On 7/10/26 16:43, [email protected] wrote:
From: Marc-André Lureau <[email protected]>
Snapshot chunk.data_size into a host-local variable before passing it to
qxl_phys2virt() for validation, and pass it through qxl_cursor() and
qxl_unpack_chunks() so that no subsequent code re-reads the field.
Without this, a racing vCPU can inflate data_size between the
qxl_phys2virt() validation and the memcpy in qxl_unpack_chunks(),
causing a source read past the validated region. In practice the read
stays within the guest's own VRAM mmap, so the impact is limited.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3757
Reported-by: Feifan Qian <[email protected]>
Signed-off-by: Marc-Andre Lureau <[email protected]>
This feels like a qemu-stable material. I'm picking it up for the
current qemu stable series. Please let me know if I should not.
Thanks,
/mjt
