From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DUYPR08MB12016.eurprd08.prod.outlook.com (2603:10a6:10:660::21) by PAXPR08MB6942.eurprd08.prod.outlook.com with HTTPS; Thu, 3 Sep 2026 20:26:07 +0000 Received: from AM8P190CA0006.EURP190.PROD.OUTLOOK.COM (2603:10a6:20b:219::11) by DUYPR08MB12016.eurprd08.prod.outlook.com (2603:10a6:10:660::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 20:26:03 +0000 Received: from AM3PEPF0000A793.eurprd04.prod.outlook.com (2603:10a6:20b:219:cafe::71) by AM8P190CA0006.outlook.office365.com (2603:10a6:20b:219::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.12 via Frontend Transport; Thu, 3 Sep 2026 20:26:03 +0000 Authentication-Results: spf=softfail (sender IP is 99.81.216.78) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning openvz.org discourages use of 99.81.216.78 as permitted sender) Received: from nat.eu.perception-point.io (99.81.216.78) by AM3PEPF0000A793.mail.protection.outlook.com (10.167.16.122) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 20:26:03 +0000 X-PERCEPTION-POINT-VERDICT: CLN X-PERCEPTION-POINT-SPF: X-PERCEPTION-POINT-SPAM: PASS X-PERCEPTION-POINT-SENDER-IP: 2a00:1450:4864:20::434 X-PP-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::434;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x434.google.com;PTR:mail-wr1-x434.google.com;CAT:NONE;SFS:(13230040)(82310400026)(12012899012)(43022699015)(6059299003)(2092899012)(3072899012)(13003099007)(19002099009)(5063699009)(5023799004)(10067099003)(3023799007)(18002099003)(55112099003)(16102099003)(57112099003);DIR:INB; Received: from DB3PR08CU002.outbound.protection.outlook.com (mail-db3pr08cu00206.outbound.protection.outlook.com [40.93.64.86]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id ub86qjc8o41vkl9p3iosk50lu488oqqjchou3no1; Thu, 03 Sep 2026 20:26:00 +0000 (UTC) X-SES-Spam-Verdict: PASS X-SES-Virus-Verdict: PASS Received-SPF: softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.64.86 as permitted sender) client-ip=40.93.64.86; envelope-from=den@openvz.org; helo=DB3PR08CU002.outbound.protection.outlook.com; Authentication-Results-Original: amazonses.com; spf=softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.64.86 as permitted sender) client-ip=40.93.64.86; envelope-from=den@openvz.org; helo=DB3PR08CU002.outbound.protection.outlook.com; dkim=pass