On 2026/07/19 17:07, Marc-André Lureau wrote:
Hi
On Sun, Jul 19, 2026 at 11:51 AM Akihiko Odaki
<[email protected]> wrote:
On 2026/07/19 16:33, Michael Tokarev wrote:
[Resending with the correct email of Akihiko Odaki, please excuse the
duplicate]
On 7/17/26 14:52, Marc-André Lureau wrote:
Various UI/security-related fixes for 11.1
----------------------------------------------------------------
Akihiko Odaki (3):
ui/gtk: Narrow DMA-BUF critical section
hw/display/virtio-gpu: reject strides exceeding INT_MAX
hw/display/virtio-gpu: Check pixman_image_create_bits() results
Marc-André Lureau (12):
i386/tdx: fix uninitialized variable warning in tdx_check_features
ui/vnc: fix OOB write in vnc_refresh_lossy_rect
ui/vnc: validate color shifts in SetPixelFormat
ui/vnc: use RFB wire types for client message handlers
ui/input-barrier: fix off-by-one in keycode bounds check
ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
ui/vnc: validate SetPixelFormat field ranges
hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
hw/display/virtio-gpu: validate stride against width on scanout
hw/display/virtio-gpu: cap submit_3d command buffer allocation
hw/display/virtio-gpu: handle migration iov allocation failure
Hi!
Hi Michael, Marc-André,
Is there anything in there which should *not* go
to the stable qemu series?
(besides fixes for code which is not in releases, if any)
It feels like everything in this pullreq should be picked up
for qemu-stable.
The hw/display/virtio-gpu patches are generally good for stable, with
one exception:
"hw/display/virtio-gpu: validate stride against width on scanout"
This patch doesn't account for the late feedback I sent here:
https://lore.kernel.org/qemu-devel/[email protected]/
Marc-André: My apologies for the timing, but please check the linked
thread.
Tampering with migration stream is still being discussed, in the
meantime the patch fixes malicious guest gpu usage. Can you send a
follow up patch?
I sent one:
https://lore.kernel.org/qemu-devel/[email protected]/
("[PATCH] hw/display/virtio-gpu: Remove the bytes_pp field")
Michael: You may holding off on that specific patch for qemu-stable
until we clear up that edge case, but at least it's not harmful. I think
my patches and the other virtio-gpu patches are ready.
One correction: we need to apply "hw/display/virtio-gpu: validate stride
against width on scanout" and the follow up patch at the same time.
Otherwise we will have a user of the bytes_pp field, which the follow up
patch drops.
Regards,
Akihiko Odaki
