The following changes since commit 257bf4f160c50ca8c4ebd603f519f5c786013fb7:
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2026-09-10 11:08:04 +0100) are available in the Git repository at: https://gitlab.com/marcandre.lureau/qemu.git tags/virtio-gpu-pr-v1 for you to fetch changes up to d26343c12d84227263b8d2fc89bac7632a98e00d: contrib/vhost-user-gpu: disable scanouts on resource unref (2026-09-10 17:29:47 +0400) ---------------------------------------------------------------- Various virtio-gpu/dmabuf related fixes Hi, While working on CVE-2026-66020 (which had a few revision on list), I kept finding several places where virtio-gpu scanout and dmabuf ownership was unclear. The CVE comes from using a blob after RESOURCE_DETACH_BACKING has unmapped its memory. Following that path also found stale dmabuf references, duplicated scanout bookkeeping, and inconsistent cleanup between display backends. Those changes touch a lot of area and I have done basic testing with the various backends. I would not recommend backporting them all to stable. The first 2 patches address CVE-2026-66020 in the general case and should be safe to backport. thanks To: [email protected] Cc: Alex Bennée <[email protected]> Cc: Akihiko Odaki <[email protected]> Cc: Dmitry Osipenko <[email protected]> Cc: "Michael S. Tsirkin" <[email protected]> Cc: Stefano Garzarella <[email protected]> Cc: Alex Williamson <[email protected]> Cc: Cédric Le Goater <[email protected]> Signed-off-by: Marc-André Lureau <[email protected]> --- Changes in v5: - EDITME: describe what is new in this series revision. - EDITME: use bulletpoints and terse descriptions. - Link to v4: https://lore.kernel.org/qemu-devel/[email protected] Changes in v4: - replaced "ui: make GL context current before releasing DMA-BUF textures" with more complete "ui: make GL context current in display backend callbacks" - rebase, drop eof line leftover, collect rb trailer - Link to v3: https://lore.kernel.org/qemu-devel/[email protected] Changes in v3: - updated "virtio-gpu: fix use-after-free on blob cursor", now "clear res->blob on mapping cleanup" - always disable GL when clearning scanout in "virtio-gpu: consolidate disabling scanout" - drop "vhost-user-gpu: release DMA-BUFs on scanout disable" for now - rebased, collect rb trailers - Link to v2: https://lore.kernel.org/qemu-devel/[email protected] Changes in v2: addresses Akihiko review - reorder to have CVE fix first, easily back-portable (but also more limited fix) - include virtio_gpu_{simple,virgl}_resource_new() patch, and other sent separately - move draw_submitted from QemuDmaBuf to VirtualGfxConsole - contrib/vhost-user-gpu: disable scanouts on resource unref - drop rfc, collect rb, adjust commit messages - Link to v1: https://lore.kernel.org/qemu-devel/[email protected] ---------------------------------------------------------------- Marc-André Lureau (24): virtio-gpu: disable blob scanouts on mapping cleanup virtio-gpu: clear res->blob on mapping cleanup hw/display/virtio-gpu: introduce virtio_gpu_{simple,virgl}_resource_new() virtio-gpu/virgl: free BHs and timers on renderer reset hw/display/virtio-gpu: set share_handle for udmabuf blob resources ui/gtk: move GL fence tracking from QemuDmaBuf to VirtualGfxConsole ui/gtk: move draw_submitted from QemuDmaBuf to VirtualGfxConsole ui/dbus: disable scanout iff dmabuf is current virtio-gpu: store the scanout DMABUF in virtio_gpu_scanout ui/console: disable GL scanout when dmabuf is the active one ui/sdl2: clear guest_fb.dmabuf on release ui/dmabuf: own and close fds on free ui: make GL context current in display backend callbacks virtio-gpu: release the dmabuf when a scanout is disabled contrib/vhost-user-gpu: drop scanout_bitmask bookkeeping virtio-gpu-rutabaga: fix scanout handling virtio-gpu: drop scanout_bitmask bookkeeping virtio-gpu: release dmabuf when switching to a surface virtio-gpu/virgl: release dmabuf when a texture replaces a scanout virtio-gpu: consolidate disabling scanout virtio-gpu: minor refactoring virtio-gpu/virgl: disable scanouts on resource unref virtio-gpu: extract virtio_gpu_disable_scanout_for_resource helper contrib/vhost-user-gpu: disable scanouts on resource unref contrib/vhost-user-gpu/vhost-user-gpu.c | 28 ++---- contrib/vhost-user-gpu/virgl.c | 12 +++ hw/display/vhost-user-gpu.c | 1 - hw/display/virtio-gpu-rutabaga.c | 38 ++++---- hw/display/virtio-gpu-udmabuf-stubs.c | 2 +- hw/display/virtio-gpu-udmabuf.c | 89 +++++++------------ hw/display/virtio-gpu-virgl.c | 135 ++++++++++++++++++----------- hw/display/virtio-gpu.c | 148 +++++++++++++++++++++----------- hw/vfio/display.c | 1 - include/hw/virtio/virtio-gpu.h | 31 ++++--- include/ui/dmabuf.h | 7 -- include/ui/egl-helpers.h | 4 +- include/ui/gtk.h | 14 ++- ui/console.c | 3 + ui/dbus-listener.c | 69 ++++++++++----- ui/dmabuf.c | 65 ++------------ ui/egl-headless.c | 17 ++++ ui/egl-helpers.c | 15 ++-- ui/gtk-egl.c | 55 +++++++----- ui/gtk-gl-area.c | 33 ++++--- ui/gtk.c | 43 ++++++---- ui/sdl2-gl.c | 7 ++ ui/spice-display.c | 2 + 23 files changed, 450 insertions(+), 369 deletions(-)
