@samitouri / QOSamiQemu / commits / 30fad722ce

hw/display: don't accidentally autofree existing virgl resources

While sanity checking a create blob operation the use of the auto freed res variable could lead to inadvertently freeing an existing blob. Avoid this by in-lining the virtio_gpu_virgl_find_resource() check as the value is not needed anyway. While at it add a comment to the end and use g_steal_pointer to make it clearer the object lifetime exceeds the function bounds if we pass all the checks. Fixes: CVE-2026-6502 Fixes: 7c092f17cce (virtio-gpu: Handle resource blob commands) Message-ID: 20260417094443.785462-1-alex.bennee@linaro.org Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Cc: qemu-stable@nongnu.org Message-ID: <20260417122703.845442-1-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>

Alex Bennée committed Apr 17, 2026 at 13:27 UTC 30fad722ce68316d22b926ba0e6017f0440465df
1 file changed +3 -3
hw/display/virtio-gpu-virgl.c
+3 -3
@@ -830,8 +830,7 @@ static void virgl_cmd_resource_create_blob(VirtIOGPU *g,
830 return;
831 }
832
833 - res = virtio_gpu_virgl_find_resource(g, cblob.resource_id);
834 - if (res) {
833 + if (virtio_gpu_virgl_find_resource(g, cblob.resource_id)) {
834 qemu_log_mask(LOG_GUEST_ERROR, "%s: resource already exists %d\n",
835 __func__, cblob.resource_id);
836 cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_RESOURCE_ID;
@@ -884,8 +883,9 @@ static void virgl_cmd_resource_create_blob(VirtIOGPU *g,
883
884 res->base.dmabuf_fd = info.fd;
885
886 + /* Now live, cleaned up in virtio_gpu_virgl_resource_unref */
887 QTAILQ_INSERT_HEAD(&g->reslist, &res->base, next);
888 - res = NULL;
888 + g_steal_pointer(&res);
889 }
890
891 static void virgl_cmd_resource_map_blob(VirtIOGPU *g,