Hi
On Sat, Jul 25, 2026 at 11:14 AM Akihiko Odaki
<[email protected]> wrote:
>
> The blob size is encoded as a 64-bit integer in the virtio protocol, but
> it is encoded as a 32-bit integer in the migration stream, and
> a large blob whose size cannot be expressed in a 32-bit integer will
> be corrupted after migration. Deny creating such large blobs.
>
> Fixes: 10b9ddbc83b9 ("Revert "virtio-gpu: block migration of VMs with
> blob=true"")
also
Fixes: f66767f75c9c ("virtio-gpu: add virtio-gpu/blob vmstate subsection")
Damn, my bad.. I wish C didn't silently accept this...
It may be worth adding a TODO for the v2 version.
> Signed-off-by: Akihiko Odaki <[email protected]>
> ---
> hw/display/virtio-gpu.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
> index 718ba3039290..a5aa37aebd0e 100644
> --- a/hw/display/virtio-gpu.c
> +++ b/hw/display/virtio-gpu.c
> @@ -352,6 +352,14 @@ static void virtio_gpu_resource_create_blob(VirtIOGPU *g,
> return;
> }
>
> + if (cblob.size > UINT32_MAX) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "%s: blob too large (%" PRIu64 "> %" PRIu32 ")\n",
> + __func__, cblob.size, UINT32_MAX);
> + cmd->error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY;
> + return;
> + }
> +
> if (virtio_gpu_find_resource(g, cblob.resource_id)) {
> qemu_log_mask(LOG_GUEST_ERROR, "%s: resource already exists %d\n",
> __func__, cblob.resource_id);
>
> ---
> base-commit: 006a22cb26998998385b104db1ff9466ef2f3153
> change-id: 20260725-blob-8a6a1a85601a
>
> Best regards,
> --
> Akihiko Odaki <[email protected]>
>
>
--
Marc-André Lureau
