qemu/contrib/vhost-user-gpu at master - qemu - Gitea: Git with a cup of tea

mirrors/qemu

0 Fork 0

mirror of https://gitlab.com/qemu-project/qemu.git synced 2026-10-28 14:04:39 +08:00

Files

T

History

Marc-André Lureau 01df81b24c vhost-user-gpu: validate command buffer size in submit_3d

virgl_cmd_submit_3d() passes the guest-controlled cs.size directly to
g_malloc() without any bounds check. A malicious guest can set this
field to an arbitrarily large value (up to 4GB), causing an OOM abort
that crashes the vhost-user-gpu daemon.

Validate cs.size against the actual descriptor payload size before
allocating, rejecting values that exceed what the virtqueue entry
can carry.

Fixes: d52c454aad ("contrib: add vhost-user-gpu")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3776
Reported-by: admin@fluentlogic.org
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260713125431.107278-1-marcandre.lureau@redhat.com>
Message-ID: <67f10fb88d3c75da3ba7fa5a37f7d6bcfcf3ce9e.1789071042.git.mst@redhat.com>

2026-09-13 14:41:12 +04:00

50-qemu-gpu.json.in

vhost-user-gpu: Drop trailing json comma

2019-12-20 06:56:37 +01:00

meson.build

meson: refine check for whether to look for virglrenderer

2022-02-21 10:35:53 +01:00

vhost-user-gpu.c

contrib/vhost-user-gpu: drop scanout_bitmask bookkeeping

2026-09-10 19:59:42 +04:00

virgl.c

vhost-user-gpu: validate command buffer size in submit_3d