Hi On Wed, Jul 22, 2026 at 2:01 PM Philippe Mathieu-Daudé <[email protected]> wrote: > > On 22/7/26 11:38, Michael Tokarev wrote: > > On 7/15/26 10:27, [email protected] wrote: > >> From: Marc-André Lureau <[email protected]> > >> > >> The qxl_phys2virt() call for guest_monitors_config only validates > >> sizeof(QXLMonitorsConfig), which covers the fixed header (count and > >> max_allowed) since commit 8efec0ef8bbc ("hw/display/qxl: Pass requested > >> buffer size to qxl_phys2virt()"), but not the flexible array member > >> heads[]. When count == 1, heads[0] is accessed without its memory being > >> validated, allowing a guest to cause an out-of-bounds read. > >> > >> Include sizeof(QXLHead) in the size passed to qxl_phys2virt() so that > >> the first head entry is validated within the guest memory slot, > >> preventing > >> guest-visible memory reading. > >> > >> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4027 > >> Reported-by: Tristan @TristanInSec > >> Signed-off-by: Marc-Andre Lureau <[email protected]> > > > > I'm picking this one up for the stable qemu series. > > Please let me know if I shouldn't. > > > > It would be nice if changes which should be picked up, > > had Cc: qemu-stable@ in the first place, to avoid this > > extra round-trip. I'm trying to keep it as simple as > > possible, only asking to reply if I should not pick it > > up, but it is more work for everyone still. > > Indeed this patch should had a 'Cc: qemu-stable@' tag.
It could. That said, properly testing fixes on older releases takes additional time and effort, and I prefer not to add Cc: qemu-stable@ unless I've verified the fix against those versions myself. I appreciate you taking care of the stable evaluation, but I prefer to keep my focus on master. Imho, we should not rush backports before they have received a little bit more testing, it could introduce regressions - the opposite of what I'd expect from -stable...