header.i=@openvz.org; dmarc=pass header.from=openvz.org; X-SES-RECEIPT: AEFBQUFBQUFBQUFId0pmODBsRzVOb0ZjMjN6am4wMEhvN3k2bk9EZVJNeEhvU0hFOERRNUV2K2hPdG1tYllza1E5dlI5dWZ4Y1hFMjJmY090Wm9RTE9JcUF1bFFLcG5mU2x1WC9XNDVJbWNXbHQ0NisrTFpIUHhTU3pLRUVGVXI0MWZXRXV3VFlySHlpajZJNzhCMFRpMjVHb1c4OWRTTUl6UDRwQWU2bGY4Z2JOcFhDS29LN2JXZWNtSUhsYTV0UDJxck93bUdwdzBCM1ZOSC9SSlZsaDF6YTd0ZisxMXV0MVB4dzlyRllyamszS2kyZ0ZxNUV4dFR2Um9UTjdFbm9vQlhaakdka3dqNWN1NzV2MW1ZYUpqanRrOHJXUWhoRFBSUURUZi9XZWd5Rjl1YjdtODRhK3c9PQ== X-SES-DKIM-SIGNATURE: a=rsa-sha256; q=dns/txt; b=0QkHncp/GwTQvxr54YERBdypzjHV5lfKCeMP7pb/2RymAxAb61RUQmCtRvmwTJYrUToy0A+kp3O64GaFZV5ySqDtdQiJ5Ae/FizEnyPM4fPlBoY4fIOh9BLhkyiCTkEKP63RTfZ8QH5VGd5668zKc6tOENE1DqTSPJG79xAh6CM=; c=relaxed/simple; s=shh3fegwg5fppqsuzphvschd53n6ihuv; d=amazonses.com; t=1788467161; v=1; bh=wl2NdA49nk02GvIYo1inz0mQ4Yvsri9aVNQrJLWqdBg=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT; Received: from DUZPR01CA0331.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b8::24) by GV1PR08MB10838.eurprd08.prod.outlook.com (2603:10a6:150:16a::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 20:25:53 +0000 Received: from DB1PEPF00050A00.eurprd03.prod.outlook.com (2603:10a6:10:4b8:cafe::89) by DUZPR01CA0331.outlook.office365.com (2603:10a6:10:4b8::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.12 via Frontend Transport; Thu, 3 Sep 2026 20:25:53 +0000 Authentication-Results-Original: spf=pass (sender IP is 2a00:1450:4864:20::434) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::434 as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::434; helo=mail-wr1-x434.google.com; pr=C Received: from mail-wr1-x434.google.com (2a00:1450:4864:20::434) by DB1PEPF00050A00.mail.protection.outlook.com (2603:10a6:18:3::6da) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 20:25:52 +0000 Received: by mail-wr1-x434.google.com with SMTP id ffacd0b85a97d-484362f5c4aso328667f8f.3 for ; Thu, 03 Sep 2026 13:25:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1788467152; x=1789071952; darn=virtuozzo.com; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=HdPY9VNcZkZEkEvIk/rizggCNvJTM/9mOAS9hXS2p1o=; b=CWffg6axbBuLq04E+oawsXJ8dwOcCVGzvKwWVLfyLyEzWdBYZMlUGpz7Ojwz8dZ6A5 5is21vcKpsPQvP1wvnBp3ho4v7USv5cQleKUA7cut5WysuNUN/ToAS42K9Y/+gopqJRh rEryKYwUYOOyqKDANqiDdQnFxnMOC16Huue2jkYWkIaNNpwdFGzn6GX0uM7bkvqC1XbX