Re: [PATCH 2/4] virtio-gpu/gl: reject non-32bpp cursor resources

["Daniel P. Berrangé" <berrange@redhat.com>]

On Tue, Nov 10, 2026 at 12:31:12PM +0400, Marc-André Lureau wrote:
> Cursor pixel data is copied as 32bpp, but the resource format is never
> checked. virgl_renderer_get_cursor_data() sizes its buffer for the
> resource's own format, while virtio_gpu_gl_update_cursor_data() copies
> width * height * 4 bytes from it: a 64x64 R8_UNORM resource gives a
> 4096 byte buffer and a 16384 byte read, so 12 KiB of host heap past the
> end of the allocation is sent to a connected VNC client as cursor data.
> 
> Look up the resource format and refuse anything that is not 32bpp,
> matching what the non-virgl paths accept. Querying the renderer covers
> blob resources: a blob carries no format in the virtio command and QEMU
> stores 0 for it. The virgl and virtio format enums have the same values
> for the accepted formats.
> 
> Fixes: CVE-2026-122027
> Fixes: 9d9e152136bd ("virtio-gpu: add 3d mode and virgl rendering support.")
> Reported-by: Fernando Bortotti <https://gitlab.com/fernando.bortotti>
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  hw/display/virtio-gpu-gl.c            | 18 ++++++++++++++++++
>  include/hw/virtio/virtio-gpu-pixman.h | 13 +++++++++++++
>  2 files changed, 31 insertions(+)
> 
> diff --git a/hw/display/virtio-gpu-gl.c b/hw/display/virtio-gpu-gl.c
> index 2b7a41c46643..c314631b05f3 100644
> --- a/hw/display/virtio-gpu-gl.c
> +++ b/hw/display/virtio-gpu-gl.c
> @@ -31,6 +31,7 @@ static void virtio_gpu_gl_update_cursor_data(VirtIOGPU *g,
>                                               uint32_t resource_id)
>  {
>      VirtIOGPUGL *gl = VIRTIO_GPU_GL(g);
> +    struct virgl_renderer_resource_info info = { 0 };
>      uint32_t width, height;
>      uint32_t pixels, *data;
>  
> @@ -38,6 +39,20 @@ static void virtio_gpu_gl_update_cursor_data(VirtIOGPU *g,
>          return;
>      }
>  
> +    virgl_renderer_force_ctx_0();
> +    if (virgl_renderer_resource_get_info(resource_id, &info) != 0) {
> +        qemu_log_mask(LOG_GUEST_ERROR, "%s: unknown cursor resource %u\n",
> +                      __func__, resource_id);
> +        return;
> +    }
> +
> +    if (!virtio_gpu_format_is_cursor_capable(info.virgl_format)) {
> +        qemu_log_mask(LOG_GUEST_ERROR,
> +                      "%s: cursor resource %u has unsupported format %u\n",
> +                      __func__, resource_id, info.virgl_format);
> +        return;
> +    }
> +
>      data = virgl_renderer_get_cursor_data(resource_id, &width, &height);
>      if (!data) {
>          return;
> @@ -45,6 +60,9 @@ static void virtio_gpu_gl_update_cursor_data(VirtIOGPU *g,
>  
>      if (width != s->current_cursor->width ||
>          height != s->current_cursor->height) {
> +        qemu_log_mask(LOG_GUEST_ERROR,
> +                      "%s: cursor resource %u has unsupported dimension %ux%u\n",
> +                      __func__, resource_id, width, height);
>          free(data);
>          return;
>      }
> diff --git a/include/hw/virtio/virtio-gpu-pixman.h b/include/hw/virtio/virtio-gpu-pixman.h
> index 4dba782758dc..d6043d2ca1df 100644
> --- a/include/hw/virtio/virtio-gpu-pixman.h
> +++ b/include/hw/virtio/virtio-gpu-pixman.h
> @@ -42,4 +42,17 @@ virtio_gpu_get_pixman_format(uint32_t virtio_gpu_format)
>      }
>  }
>  
> +/*
> + * Cursor data is copied as 32bpp; formats without a pixman mapping are
> + * rejected.
> + */
> +static inline bool
> +virtio_gpu_format_is_cursor_capable(uint32_t format)
> +{
> +    pixman_format_code_t pformat;
> +
> +    pformat = virtio_gpu_get_pixman_format(format);
> +    return pformat && PIXMAN_FORMAT_BPP(pformat) == 32;

Seems like 'pformat &&' is redundant since pixman_format_code_t is an
int (enum) and thus it is impossible for it to be 0, at the same time
as PIXMAN_FORMAT_BPP() reports 32.

Functionally it works though, so with/without it, 

  Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>



With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|