Re: [PATCH 3/4] virtio-gpu/rutabaga: reject non-32bpp cursor resources

["Daniel P. Berrangé" <berrange@redhat.com>]

On Tue, Nov 10, 2026 at 12:31:13PM +0400, Marc-André Lureau wrote:
> The cursor buffer is always 64x64x4, but rutabaga does not check the
> resource format before the transfer read. Gfxstream copies only as many
> bytes as the resource format needs, so an R8_UNORM cursor updates the
> first 4096 bytes of the 16384 byte buffer and leaves the rest untouched,
> while formats with a larger pixel size do not fit the request and fail.
> 
> Refuse cursor resources that are not 32bpp, reusing
> virtio_gpu_get_pixman_format() as the allowlist so the 32bpp formats the
> other backends accept keep working. res->format is the value passed to
> rutabaga_resource_create_3d(), so it matches what gfxstream stores. Blob
> resources carry no format; they were already rejected by the dimension
> check and stay rejected. Log the dimension mismatch and the transfer
> failure as well.
> 
> Fixes: CVE-2026-122027
> Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstream")
> Reported-by: Fernando Bortotti <https://gitlab.com/fernando.bortotti>
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  hw/display/virtio-gpu-rutabaga.c | 19 ++++++++++++++++---
>  1 file changed, 16 insertions(+), 3 deletions(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|