Commit 7275e5d1ba for qemu.org

commit 7275e5d1ba9104799b194e25825b4ff189a61071
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Fri Sep 4 16:30:20 2026 +0400

    ui/dbus: fix cursor race, copy cursor data

    Eliminates the undefined behavior where virtio-gpu's memcpy() overwrites
    the buffer that an in-flight gvariant still references. Fixes the data
    race where the GDBus worker thread calls cursor_unref() concurrently
    with main thread.

    Fixes: 142ca628a733 ("ui: add a D-Bus display backend")
    Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20260904123020.3108205-1-marcandre.lureau@redhat.com>

diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index c1e8664838..624d0fb71d 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -926,13 +926,11 @@ static void dbus_cursor_define(DisplayChangeListener *dcl,

     ddl_discard_cursor_messages(ddl);

-    v_data = g_variant_new_from_data(
-        G_VARIANT_TYPE("ay"),
+    v_data = g_variant_new_fixed_array(
+        G_VARIANT_TYPE_BYTE,
         c->data,
         c->width * c->height * 4,
-        TRUE,
-        (GDestroyNotify)cursor_unref,
-        cursor_ref(c));
+        1);

     qemu_dbus_display1_listener_call_cursor_define(
         ddl->proxy,