On 2026/07/28 6:35, Michael Tokarev wrote:
On 7/25/26 10:12, Akihiko Odaki wrote:
Discriminating blobs by checking whether blob_size is nonzero fails for
empty blobs. Identify 2D resources by their non-NULL image instead.
Fixes: bdd53f739273 ("virtio-gpu: Update cursor data using blob")
Fixes: f66767f75c9c ("virtio-gpu: add virtio-gpu/blob vmstate
subsection")
Signed-off-by: Akihiko Odaki <[email protected]>
---
hw/display/virtio-gpu.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
Is this a qemu-stable material? I've no idea from the description
about the implication of the previous behavior.
This fix is not important nor a regression but you may still pick it.
The consequence of the bug this patch fixes is a NULL pointer
dereference and denial-of-service. docs/devel/stable-process.rst says:
> Generally, the following patches are considered stable material:
>
> * Patches that fix severe issues, like fixes for CVEs
>
> * Patches that fix regressions
And I don't think this match with the description. It still does fix a
bug, and I think you can cleanly backport it and you tend to backport
such a patch.
Regards,
Akihiko Odaki
Thanks,
/mjt
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 718ba3039290..6413df029b8e 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -56,18 +56,18 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g,
return;
}
- if (res->blob_size) {
- if (res->blob_size < (s->current_cursor->width *
- s->current_cursor->height * 4)) {
- return;
- }
- data = res->blob;
- } else {
+ if (res->image) {
if (pixman_image_get_width(res->image) != s-
>current_cursor->width ||
pixman_image_get_height(res->image) != s-
>current_cursor->height) {
return;
}
data = pixman_image_get_data(res->image);
+ } else {
+ if (res->blob_size < (s->current_cursor->width *
+ s->current_cursor->height * 4)) {
+ return;
+ }
+ data = res->blob;
}
pixels = s->current_cursor->width * s->current_cursor->height;
@@ -1279,7 +1279,7 @@ static int virtio_gpu_save(QEMUFile *f, void
*opaque, size_t size,
assert(QTAILQ_EMPTY(&g->cmdq));
QTAILQ_FOREACH(res, &g->reslist, next) {
- if (res->blob_size) {
+ if (!res->image) {
continue;
}
qemu_put_be32(f, res->resource_id);
@@ -1430,7 +1430,7 @@ static int virtio_gpu_blob_save(QEMUFile *f,
void *opaque, size_t size,
assert(QTAILQ_EMPTY(&g->cmdq));
QTAILQ_FOREACH(res, &g->reslist, next) {
- if (!res->blob_size) {
+ if (res->image) {
continue;
}
assert(!res->image);
---
base-commit: 006a22cb26998998385b104db1ff9466ef2f3153
change-id: 20260725-image-6c8566fb1253
Best regards,
--
Akihiko Odaki <[email protected]>