QufuS0i0OP6zWfmEo3wxSTjOWyM3uTIRq2eR0ffXokVFdGS628Vtm9JLvK7qLSBkV7Sm X5Ra7nq1P8ahJYrAZbMBHpPG6Gf1p1rqgjYobtfTriAGxx5Fq2ONsTsiqsZftxYRxpI4 9R/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788467152; x=1789071952; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=HdPY9VNcZkZEkEvIk/rizggCNvJTM/9mOAS9hXS2p1o=; b=WtaIqCOy3dvU+f3NSEKmaPdh79P3yPtxc8lqgEs4b/VyiShhSdnPrqxGeUCdFzlova hSBb1h8UHSdHF+1y3t50aNRk97waYsLVhbe6Y/UX1wHr3eKdxl/fVsUr3gYnmkIMdIDb UgQibLw3Fj+XrH7tsvanWSgTB57A1QmLsRhsSzSNLPErg8lnFzp8yzeW4pcUKrHU96D9 FkobvsRCQEjge38FJInoJVJfqJWt6wESyq76/62rQxfGug03nK8fFDubRyiZBBsiusWh 4Py6qtKwpBkcyDpdw1MK9OD9W9IOpR4vNUWoEomOcg8u4t99dkATpUHtnUgILYKdk0qp mylA== X-Gm-Message-State: AFuF++lG6UIY4NvojmSCiq7Hyd8u1AvLX57fHsq1piLo8HQtxNS9iTB+ Bs8vKdh1tggxrnOBPWEGEQxgutdFVuRfLmzEaWL2YJSE4aEpAZyHGiBvTVQFHebWfJMMJJ3U/oP 93+M+AKI= X-Gm-Gg: AYBFou3woeQ2TfQfAKO07pZxdx9f9576Z+TWne7YDfgnBQ7o9uyuwTSXNolkf4naRjO 2nYiJK2RwU1D/MxbNP27nRADmWtuRBiPkEQYCkoECa7TglxiLXOihkh4aYn/qjql/sOih8dN40x LoJ6cVTIyAag2h121CyExoFHJqriG7H1/Krk94yOy5jLOc5yPAyGrQhmw8tVt1OeaaapDvdXNCx /5/O8i4hoOF02AUojf379NsSZJYyRsSTgnTRYe+ocx/kCHhb7FKi3z/iQ0udkfDE8bCtCNV1QcZ M+vcsp6eb+5nPucNkOAbP2u8lqi1RmCHNYN2KumkNgIRHydTSJK0qgUmtjeiq5ZDKrCnHXgl/U0 mauXveTjIdSbUnHMSSqLNEhTTemIBpovySNK3vW0R72aHjYezJ0Ya4lsBQP2nhr96sHnqD1dRPw H0byLHVR/Ho/jRZiwifvnPBXgCfrA2VFfBtwcc7NlsksuCTNZMhmtDpQ0PDzzr9XCbBqQ= X-Received: by 2002:a05:6000:2108:b0:47e:81aa:3832 with SMTP id ffacd0b85a97d-48587085fa6mr3085397f8f.16.1788467151596; Thu, 03 Sep 2026 13:25:51 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:83cc:ab98:cda9:7dc]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48588394fa1sm950600f8f.8.2026.09.03.13.25.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Sep 2026 13:25:51 -0700 (PDT) From: "Denis V. Lunev" To: svt-core@virtuozzo.com Cc: den@openvz.org Subject: [QEMU HCI-8.0 PATCH 0/7] qxl cursor use-after-free plus stability backports #VSTOR-144000 Date: Thu, 3 Sep 2026 22:25:42 +0200 Message-ID: <20260903202549.2754937-1-den@openvz.org> X-Mailer: git-send-email 2.53.