Hi On Thu, Jul 16, 2026 at 12:04 PM Akihiko Odaki <[email protected]> wrote: > > On 2026/07/16 16:37, Akihiko Odaki wrote: > > On 2026/07/16 5:10, [email protected] wrote: > >> From: Marc-André Lureau <[email protected]> > >> > >> Validate that the framebuffer stride is at least width * bytes_per_pixel > >> in both virtio_gpu_scanout_blob_to_fb() and virtio_gpu_do_set_scanout(). > >> > >> A guest can set a very small stride while using a large width. The total > >> size check (offset + stride * height <= blob_size) passes because > >> stride * height is small, but pixman reads width * bytes_per_pixel per > >> row, causing heap OOB reads. The leaked data is rendered to the host > >> display. > >> > >> The check is added in virtio_gpu_do_set_scanout() to cover all paths: > >> blob scanout, non-blob scanout and migration post_load. The additional > >> early check in virtio_gpu_scanout_blob_to_fb() rejects invalid blob > >> configurations early. > >> > >> Fixes: CVE-2026-63109 > >> Fixes: 144bd171c837 ("virtio-gpu: Support blob scanout using dmabuf fd") > > I cannot resolve commit 144bd171c837. Apparently the bug was introduced > by commit 7b5574225429 ("hw/display: check frame buffer can hold blob"). >
oh yes, that was an earlier version from a development branch, thanks..
