Commit e2f4e8b381 for qemu.org

commit e2f4e8b381201e239a2231c4ca06e1cd174c12fd
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Mon Aug 24 11:01:29 2026 +0400

    ui/sdl2: clear guest_fb.dmabuf on release

    sdl2_gl_release_dmabuf() releases the texture but leaves the
    guest_fb.dmabuf pointer dangling. Clear it to prevent stale
    references after the dmabuf is freed.

    Fixes: 52053b7e0a0e ("ui/sdl2: Implement dpy dmabuf functions")
    Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

diff --git a/ui/sdl2-gl.c b/ui/sdl2-gl.c
index 1547ad2f6f..46eff768c9 100644
--- a/ui/sdl2-gl.c
+++ b/ui/sdl2-gl.c
@@ -286,7 +286,12 @@ void sdl2_gl_scanout_dmabuf(DisplayChangeListener *dcl,
 void sdl2_gl_release_dmabuf(DisplayChangeListener *dcl,
                             QemuDmaBuf *dmabuf)
 {
+    struct sdl2_console *scon = container_of(dcl, struct sdl2_console, dcl);
+
     egl_dmabuf_release_texture(dmabuf);
+    if (scon->guest_fb.dmabuf == dmabuf) {
+        scon->guest_fb.dmabuf = NULL;
+    }
 }

 bool sdl2_gl_has_dmabuf(DisplayChangeListener *dcl)