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 1 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:1 X-MS-TrafficTypeDiagnostic: DB1PEPF00050A00:EE_|GV1PR08MB10838:EE_|AM3PEPF0000A793:EE_|DUYPR08MB12016:EE_|PAXPR08MB6942:EE_ X-MS-Office365-Filtering-Correlation-Id: f77e8f70-1175-49a9-9e1f-08df09f99388 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA|SL X-PERCEPTION-POINT-CUSTOM: vzpp X-Microsoft-Antispam-Untrusted: BCL:0;ARA:13230040|82310400026|12012899012|43022699015|6059299003|2092899012|3072899012|13003099007|19002099009|5063699009|5023799004|10067099003|3023799007|18002099003|55112099003|16102099003|57112099003; X-Microsoft-Antispam-Message-Info-Original: =?utf-8?B?TXZaTEtGU2ZZOWlWNU1VOGxSa1Q4UUVBTHZST3JBVHp6SjFRcTN5UXJXSEZY?= =?utf-8?B?cVp4LzhRWEJJSDR6M0VqM0tNUmczNkJ1UE1NaTdraTJBZ2dhcXgvQmdsZ3h4?= =?utf-8?B?NklnUkhaQkJnOVFqNEN6amxxQXJGT1Bqd3VsaldjMTBtRDJxL0FlMWg5VzNx?= =?utf-8?B?NkZiSy9TWGozZ2pKcmZUL2hhalNQVlBDTHpHSXRCUkY5V2dhZEJJUzc1eHpE?= =?utf-8?B?WFpSODl3RUhvYnBhM1dHUHV1VmdUcFFpemZ5UUNMQjZWZmVEZ285Rm9oLys4?= =?utf-8?B?WEJ6R2RiaDBkUXY3Wnl2N2tIWjY1YmZSeVNyVGlKQmhIY3VwK1U3SHl2Y0pZ?= =?utf-8?B?THFERURQQVdsaVEzUW83UDY5c0djY0h1MlNYSmo0MVN0Y055Vk8vdzNHTEtO?= =?utf-8?B?azk3am95akcvTGlCOTJVdGhrVEkyNCt1N3hBbFdRNUt0eUl4cDlkV2VzcXEv?= =?utf-8?B?R1F4bEpiTkpoYXgvaXJLVXpFcUtHUlh5VGJIQUI2OEdGSDdBdkFRSmJSZHk4?= =?utf-8?B?UTVUaS9nTzBxNHhqYStveTdQd00yWGZKZlVkRWpyZDVidHJxYUZUcGlreHF5?= =?utf-8?B?RS9GSXFlWWpnWnpvTzVtdm45OE5HMHhUWjdWTGkzSzd1aU5GbVRkLzRLa01R?= =?utf-8?B?RUhuZktnVnpmRFgrSDRsMmNYd2QwVVBQZit3UXlDNnpNVGhiUDVGNjBGd0Zj?= =?utf-8?B?WTJuZzN4eExUdHpOY3pvMUhWdDE1dE12cUdyS0pwQ1N3dXhFakp1YVJVUUE0?= =?utf-8?B?NzNYSC92MG5qSUlWZ3poUW1kdzVMNXB0MXB5ZmEvQlplY25OMlN3UFF2ZjlX?= =?utf-8?B?OUtCQ0l3UmhsWlNmU2UrUk5IbTI4OUNkK080elo4bmRvck1neGs2QmQ0QXBG?= =?utf-8?B?enBzYjhoM1kzRXdQVWkwaE9UU0I1ZHlJNWJzaEdwSGtMcGlUSmpBcWdBMmNy?= =?utf-8?B?ZWo3T3cvak5EOFRMSjhKSFlVUDNCc0YzdWdTdmVpY2dlN0w4cDlyL0xTeHRP?= =?utf-8?B?WjNEVDczQ3dGR0trbytlNjRXR2tMeUY4Nk9GUUE4N1dkeHZJNkJZUFVZZVc3?= =?utf-8?B?aDRzMGRiMnpTaGhHUTVhVVhnUEFXSEp4bWhXMC94cHdoT1QzUWFpWFFHWXBE?= =?utf-8?B?QTZJS1FhMUNYaW1IZFlGVCtTakVrcXNOQlplVGNLVWpuZ0h3Z0hzaTFyOGZG?= =?utf-8?B?ZmljaHVOazYwQW82TjVxT2hrYmFHWXg0bE1JclVmUXQ3S3lFWkxqd3oyYUE1?= =?utf-8?B?ZllyUEdkNWM1VWRabDJ6d2lXNWV4MmZDekdpZzNKMWU5bkxOQnFMVlk3elBV?= =?utf-8?B?eUNoaGY5MjVQd0diemcwZEdyaEdBRFdIM0FOWlVxRG1zTlIvN29ONUovT1hz?= =?utf-8?B?S2RWRzBVYjZZTW41RHpmc2pObnFNZTlLTk9zbDNYZHdObVFCeWNTUkdwenM4?= =?utf-8?B?UVd1eTgxY3JPT29ER0hyN1U1N1dMNjhQcEE0RVJZbC82UVJoenlHM0NCU0F1?= =?utf-8?B?aS9MSG5URFlJNTJYcHU1L2tIVWk5STRUOVpFWHpuTE9oRW5Sd0hFSjhhUUh3?= =?utf-8?B?anJZVGVXYXFaUklGMG9GMnZlalpvV245ZGhUVlFNZUhTSHhrS2RKWTdoRGNV?