Commit a113e0c53f for qemu.org

commit a113e0c53fb50d78529fd5ea79e3b8313a7ddcaa
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Fri Jul 10 17:47:19 2026 +0400

    vhost-user-gpu: fix integer overflow in buffer allocation

    A malicious guest can trigger a heap buffer overflow in the
    vhost-user-gpu backend by sending a VIRTIO_GPU_CMD_RESOURCE_CREATE_2D
    with large width and height values (e.g. 65537x65537). The allocation
    size width * height * 4 silently wraps in uint32_t arithmetic,
    resulting in a much smaller allocation than expected. Subsequent
    VIRTIO_GPU_CMD_TRANSFER_TO_HOST_2D writes past the heap buffer.

    The in-tree virtio-gpu device (hw/display/virtio-gpu.c) already handles
    this via calc_image_hostmem() with uint64_t arithmetic and an overflow
    check. Apply the same approach to the vhost-user-gpu contrib backend:

    - Add an overflow check in vugbm_buffer_create() rejecting dimensions
      where width * height * 4 exceeds UINT32_MAX
    - Promote the size arithmetic to uint64_t in mem_alloc_bo() and
      udmabuf_get_size()
    - Check the return value of vugbm_buffer_create() in
      vg_resource_create_2d(), which was previously ignored

    Fixes: CVE-2026-15264
    Reported-by: "Vulnerability Report" <vr@darknavy.com>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3940
    Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
    Acked-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Message-ID: <20260710134720.2317856-1-marcandre.lureau@redhat.com>

diff --git a/contrib/vhost-user-gpu/vhost-user-gpu.c b/contrib/vhost-user-gpu/vhost-user-gpu.c
index bb41758e34..ee9858c397 100644
--- a/contrib/vhost-user-gpu/vhost-user-gpu.c
+++ b/contrib/vhost-user-gpu/vhost-user-gpu.c
@@ -388,7 +388,13 @@ vg_resource_create_2d(VuGpu *g,
         cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
         return;
     }
-    vugbm_buffer_create(&res->buffer, &g->gdev, c2d.width, c2d.height);
+    if (!vugbm_buffer_create(&res->buffer, &g->gdev, c2d.width, c2d.height)) {
+        g_critical("%s: buffer creation failed %d %d %d",
+                   __func__, c2d.resource_id, c2d.width, c2d.height);
+        g_free(res);
+        cmd->error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY;
+        return;
+    }
     res->image = pixman_image_create_bits(pformat,
                                           c2d.width,
                                           c2d.height,
diff --git a/contrib/vhost-user-gpu/vugbm.c b/contrib/vhost-user-gpu/vugbm.c
index 503d0a4566..710d545297 100644
--- a/contrib/vhost-user-gpu/vugbm.c
+++ b/contrib/vhost-user-gpu/vugbm.c
@@ -13,7 +13,7 @@
 static bool
 mem_alloc_bo(struct vugbm_buffer *buf)
 {
-    buf->mmap = g_malloc(buf->width * buf->height * 4);
+    buf->mmap = g_malloc((uint64_t)buf->width * buf->height * 4);
     buf->stride = buf->width * 4;
     return true;
 }
@@ -53,7 +53,8 @@ struct udmabuf_create {
 static size_t
 udmabuf_get_size(struct vugbm_buffer *buf)
 {
-    return ROUND_UP(buf->width * buf->height * 4, qemu_real_host_page_size());
+    return ROUND_UP((uint64_t)buf->width * buf->height * 4,
+                    qemu_real_host_page_size());
 }

 static bool
@@ -293,6 +294,12 @@ bool
 vugbm_buffer_create(struct vugbm_buffer *buffer, struct vugbm_device *dev,
                     uint32_t width, uint32_t height)
 {
+    uint64_t size = (uint64_t)width * height * 4;
+    if (size > UINT32_MAX) {
+        g_warning("buffer dimensions too large: %ux%u", width, height);
+        return false;
+    }
+
     buffer->dev = dev;
     buffer->width = width;
     buffer->height = height;