From: Marc-André Lureau <[email protected]>
d3c2da174ca6 ("hw/display/virtio-gpu: Check cursor data presence")
already prevents the use-after-free on blob cursor after detach.
Clear res->blob in virtio_gpu_destroy_udmabuf() to keep init/fini
symmetric, and add LOG_GUEST_ERROR messages in
virtio_gpu_update_cursor_data() for missing or undersized blobs.
Fixes: bdd53f739273 ("virtio-gpu: Update cursor data using blob")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3881
Reported-by: 章鱼哥@aipy (www.aipyaipy.com)
Reported-by: swing <[email protected]>
Reviewed-by: Akihiko Odaki <[email protected]>
Signed-off-by: Marc-André Lureau <[email protected]>
(cherry picked from commit c7254cd584bb667c3f01f95b94c64970b6944452)
(Mjt: fixup across v11.1.0-574-gd3c2da174ca6
"hw/display/virtio-gpu: Check cursor data presence"
(this commit re-does v11.1.0-574-gd3c2da174ca6))
Signed-off-by: Michael Tokarev <[email protected]>
diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c
index 326b887451b..d4d6dc3cb3a 100644
--- a/hw/display/virtio-gpu-udmabuf.c
+++ b/hw/display/virtio-gpu-udmabuf.c
@@ -91,6 +91,7 @@ static void virtio_gpu_destroy_udmabuf(struct
virtio_gpu_simple_resource *res)
close(res->dmabuf_fd);
res->dmabuf_fd = -1;
}
+ res->blob = NULL;
}
static int find_memory_backend_type(Object *obj, void *opaque)
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index c3967196250..393bd9aacd7 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -63,8 +63,16 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g,
}
data = pixman_image_get_data(res->image);
} else {
+ if (!res->blob) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: resource %d has no blob\n",
+ __func__, resource_id);
+ return;
+ }
if (res->blob_size < (s->current_cursor->width *
s->current_cursor->height * 4)) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: blob size too small for resource %d\n",
+ __func__, resource_id);
return;
}
data = res->blob;
--
2.47.3