= =?utf-8?B?SndnanF3ODg0R1NTdG1TZXR3aDZoejArd29aek8yQi9vYnUvYURPekVtbTZP?= =?utf-8?B?cXd6R3dxQVNyZ2VQeFJkRkVSOTZzZEtvaGV6eDh1WEVyYW94eDNpeE9vRHpJ?= =?utf-8?B?a21MZHdGMW9PWFN6WkZWaFpHL3c2QVEreFBsdVZncVU3YUU0MkltWmtRMjhE?= =?utf-8?B?cDg1Ym4wNkxvcHBFUE90UHIxWDhmMTI1aFdpVVdqditWRVlpcXpLZm54RDFx?= =?utf-8?B?NndyS2JjdFBybThjQ0c3WHY3STBwRmk1NmZUbk5IaEtYUWJmckhhd0hEU0Zl?= =?utf-8?B?TEQrdHZWbHV6aFZFUjgyNlpnVGVFWWxwd1N1U1E5Nzc2VTBsSnErWStzWjJH?= =?utf-8?B?NzBKQ3dVMklheGZQNkdOUzVDRlhCSEE0MjdKM0k2QnU1R2ExazFxeDlTN2Fz?= =?utf-8?B?c2lXVnEyb0ZIbDFONXVFQW5VT1BlUkdVb0l2SzRqbThHWHdBQ0JFclFRNlpj?= =?utf-8?B?d2IrYWtvTUFMQjhyUlBwd0gzWTlqOGtMT0pFcjRpV1FMa2RMelB4MGQydWhp?= =?utf-8?B?NnVXNDRVcnlzYmtma05uTmhBYVJRZDEyNGZPQ2RMN0FmcU9tdDdld3hwMnZa?= =?utf-8?B?V2RNT1hqWG44eDlCc3FXc3k3TUZ3SDhNYk4zS08vRlZtd0FaTUVyMnBEYSs0?= =?utf-8?B?aFBRVDhpNDcwelArRFQvUU1rc1ZGT04yYnY3QkhUa3hqUWhJL200UUkwUHA0?= =?utf-8?B?V01zYmlBNmo4SS9TeE85bXpzSlJUWGNkYXJKNlJBZTdIT01BNm9EQ1YwUXRo?= =?utf-8?B?QTZacWxWOG90MDVySWFIZTYycDlwZFVoZ0dsV0hzYXRCMVJ3Z01OK21BSklj?= =?utf-8?B?a3Z2L0JVUC82ak1paWZRSFFzT1orSXdISUFXS25IWHBjQVJNTGVQdWFnRFda?= =?utf-8?B?MUZ0Y2FPZlh5K2RYNkZCdlhuQkZtK1pHa2ZnNlArWmdhSkE3TEVQRmpjbnVQ?= =?utf-8?B?RkdIQ3d5eEluQ2JWZkZ2RHhjaVczRFU4eDdtTWRPUEw2TjNReUZSdklER1dK?= =?utf-8?B?bCtiZ2tYdnQ3K2VtTGRsZUhmWE5IQ0sySU5zVytaYVNsYjE5ZGVNdDBJd3dC?= =?utf-8?B?TVU4bnlhNGRtV1pQa2E0MWE2UGdIYmtrQnFOWXhkZG1NM1lrZzJQUVprOGlo?= =?utf-8?B?c2g0YnY4b0dTRGorSVM5YU42b2kyU1Rvc2FPeUxxc2srZWROL1NMSmhxNXkz?= =?utf-8?B?TXY1OWZ6L3FEV1lnaHpHRXZ3U0FINWtldDdYOUxBOUJ4emdSSWphaVpzSkFy?= =?utf-8?B?c21xc1BnQ1hRa2FCVWFRUVpDNm9JRFNnUHBwNHd6UUV3TzN0alE9PQ==?= X-Forefront-Antispam-Report-Untrusted: CIP:2a00:1450:4864:20::434;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x434.google.com;PTR:mail-wr1-x434.google.com;CAT:NONE;SFS:(13230040)(82310400026)(12012899012)(43022699015)(6059299003)(2092899012)(3072899012)(13003099007)(19002099009)(5063699009)(5023799004)(10067099003)(3023799007)(18002099003)(55112099003)(16102099003)(57112099003);DIR:INB; X-Auto-Response-Suppress: DR, OOF, AutoReply X-Exchange-RoutingPolicyChecked: g4Y9a1ROBkvJR6U2BEOBqc5JrQ1nGXo1dzPoNCJ/ur5Q0kLzSlwIa0n0oxRYr26HV+rgXyBRXBQWk3b2tqDVRwE/6etZNE/sDpxnpnvlwHpXWmpIAeh/pbFL2v/R/YXNAjGnChfZD7vBMXSK5PpL/M/R5/6yl+uzg1Fg2x52az9+AsIqOAgu7PXW0ymhVUFeluw5mroQKJ0xCBGdYfmoNhqs/XUfPN6zT2tRR2itmsqkkj4BUpqSzHLuwIGVq3CizGZ52TENdmHFCZC5CFz4PANyWOIOI3X61w8fz3UCXzzVuadHnVdJKLRfOHf/1DY7L3eOI/Q35SUqdDJPyheLrg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1PR08MB10838 