On 2026/09/04 22:10, Marc-André Lureau wrote:
virtio_gpu_cleanup_mapping() unmaps the guest IOVs and tears down any
udmabuf mapping, but leaves res->blob pointing at the freed memory. Once
a blob resource goes through RESOURCE_DETACH_BACKING, res->blob is left
dangling while res->blob_size is still non-zero.
virtio_gpu_update_cursor_data() only checks res->blob_size before copying
from res->blob, so an UPDATE_CURSOR on a detached blob resource makes
QEMU memcpy from freed memory.
Well, I forgot the presence of this patch and fixed the described issue
with d3c2da174ca6 ("hw/display/virtio-gpu: Check cursor data presence"),
so the issue is no longer present. Clearing res->blob and adding proper
error messages are still nice additions.
Clear res->blob after tearing down its backing, keeping init/fini
symmetric, and check it before dereferencing in
virtio_gpu_update_cursor_data().
Fixes: CVE-2026-66020
Fixes: bdd53f739273 ("virtio-gpu: Update cursor data using blob")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3881
Reported-by: 章鱼哥@aipy (www.aipyaipy.com)
Reported-by: swing <[email protected]>
Signed-off-by: Marc-André Lureau <[email protected]>
---
hw/display/virtio-gpu-udmabuf.c | 1 +
hw/display/virtio-gpu.c | 8 ++++++++
2 files changed, 9 insertions(+)
diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c
index c230509852ff..03f0b29754e1 100644
--- a/hw/display/virtio-gpu-udmabuf.c
+++ b/hw/display/virtio-gpu-udmabuf.c
@@ -92,6 +92,7 @@ static void virtio_gpu_destroy_udmabuf(struct
virtio_gpu_simple_resource *res)
close(res->dmabuf_fd);
res->dmabuf_fd = -1;
}
+ res->blob = NULL;
}
static int find_memory_backend_type(Object *obj, void *opaque)
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 5b63a292933a..aeb6155130d0 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -61,8 +61,16 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g,
}
data = pixman_image_get_data(res->image);
} else {
+ if (!res->blob) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: resource %d has no blob\n",
+ __func__, resource_id);
+ return;
+ }
if (!res->iov || res->blob_size < (s->current_cursor->width *
s->current_cursor->height * 4)) {
This res->iov check I added will be unnecessary and misleading with the
error message.
Regards,
Akihiko Odaki
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: blob size too small for resource %d\n",
+ __func__, resource_id);
return;
}
data = res->blob;
