From: Marc-André Lureau <[email protected]>
When a blob resource backing is cleaned up (for ex via detach_backing),
any scanouts referencing it must be disabled first to prevent the
dmabuf from outliving its backing memory.
Fixes: CVE-2026-66020
Fixes: 32db3c63ae11 ("virtio-gpu: Add virtio_gpu_set_scanout_blob")
Reported-by: Akihiko Odaki <[email protected]>
Reviewed-by: Akihiko Odaki <[email protected]>
Signed-off-by: Marc-André Lureau <[email protected]>
(cherry picked from commit 3ece85b53c124142c7d5cbb1165d4da125b7c369)
Signed-off-by: Michael Tokarev <[email protected]>
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 365ffba9919..c3967196250 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -987,6 +987,16 @@ void virtio_gpu_cleanup_mapping_iov(VirtIOGPU *g,
void virtio_gpu_cleanup_mapping(VirtIOGPU *g,
struct virtio_gpu_simple_resource *res)
{
+ if (res->blob) {
+ int i, max_outputs = g->parent_obj.conf.max_outputs;
+
+ for (i = 0; i < max_outputs; i++) {
+ if (g->parent_obj.scanout[i].resource_id == res->resource_id) {
+ virtio_gpu_disable_scanout(g, i);
+ }
+ }
+ }
+
virtio_gpu_cleanup_mapping_iov(g, res->iov, res->iov_cnt);
res->iov = NULL;
res->iov_cnt = 0;
--
2.47.3
