@samitouri / QOSamiQemu / commits / d541d7dc2f

hw/display/virtio-gpu-rutabaga: zero-init capset info response

rutabaga_cmd_get_capset_info() only fills in capset_id, capset_max_version and capset_max_size before sending the response to the guest. The remaining fields of struct virtio_gpu_resp_capset_info, including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with stack garbage and leaked to the guest, including host pointers useful for an ASLR bypass. Zero the response first, matching virgl_cmd_get_capset_info(). Not a real risk thanks to -ftrivial-auto-var-init=zero, but only with gcc >= 12 or clang >= 16. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3609 Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstream") Reported-by: Haotian Jiang <jianghaotian.sunday@gmail.com> Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Marc-André Lureau committed Jul 23, 2026 at 12:07 UTC d541d7dc2fb4ee0d86ab7b4a7c466f0e8211d9d4

1 file changed +2

hw/display/virtio-gpu-rutabaga.c

@@ -556,6 +556,8 @@ rutabaga_cmd_get_capset_info(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd)

556

557 VIRTIO_GPU_FILL_CMD(info);

558

559 + memset(&resp, 0, sizeof(resp));

560 +

561 result = rutabaga_get_capset_info(vr->rutabaga, info.capset_index,

562 &resp.capset_id, &resp.capset_max_version,

563 &resp.capset_max_size);