@samitouri / QOSamiQemu / commits / 8ac0a1c7b9

virtio-gpu: fix NULL deref in rutabaga set_scanout

rutabaga_cmd_set_scanout() checks scanout_id < VIRTIO_GPU_MAX_SCANOUTS (16), but does not check scanout_id < conf.max_outputs like the base class (virtio-gpu.c) and virgl backend (virtio-gpu-virgl.c) do. With the default max_outputs=1, virtio_gpu_base_device_realize only initializes scanout[0].con. A guest submitting SET_SCANOUT with scanout_id >= 1 takes the con=NULL path, and qemu_console_set_surface(NULL, NULL) dereferences con->ds, crashing QEMU. Replace VIRTIO_GPU_MAX_SCANOUTS with vb->conf.max_outputs in the CHECK, since realization already ensures max_outputs <= VIRTIO_GPU_MAX_SCANOUTS. Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstream") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3897 Cc: qemu-stable@nongnu.org Message-ID: <20260720071556.106003-1-jianghaotian.sunday@gmail.com> Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Haotian Jiang <jianghaotian.sunday@gmail.com>

Haotian Jiang committed Jul 20, 2026 at 15:15 UTC 8ac0a1c7b98e11693db8fc6b390cc892b6e3e6c8

1 file changed +1 -1

hw/display/virtio-gpu-rutabaga.c

+1 -1

@@ -302,7 +302,7 @@ rutabaga_cmd_set_scanout(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd)

302 trace_virtio_gpu_cmd_set_scanout(ss.scanout_id, ss.resource_id,

303 ss.r.width, ss.r.height, ss.r.x, ss.r.y);

304

305 - CHECK(ss.scanout_id < VIRTIO_GPU_MAX_SCANOUTS, cmd);

305 + CHECK(ss.scanout_id < vb->conf.max_outputs, cmd);

306 scanout = &vb->scanout[ss.scanout_id];

307

308 if (ss.resource_id == 0) {