Commit 3ece85b53c for qemu.org
commit 3ece85b53c124142c7d5cbb1165d4da125b7c369
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date: Mon Aug 24 13:14:42 2026 +0400
virtio-gpu: disable blob scanouts on mapping cleanup
When a blob resource backing is cleaned up (for ex via detach_backing),
any scanouts referencing it must be disabled first to prevent the
dmabuf from outliving its backing memory.
Fixes: CVE-2026-66020
Fixes: 32db3c63ae11 ("virtio-gpu: Add virtio_gpu_set_scanout_blob")
Reported-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 55a1c7f80f..5b63a29293 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1022,6 +1022,16 @@ void virtio_gpu_cleanup_mapping_iov(VirtIOGPU *g,
void virtio_gpu_cleanup_mapping(VirtIOGPU *g,
struct virtio_gpu_simple_resource *res)
{
+ if (res->blob) {
+ int i, max_outputs = g->parent_obj.conf.max_outputs;
+
+ for (i = 0; i < max_outputs; i++) {
+ if (g->parent_obj.scanout[i].resource_id == res->resource_id) {
+ virtio_gpu_disable_scanout(g, i);
+ }
+ }
+ }
+
virtio_gpu_cleanup_mapping_iov(g, res->iov, res->iov_cnt);
res->iov = NULL;
res->iov_cnt = 0;