The blob size is encoded as a 64-bit integer in the virtio protocol, but
it is encoded as a 32-bit integer in the migration stream, and
a large blob whose size cannot be expressed in a 32-bit integer will
be corrupted after migration. Deny creating such large blobs.
Fixes: 10b9ddbc83b9 ("Revert "virtio-gpu: block migration of VMs with
blob=true"")
Signed-off-by: Akihiko Odaki <[email protected]>
---
hw/display/virtio-gpu.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 718ba3039290..a5aa37aebd0e 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -352,6 +352,14 @@ static void virtio_gpu_resource_create_blob(VirtIOGPU *g,
return;
}
+ if (cblob.size > UINT32_MAX) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: blob too large (%" PRIu64 "> %" PRIu32 ")\n",
+ __func__, cblob.size, UINT32_MAX);
+ cmd->error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY;
+ return;
+ }
+
if (virtio_gpu_find_resource(g, cblob.resource_id)) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: resource already exists %d\n",
__func__, cblob.resource_id);
---
base-commit: 006a22cb26998998385b104db1ff9466ef2f3153
change-id: 20260725-blob-8a6a1a85601a
Best regards,
--
Akihiko Odaki <[email protected]>
