Commit d3c2da174c for qemu.org

commit d3c2da174ca69161eafeb82d98d0117150017909
Author: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date:   Tue Aug 25 16:28:50 2026 +0900

    hw/display/virtio-gpu: Check cursor data presence

    Reject a blob that lacks the backing storage for
    VIRTIO_GPU_CMD_UPDATE_CURSOR.

    Fixes: bdd53f739273 ("virtio-gpu: Update cursor data using blob")
    Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20260825-dmabuf-v2-4-b3d64d3b9a0e@rsg.ci.i.u-tokyo.ac.jp>

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 7f3301a9ac..01549d29d8 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -63,8 +63,8 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g,
         }
         data = pixman_image_get_data(res->image);
     } else {
-        if (res->blob_size < (s->current_cursor->width *
-                              s->current_cursor->height * 4)) {
+        if (!res->iov || res->blob_size < (s->current_cursor->width *
+                                           s->current_cursor->height * 4)) {
             return;
         }
         data = res->blob;