X-MS-Exchange-Organization-ExpirationStartTime: 03 Sep 2026 20:26:03.6610 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: f77e8f70-1175-49a9-9e1f-08df09f99388 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM3PEPF0000A793.eurprd04.prod.outlook.com X-MS-PublicTrafficType: Email X-MS-Exchange-Organization-AuthSource: AM3PEPF0000A793.eurprd04.prod.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id-Prvs: 18289b1b-1988-4474-b897-08df09f98cd6 X-MS-Exchange-Organization-SCL: -1 X-Microsoft-Antispam: BCL:0;ARA:13230040|2092899012|82310400026|43022699015|12012899012|6059299003|35042699022|3072899012|13003099007|19002099009|10067099003|5133699003|5063699009|5023799004|18003699003|3023799007|57112099003|16102099003|55112099003; X-Forefront-Antispam-Report: CIP:99.81.216.78;CTRY:IE;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:nat.eu.perception-point.io;PTR:nat2.eu.perception-point.io;CAT:NONE;SFS:(13230040)(2092899012)(82310400026)(43022699015)(12012899012)(6059299003)(35042699022)(3072899012)(13003099007)(19002099009)(10067099003)(5133699003)(5063699009)(5023799004)(18003699003)(3023799007)(57112099003)(16102099003)(55112099003);DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Sep 2026 20:26:03.2861 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f77e8f70-1175-49a9-9e1f-08df09f99388 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: AM3PEPF0000A793.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DUYPR08MB12016 X-MS-Exchange-Transport-EndToEndLatency: 00:00:03.7858784 X-MS-Exchange-Processed-By-BccFoldering: 15.21.0382.004 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910005)(944506478)(944626604)(920097)(930201)(20251009189)(140003); X-Microsoft-Antispam-Message-Info: =?utf-8?B?elR4akM3OUU5WjBCczhLNit1VGgzYXRMTjhwWmFnOUNVMkJENEJvbDdpcjcz?= =?utf-8?B?SWJZMk9Pd09Tb3NwaHNFa3dMTTBvbWYyTGFDNnNjelU5ZDlxWHJIaUQrRThm?= =?utf-8?B?MXVUeVdsOGRzdXd2R0VmTXo2aGxrTmhWYklUWElkSkc5S2pweHNpTC8zNUVp?= =?utf-8?B?RXVNZ1I0K3l6WktnNlRpNkFNZWFLSGRFK2c5Uy9PY1oyQnNycGFscVp2OFJO?= =?utf-8?B?SG04TTVRaFZtSExDL3FvWXd4YWhZSzV1bXdiS1ZRWWpTeHVmNTYrWmNZZllt?= =?utf-8?B?TmtvMmtUUnFIOUl1dWUzblJCWXR1d3AzU0NNVTdqUjF5TlhhSjRIUGNDRlhO?