From: Marc-André Lureau <[email protected]> The following changes since commit 257bf4f160c50ca8c4ebd603f519f5c786013fb7:
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2026-09-10 11:08:04 +0100) are available in the Git repository at: https://gitlab.com/marcandre.lureau/qemu.git tags/virtio-gpu-pr-v2 for you to fetch changes up to d6e516555805b95a7a935c3fd74568dabf7796f2: contrib/vhost-user-gpu: disable scanouts on resource unref (2026-09-10 19:59:43 +0400) ---------------------------------------------------------------- Various virtio-gpu/dmabuf related fixes While working on CVE-2026-66020 (which had a few revision on list), I kept finding several places where virtio-gpu scanout and dmabuf ownership was unclear. The CVE comes from using a blob after RESOURCE_DETACH_BACKING has unmapped its memory. Following that path also found stale dmabuf references, duplicated scanout bookkeeping, and inconsistent cleanup between display backends. Those changes touch a lot of area and I have done basic testing with the various backends. I would not recommend backporting them all to stable. The first 2 patches address CVE-2026-66020 in the general case and should be safe to backport. ---------------------------------------------------------------- Marc-André Lureau (24): virtio-gpu: disable blob scanouts on mapping cleanup virtio-gpu: clear res->blob on mapping cleanup hw/display/virtio-gpu: introduce virtio_gpu_{simple,virgl}_resource_new() virtio-gpu/virgl: free BHs and timers on renderer reset hw/display/virtio-gpu: set share_handle for udmabuf blob resources ui/gtk: move GL fence tracking from QemuDmaBuf to VirtualGfxConsole ui/gtk: move draw_submitted from QemuDmaBuf to VirtualGfxConsole ui/dbus: disable scanout iff dmabuf is current virtio-gpu: store the scanout DMABUF in virtio_gpu_scanout ui/console: disable GL scanout when dmabuf is the active one ui/sdl2: clear guest_fb.dmabuf on release ui/dmabuf: own and close fds on free ui: make GL context current in display backend callbacks virtio-gpu: release the dmabuf when a scanout is disabled contrib/vhost-user-gpu: drop scanout_bitmask bookkeeping virtio-gpu-rutabaga: fix scanout handling virtio-gpu: drop scanout_bitmask bookkeeping virtio-gpu: release dmabuf when switching to a surface virtio-gpu/virgl: release dmabuf when a texture replaces a scanout virtio-gpu: consolidate disabling scanout virtio-gpu: minor refactoring virtio-gpu/virgl: disable scanouts on resource unref virtio-gpu: extract virtio_gpu_disable_scanout_for_resource helper contrib/vhost-user-gpu: disable scanouts on resource unref contrib/vhost-user-gpu/vhost-user-gpu.c | 28 ++---- contrib/vhost-user-gpu/virgl.c | 12 +++ hw/display/vhost-user-gpu.c | 1 - hw/display/virtio-gpu-rutabaga.c | 38 ++++---- hw/display/virtio-gpu-udmabuf-stubs.c | 2 +- hw/display/virtio-gpu-udmabuf.c | 89 +++++++------------ hw/display/virtio-gpu-virgl.c | 135 ++++++++++++++++++----------- hw/display/virtio-gpu.c | 148 +++++++++++++++++++++----------- hw/vfio/display.c | 1 - include/hw/virtio/virtio-gpu.h | 31 ++++--- include/ui/dmabuf.h | 7 -- include/ui/egl-helpers.h | 4 +- include/ui/gtk.h | 14 ++- ui/console.c | 3 + ui/dbus-listener.c | 69 ++++++++++----- ui/dmabuf.c | 65 ++------------ ui/egl-headless.c | 17 ++++ ui/egl-helpers.c | 15 ++-- ui/gtk-egl.c | 55 +++++++----- ui/gtk-gl-area.c | 33 ++++--- ui/gtk.c | 43 ++++++---- ui/sdl2-gl.c | 7 ++ ui/spice-display.c | 2 + 23 files changed, 450 insertions(+), 369 deletions(-)
