Commit c7254cd584 for qemu.org

commit c7254cd584bb667c3f01f95b94c64970b6944452
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Thu Aug 20 17:47:57 2026 +0400

    virtio-gpu: clear res->blob on mapping cleanup

    d3c2da174ca6 ("hw/display/virtio-gpu: Check cursor data presence")
    already prevents the use-after-free on blob cursor after detach.

    Clear res->blob in virtio_gpu_destroy_udmabuf() to keep init/fini
    symmetric, and add LOG_GUEST_ERROR messages in
    virtio_gpu_update_cursor_data() for missing or undersized blobs.

    Fixes: bdd53f739273 ("virtio-gpu: Update cursor data using blob")
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3881
    Reported-by: 章鱼哥@aipy (www.aipyaipy.com)
    Reported-by: swing <swing@mail.exp.sh>
    Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c
index c230509852..03f0b29754 100644
--- a/hw/display/virtio-gpu-udmabuf.c
+++ b/hw/display/virtio-gpu-udmabuf.c
@@ -92,6 +92,7 @@ static void virtio_gpu_destroy_udmabuf(struct virtio_gpu_simple_resource *res)
         close(res->dmabuf_fd);
         res->dmabuf_fd = -1;
     }
+    res->blob = NULL;
 }

 static int find_memory_backend_type(Object *obj, void *opaque)
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 5b63a29293..3c3539e337 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -61,8 +61,16 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g,
         }
         data = pixman_image_get_data(res->image);
     } else {
-        if (!res->iov || res->blob_size < (s->current_cursor->width *
-                                           s->current_cursor->height * 4)) {
+        if (!res->blob) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: resource %d has no blob\n",
+                          __func__, resource_id);
+            return;
+        }
+        if (res->blob_size < (s->current_cursor->width *
+                              s->current_cursor->height * 4)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: blob size too small for resource %d\n",
+                          __func__, resource_id);
             return;
         }
         data = res->blob;