Commit 5bf61eef11 for qemu.org
commit 5bf61eef114add377890fef01a5ed55de554241d
Merge: 257bf4f160 d6e5165558
Author: Richard Henderson <richard.henderson@linaro.org>
Date: Thu Sep 10 14:19:15 2026 -1000
Merge tag 'virtio-gpu-pr-v2' of https://gitlab.com/marcandre.lureau/qemu into staging
Various virtio-gpu/dmabuf related fixes
While working on CVE-2026-66020 (which had a few revision on list), I
kept finding several places where virtio-gpu scanout and dmabuf
ownership was unclear.
The CVE comes from using a blob after RESOURCE_DETACH_BACKING has
unmapped its memory. Following that path also found stale dmabuf
references, duplicated scanout bookkeeping, and inconsistent cleanup
between display backends.
Those changes touch a lot of area and I have done basic testing with the
various backends. I would not recommend backporting them all to stable.
The first 2 patches address CVE-2026-66020 in the general case and
should be safe to backport.
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmqi0+8ACgkQ2ujhCXWW
# nOVihA/+P9OvMzadaVVLXzML6uK+tHJfKiX6kFICIzXMYmVPyFO3ociPKS0n8645
# CpaYNZc+xqXbtFtxXkzXW7Lg7dYkfYRKFS7IhgN7mSPo/f3+d3p/rMOsrraXZd8y
# UnpDaEnheA9KWBmNHizVUv83PCsrCo19NkBnB13tcoc7Yiy+xE8/P20ohoxc+KDX
# cchpy31x2ccqAv3P3gaclvlclsj4UaiNPT71oTbm1fZnfsGVWKdxnAxTY6mmtEC5
# kP0MmK41wOUcxM9u/1qw95YVRYc7Fhdlxbf9ZaOli9mVFzGYC1LCCDu9xTxaIE6+
# w0AXe1NVIdt9FpuraoOovsdFiF2NU8U6+kTVMOkSO8qP2UtIyvfbk65pCQOjClNr
# S9fhS4+Gkx1dIjJASLfyd3Ej222safwmBHBrY9KgCZ8o439gQMjIgD9pUoS21Nak
# j5H6eQ3YHCZcoSClQCPH+wl3elundraZO38wuME+3a4EcrFN3bFxOThws3Ns2Bf3
# MlA73vZLHOC22x/RR3M4rxzoPKEKArBIQaHQXO8wqfsTABImPzGRYyjfXGRqGDEK
# atBYTR++tS7lG8EM9a+IW482D4/tVCkvwMjA5G6+dyx7bUdJ3bhj854yce7wSI8u
# PeUoP5QzqAxy4xRvWLWhRJIJiFzhK7Ag/BrzN7cTnefIa5L6mNQ=
# =3aXk
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 10 Sep 2026 05:59:43 AM HST
# gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [unknown]
# gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5
* tag 'virtio-gpu-pr-v2' of https://gitlab.com/marcandre.lureau/qemu: (24 commits)
contrib/vhost-user-gpu: disable scanouts on resource unref
virtio-gpu: extract virtio_gpu_disable_scanout_for_resource helper
virtio-gpu/virgl: disable scanouts on resource unref
virtio-gpu: minor refactoring
virtio-gpu: consolidate disabling scanout
virtio-gpu/virgl: release dmabuf when a texture replaces a scanout
virtio-gpu: release dmabuf when switching to a surface
virtio-gpu: drop scanout_bitmask bookkeeping
virtio-gpu-rutabaga: fix scanout handling
contrib/vhost-user-gpu: drop scanout_bitmask bookkeeping
virtio-gpu: release the dmabuf when a scanout is disabled
ui: make GL context current in display backend callbacks
ui/dmabuf: own and close fds on free
ui/sdl2: clear guest_fb.dmabuf on release
ui/console: disable GL scanout when dmabuf is the active one
virtio-gpu: store the scanout DMABUF in virtio_gpu_scanout
ui/dbus: disable scanout iff dmabuf is current
ui/gtk: move draw_submitted from QemuDmaBuf to VirtualGfxConsole
ui/gtk: move GL fence tracking from QemuDmaBuf to VirtualGfxConsole
hw/display/virtio-gpu: set share_handle for udmabuf blob resources
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>