbxgCa+H96/m7oKsNkgmtapJquPSSA0Sx6ArffTyCNSL/2CESmK1DvOvkou9HCHgpoXCp3tmI5Il+T2jKAeItg2cRhQRvQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782280595; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ofEdMY9zt99tdbxUiyYRHfOD4DlMcGw6BT6VQvKcGvo=; b=Hw0gJ5erkgg/17cLcEP/b81F88+Cfm09O3JJkj8b3tkpMFj91vgdSRK3edvDK2hZmLTkKApP9Mveo5BFWEf1kPsyufazjVk4vQ52cWcuR3+V8mmuAhdJdMLSyk5hNP9KuKc9ahhgr7UPKGbid/3VX+aQPyJxpt7T67iSNbB2jkA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782280595685347.32586021886925; Tue, 23 Jun 2026 22:56:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wcGbA-0002rc-Fz; Wed, 24 Jun 2026 01:56:32 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wcGay-0001gm-U7 for qemu-devel@nongnu.org; Wed, 24 Jun 2026 01:56:21 -0400 Received: from [115.124.30.98] (helo=out30-98.freemail.mail.aliyun.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wcGav-0007JT-IX for qemu-devel@nongnu.org; Wed, 24 Jun 2026 01:56:20 -0400 Received: from localhost(mailfrom:guobin@linux.alibaba.com fp:SMTPD_---0X5X3L9i_1782280560 cluster:ay36) by smtp.aliyun-inc.com; Wed, 24 Jun 2026 13:56:01 +0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1782280562; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=ofEdMY9zt99tdbxUiyYRHfOD4DlMcGw6BT6VQvKcGvo=; b=jpp3sfWXASU/J4e+DDnZfJIaGpPZqsS1MeWNcnnPQt5IZu+GNKaa7jsVVpPLuC6a8Tjgh4DJslPvNcv2m1Sr4bH8p3YzMy861MGoI1zD2Fp7hKRvPZ52vyZEkOapA+DU8wuMErjqM+Jw7BxejKuKl+z9jsR2mo5ykAAOUtr4m2w= X-Alimail-AntiSpam: AC=PASS; BC=-1|-1; BR=01201311R251e4; CH=green; DM=||false|; DS=||; FP=0|-1|-1|-1|0|-1|-1|-1; HT=maildocker-contentspam033037009110; MF=guobin@linux.alibaba.com; NM=1; PH=DS; RN=5; SR=0; TI=SMTPD_---0X5X3L9i_1782280560; From: Bin Guo To: alex.bennee@linaro.org Cc: mst@redhat.com, odaki@rsg.ci.i.u-tokyo.ac.jp, dmitry.osipenko@collabora.com, qemu-devel@nongnu.org Subject: [PATCH 3/3] virtio-gpu: use unsigned shift for scanout bitmask operations Date: Wed, 24 Jun 2026 13:55:57 +0800 Message-ID: <22d21cfbe4466c27e33e979717957f48673d4647.1782270919.git.guobin@linux.alibaba.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Host-Lookup-Failed: Reverse DNS lookup failed for 115.124.30.98 (deferred) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=115.124.30.98; envelope-from=guobin@linux.alibaba.com; helo=out30-98.freemail.mail.aliyun.com X-Spam_score_int: -166 X-Spam_score: -16.7 X-Spam_bar: ---------------- X-Spam_report: (-16.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linux.alibaba.com) X-ZM-MESSAGEID: 1782280596548158500 Content-Type: text/plain; charset="utf-8" The scanout_bitmask field is uint32_t, but all six bit operations used the signed literal `1 << shift`. When the shift count reaches 31 this is undefined behavior (signed integer overflow). Replace every occurrence with `1U << shift` to perform an unsigned shift, which is well-defined for all bit positions 0-31. No functional change; the result is already stored in a uint32_t, so the generated code is identical on most platforms. Signed-off-by: Bin Guo Reviewed-by: Marc-Andr=C3=A9 Lureau --- hw/display/virtio-gpu.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 88526051a9..9dfffa270a 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -387,7 +387,7 @@ void virtio_gpu_disable_scanout(VirtIOGPU *g, int scano= ut_id) =20 res =3D virtio_gpu_find_resource(g, scanout->resource_id); if (res) { - res->scanout_bitmask &=3D ~(1 << scanout_id); + res->scanout_bitmask &=3D ~(1U << scanout_id); } =20 qemu_console_set_surface(scanout->con, NULL); @@ -405,7 +405,7 @@ static void virtio_gpu_resource_destroy(VirtIOGPU *g, =20 if (res->scanout_bitmask) { for (i =3D 0; i < g->parent_obj.conf.max_outputs; i++) { - if (res->scanout_bitmask & (1 << i)) { + if (res->scanout_bitmask & (1U << i)) { virtio_gpu_disable_scanout(g, i); } } @@ -571,7 +571,7 @@ static void virtio_gpu_resource_flush(VirtIOGPU *g, for (i =3D 0; i < g->parent_obj.conf.max_outputs; i++) { QemuRect rect; =20 - if (!(res->scanout_bitmask & (1 << i))) { + if (!(res->scanout_bitmask & (1U << i))) { continue; } scanout =3D &g->parent_obj.scanout[i]; @@ -605,10 +605,10 @@ void virtio_gpu_update_scanout(VirtIOGPU *g, scanout =3D &g->parent_obj.scanout[scanout_id]; ores =3D virtio_gpu_find_resource(g, scanout->resource_id); if (ores) { - ores->scanout_bitmask &=3D ~(1 << scanout_id); + ores->scanout_bitmask &=3D ~(1U << scanout_id); } =20 - res->scanout_bitmask |=3D (1 << scanout_id); + res->scanout_bitmask |=3D (1U << scanout_id); scanout->resource_id =3D res->resource_id; scanout->x =3D r->x; scanout->y =3D r->y; @@ -1490,7 +1490,7 @@ static int virtio_gpu_post_load(void *opaque, int ver= sion_id) if (scanout->cursor.resource_id) { update_cursor(g, &scanout->cursor); } - res->scanout_bitmask |=3D (1 << i); + res->scanout_bitmask |=3D (1U << i); } =20 return 0; --=20 2.50.1 (Apple Git-155)