On 2026/09/09 20:03, Marc-André Lureau wrote:
d3c2da174ca6 ("hw/display/virtio-gpu: Check cursor data presence") already prevents the use-after-free on blob cursor after detach.Clear res->blob in virtio_gpu_destroy_udmabuf() to keep init/fini symmetric, and add LOG_GUEST_ERROR messages in virtio_gpu_update_cursor_data() for missing or undersized blobs. Fixes: bdd53f739273 ("virtio-gpu: Update cursor data using blob") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3881 Reported-by: 章鱼哥@aipy (www.aipyaipy.com) Reported-by: swing <[email protected]> Signed-off-by: Marc-André Lureau <[email protected]>
Reviewed-by: Akihiko Odaki <[email protected]> Regards, Akihiko Odaki
