On 19/7/26 13:35, Akihiko Odaki wrote:
virtio_gpu_do_set_scanout() validates the stride field of struct virtio_gpu_framebuffer against the bytes_pp field, but bytes_pp in the migration stream may be inconsistent with the format field, which pixman_image_create_bits() uses when it accesses the framebuffer. That validation is therefore incomplete.To avoid the trouble of synchronizing the two fields, remove bytes_pp, and always derive its value from format. Removing bytes_pp is safe because no released version of QEMU uses its migrated value. Fixes: 7b5574225429 ("hw/display: check frame buffer can hold blob") Cc: [email protected] Signed-off-by: Akihiko Odaki <[email protected]> --- Based-on: <[email protected]> ("[PATCH] hw/display/virtio-gpu: validate stride against width on scanout") --- include/hw/virtio/virtio-gpu.h | 1 - hw/display/virtio-gpu.c | 27 +++++++++++++++++---------- 2 files changed, 17 insertions(+), 11 deletions(-)
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
