Re: [PATCH 4/4] contrib/vhost-user-gpu: reject non-32bpp cursor resources

["Daniel P. Berrangé" <berrange@redhat.com>]

On Tue, Nov 10, 2026 at 12:31:14PM +0400, Marc-André Lureau wrote:
> Cursor pixel data is copied as 32bpp, but the resource format is never
> checked. virgl_renderer_get_cursor_data() sizes its buffer for the
> resource's own format, while vg_virgl_update_cursor_data() copies
> 64 * 64 * 4 bytes from it: a 64x64 R8_UNORM resource gives a 4096 byte
> buffer, so 12 KiB past its end is read and handed to the display
> backend as cursor pixels.
> 
> Look up the resource format and refuse anything that is not 32bpp,
> matching the virtio-gpu backends.
> 
> While at it, let g_autofree release the buffer: the 64x64 check returned
> before it was freed, letting a guest grow the backend's memory with
> repeated UPDATE_CURSOR.
> 
> Fixes: CVE-2026-122027
> Fixes: d52c454aadcd ("contrib: add vhost-user-gpu")
> Reported-by: Fernando Bortotti <https://gitlab.com/fernando.bortotti>
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  contrib/vhost-user-gpu/vhost-user-gpu.c | 31 ++++++++++++++++++++-----------
>  contrib/vhost-user-gpu/virgl.c          | 25 ++++++++++++++++++-------
>  contrib/vhost-user-gpu/virgl.h          |  2 +-
>  3 files changed, 39 insertions(+), 19 deletions(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|