@samitouri / QOSamiQemu / commits / 1f24066fc8

virtio-gpu: reject requests with short/truncated control headers

A short control request can leave command data partially initialized. For the common header, guest-controlled flags can then cause stale fence metadata to be returned to the guest. The command fill helpers detect a short copy but only log and return. For the common header this leaves the request without any completion; for type-specific commands the caller still completes the request but reports VIRTIO_GPU_RESP_OK_NODATA, masking the error. Make VIRTIO_GPU_FILL_CMD() clear the partially copied object and complete the request with ERR_INVALID_PARAMETER. Make VUGPU_FILL_CMD() report the same error through the existing vhost-user-gpu dispatcher. This also rejects truncated type-specific commands. The vhost-user-gpu common header is copied outside VUGPU_FILL_CMD(), so clear it and complete the request directly when that copy is short. Fixes: CVE-2026-18054 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4094 Reported-by: Ankur Saini <ankur98saini@gmail.com> Suggested-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Signed-off-by: Ankur Saini <ankur98saini@gmail.com> Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20260803-virtio-gpu-short-header-v3-1-936c1daa8e61@gmail.com>

Ankur Saini committed Aug 3, 2026 at 22:39 UTC 1f24066fc88d33455ee54a20f29994d9e69997ba
3 files changed +16 -9
contrib/vhost-user-gpu/vhost-user-gpu.c
+12 -9
@@ -930,16 +930,19 @@ vg_handle_ctrl(VuDev *dev, int qidx)
930 if (len != sizeof(cmd->cmd_hdr)) {
931 g_warning("%s: command size incorrect %zu vs %zu\n",
932 __func__, len, sizeof(cmd->cmd_hdr));
933 - }
934 -
935 - virtio_gpu_ctrl_hdr_bswap(&cmd->cmd_hdr);
936 - g_debug("%d %s\n", cmd->cmd_hdr.type,
937 - vg_cmd_to_string(cmd->cmd_hdr.type));
938 -
939 - if (vg->virgl) {
940 - vg_virgl_process_cmd(vg, cmd);
933 + memset(&cmd->cmd_hdr, 0, sizeof(cmd->cmd_hdr));
934 + vg_ctrl_response_nodata(
935 + vg, cmd, VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER);
936 } else {
942 - vg_process_cmd(vg, cmd);
937 + virtio_gpu_ctrl_hdr_bswap(&cmd->cmd_hdr);
938 + g_debug("%d %s\n", cmd->cmd_hdr.type,
939 + vg_cmd_to_string(cmd->cmd_hdr.type));
940 +
941 + if (vg->virgl) {
942 + vg_virgl_process_cmd(vg, cmd);
943 + } else {
944 + vg_process_cmd(vg, cmd);
945 + }
946 }
947
948 if (cmd->state != VG_CMD_STATE_FINISHED) {
contrib/vhost-user-gpu/vugpu.h
+1
@@ -179,6 +179,7 @@ struct virtio_gpu_ctrl_command {
179 if (vugpufillcmd_s_ != sizeof(out)) { \
180 g_critical("%s: command size incorrect %zu vs %zu", \
181 __func__, vugpufillcmd_s_, sizeof(out)); \
182 + cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; \
183 return; \
184 } \
185 } while (0)
include/hw/virtio/virtio-gpu.h
+3
@@ -315,6 +315,9 @@ struct VirtIOGPURutabaga {
315 qemu_log_mask(LOG_GUEST_ERROR, \
316 "%s: command size incorrect %zu vs %zu\n", \
317 __func__, virtiogpufillcmd_s_, sizeof(out)); \
318 + memset(&out, 0, sizeof(out)); \
319 + virtio_gpu_ctrl_response_nodata( \
320 + g, cmd, VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER); \
321 return; \
322 } \
323 } while (0)