On 2026/07/26 17:24, Marc-André Lureau wrote:
Hi
On Sun, Jul 26, 2026 at 11:33 AM Akihiko Odaki
<[email protected]> wrote:
On 2026/07/25 23:00, Marc-André Lureau wrote:
rutabaga_cmd_get_capset_info() only fills in capset_id,
capset_max_version and capset_max_size before sending the response to
the guest. The remaining fields of struct virtio_gpu_resp_capset_info,
including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with
stack garbage and leaked to the guest, including host pointers useful
for an ASLR bypass.
Zero the response first, matching virgl_cmd_get_capset_info().
Not a real risk thanks to -ftrivial-auto-var-init=zero.
GCC only added -ftrivial-auto-var-init=zero in GCC 12, while QEMU still
supports GCC 10.4/11.
Good point, may be we should update:
https://patchew.org/QEMU/[email protected]/
ack otherwise?
Yes:
Reviewed-by: Akihiko Odaki <[email protected]>
Regards.
Akihiko Odaki
Regards,
Akihiko Odaki
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3609
Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstream")
Reported-by: Haotian Jiang <[email protected]>
Signed-off-by: Marc-André Lureau <[email protected]>
---
hw/display/virtio-gpu-rutabaga.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
index 4d7d7b245929..95a19eed7eda 100644
--- a/hw/display/virtio-gpu-rutabaga.c
+++ b/hw/display/virtio-gpu-rutabaga.c
@@ -555,6 +555,8 @@ rutabaga_cmd_get_capset_info(VirtIOGPU *g, struct
virtio_gpu_ctrl_command *cmd)
VIRTIO_GPU_FILL_CMD(info);
+ memset(&resp, 0, sizeof(resp));
+
result = rutabaga_get_capset_info(vr->rutabaga, info.capset_index,
&resp.capset_id,
&resp.capset_max_version,
&resp.capset_max_size);
