[PATCH 18/18] virtio-gpu: fix use-after-free on blob cursor after detach

[Marc-André Lureau]

virtio_gpu_cleanup_mapping() unmaps the guest IOVs and tears down any
udmabuf mapping, but leaves res->blob pointing at the freed memory. Once
a blob resource goes through RESOURCE_DETACH_BACKING, res->blob is left
dangling while res->blob_size is still non-zero.

virtio_gpu_update_cursor_data() only checks res->blob_size before copying
from res->blob, so an UPDATE_CURSOR on a detached blob resource makes
QEMU memcpy from freed memory.

Clear res->blob after tearing down its backing, keeping init/fini
symmetric, and check it before dereferencing in
virtio_gpu_update_cursor_data(). Simplify code by dropping a needless
condition for calling fini_udmabuf().

Fixes: CVE-2026-66020
Fixes: bdd53f739273 ("virtio-gpu: Update cursor data using blob")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3881
Reported-by: 章鱼哥@aipy (www.aipyaipy.com)
Reported-by: swing <sw...@mail.exp.sh>
Signed-off-by: Marc-André Lureau <marcandre.lur...@redhat.com>
---
 hw/display/virtio-gpu-udmabuf.c |  1 +
 hw/display/virtio-gpu.c         | 12 +++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c
index 4e9806f82144..3bd6a77730cd 100644
--- a/hw/display/virtio-gpu-udmabuf.c
+++ b/hw/display/virtio-gpu-udmabuf.c
@@ -89,6 +89,7 @@ void virtio_gpu_fini_udmabuf(struct 
virtio_gpu_simple_resource *res)
         close(res->dmabuf_fd);
         res->dmabuf_fd = -1;
     }
+    res->blob = NULL;
 }
 
 static int find_memory_backend_type(Object *obj, void *opaque)
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 521d4800d872..87823b2cd5af 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -63,8 +63,16 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g,
         }
         data = pixman_image_get_data(res->image);
     } else {
+        if (!res->blob) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: resource %d has no blob\n",
+                          __func__, resource_id);
+            return;
+        }
         if (res->blob_size < (s->current_cursor->width *
                               s->current_cursor->height * 4)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: blob size too small for resource %d\n",
+                          __func__, resource_id);
             return;
         }
         data = res->blob;
@@ -992,9 +1000,7 @@ void virtio_gpu_cleanup_mapping(VirtIOGPU *g,
     g_free(res->addrs);
     res->addrs = NULL;
 
-    if (res->blob) {
-        virtio_gpu_fini_udmabuf(res);
-    }
+    virtio_gpu_fini_udmabuf(res);
 }
 
 static void

-- 
2.55.0.543.g5ebe2ebe4ea8