VIRTIO_GPU_CMD_SET_SCANOUT_BLOB supplies a guest-controlled uint32_t
stride, but some downstream consumers take it as int. They may interpret
a value greater than INT_MAX as negative and cause issues:
- pixman_image_create_bits() takes the stride as int, and Pixman may
later access memory before the blob buffer.
- eglCreateImageKHR() also takes the stride as EGLint when importing the
DMA-BUF, and Mesa rejects it.
Reject such strides before scanout.
The check in virtio_gpu_scanout_blob_to_fb() rejects unsupported blob
configurations early. The check added in virtio_gpu_do_set_scanout()
covers migration post_load.
Fixes: 32db3c63ae11 ("virtio-gpu: Add virtio_gpu_set_scanout_blob")
Signed-off-by: Akihiko Odaki <[email protected]>
---
Based-on: <[email protected]>
("[PATCH] hw/display/virtio-gpu: validate stride against width on scanout")
---
hw/display/virtio-gpu.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index e00fb6effa50..9b54207feb37 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -654,6 +654,14 @@ static bool virtio_gpu_do_set_scanout(VirtIOGPU *g,
return false;
}
+ if (fb->stride > INT_MAX) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: stride is %" PRIu32
+ ", larger than the supported maximum (%d)\n",
+ __func__, fb->stride, INT_MAX);
+ *error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
+ return false;
+ }
+
g->parent_obj.enable = 1;
if (res->blob) {
@@ -769,6 +777,13 @@ bool virtio_gpu_scanout_blob_to_fb(struct
virtio_gpu_framebuffer *fb,
return false;
}
+ if (fb->stride > INT_MAX) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: stride is %" PRIu32
+ ", larger than the supported maximum (%d)\n",
+ __func__, fb->stride, INT_MAX);
+ return false;
+ }
+
fb->offset = ss->offsets[0] + ss->r.x * fb->bytes_pp + ss->r.y *
fb->stride;
fbend = fb->offset;
---
base-commit: d25b8018680d762145d55ceed4fa7a3a47ac646e
change-id: 20260716-int-6c94d32875b1
Best regards,
--
Akihiko Odaki <[email protected]>