= =?utf-8?B?dFdDcDNQWXRjdDRXTDY4OHR1UjFHRndIUFdIc09xWWZUUXNlWjRvYVpadngw?= =?utf-8?B?SkdiZkRmSGJIeEdrZnltTjVsYlJnaWZGUDgvZTJvbHo5bGVjaWNYNkNUaGtn?= =?utf-8?B?NndZVW4rbVQvNVgyWUNTYytmY2JtaEJOSXJFbzh1dUNXY3dPcWwzeDY0ektJ?= =?utf-8?B?ZGNIMEJzTG8yc3hlb3R4Tklsa0psb2J4NTZxZ0dRTGNvTTFQa1hTOFJ3cHFr?= =?utf-8?B?bDhleDM0TXNwTHhjU0p0VXd6Z1ZZSURMSWxVeVI4RnA0cWtLT3J0QUFOU0do?= =?utf-8?B?RVZrZlNWNVNkT25LbUVSNHd0c2hVRkpla1grVXh2bHkzcUVHOW1Hb0d2VXh5?= =?utf-8?B?TWlZZUxSOUN4dmZ5bHZlYUxVcUNOckswRndiZ1ErNm0wWjExdllLUzRJNkRy?= =?utf-8?B?UXU5TXI0RDBRWm4veVN3NHlLZExaM0xyUmNsb3hKSUxPM3F5c04zT0haeXRj?= =?utf-8?B?OCtReW5rWG1sZHFjUExLQ2dKOXJWOEpCOFBuQ0l2U3lVRXFwV01lbHAxVlJ4?= =?utf-8?B?WU1UaDF5bWU3cFNxd01BR2w1M1dpcXk5anFRRmZpUTRkcHVPRTEwM05oTGZv?= =?utf-8?B?UGlBUnl0ZkVVbXBGOTZkWG5CVDhUVkJiZUVKbXBDblpXUERQb2s3bkFUdEZK?= =?utf-8?B?a0l6KzJhY2ovcUxxNHNGaUtNeityWW5HSFAxcDhvVXcvcWZrV1ZsSzFCMTRa?= =?utf-8?B?RklRYXMrSHV3NkhDV1AyOWxJMXVuci90VDZNaUZCUXhkQmpsV01lL2QvcUtK?= =?utf-8?B?NHU2QmpVMGtWOUd0TDMyMWpia3lSZUxZdnl5RFMwMVpzQUV6dHlaQkVjcXAr?= =?utf-8?B?REwxQTFlUFN4TEZmZkxHTHpzRWV2R0NVdHJtdEQ0M1BiY09ubWg3ZHBaWnY4?= =?utf-8?B?UDlFanJYc0JqN2NzUEd4eGJtMmZjZmYwQWRsblpRM2hhTGtXalYrUVptQk8x?= =?utf-8?B?VnJiNktzNlBSdEpkRFYyYTdnUFF0VDNpVDRqY2Fqa1NtYnZ0WmRDNDVFenZ1?= =?utf-8?B?YjFKQTMyODZCejlLaThSMUZ3ZlVNZ0VWMTE3YlZhWlhOSVJqR3ZCRHZKQnV6?= =?utf-8?B?SEdselJLODBMWDdZRkI0MU5sN2l2MGNqbEpWa3MvbkQ5ZnRtTGV4d1I3TXdh?= =?utf-8?B?dWdiZi8vYXJnZ2szWnp1NGJWY2JoQTViVU50K2pYZTRZVDZicGozdzFGaGsw?= =?utf-8?B?ZTN2RWh6VHhqNVlvQXRhVUFuQk9taXNmNkJURURlK2NJS1dmV0h1V21aa2dT?= =?utf-8?B?Y3hibkNCRlplRE91UkdyNGFJUjRVSXI4SFQxT09lUWdpSnJoYlFYUEpWQkFt?= =?utf-8?B?WmNrWEpxZ09KbWloTEZIQlhvR1NRUnM5Y1pBRUJ6aWlwTHRQUzA1MzRldnJV?= =?utf-8?B?cVYrbmVnOTFOQnFlMmFTYVgrYUF3YzdBK2VwQXg2QUt3N0VjWUV5RElVQ0tt?= =?utf-8?B?Qy9zcWpIRi9GL29zSWhpdHV0YWVDYzd6ZmdERU16cUE2WXhrekxRZUhNMVN3?= =?utf-8?B?bE1CeS9ENFNHQldXeldlWVhPbVRYdm1rSndjK1J4R2toekprcUdCUkgyN3BV?= =?utf-8?B?RHlmNEpsNE1FZi9HY0xJb3p3QVFuN21td09XS0IrdDZ0N25MQ2tMa3UvNXZS?= =?utf-8?B?NC9nOWI1RGVTU2VXS0pTY2tqTTlSdHNVL1dJSDdMVFhqNktyWTVUNWg0MWNx?= =?utf-8?B?U2Y0RUk2Y0cwVWwvN2M4c2o4KzdyNEhaUXZVaFJjMWdJU2JFeng5NFhaYUdk?= =?utf-8?B?VUFpbmFMdGsrZG0ySWxaOHE1eU0xYjB1Nk0yUkpBa0pQU3ZQUkVSKytSc3pN?= =?utf-8?B?ZWxyaWFhcXViLytkcUNobjRaU2ROUm4rUnJJNGVCcEhjUmsyMm1XOGYvb0hN?= =?utf-8?B?T28vNlZRMjNmVEN0emlEZW1EN1ZwdDQxMnY1dDVMWFk5SnlvWUhXUXVCWUFo?= =?utf-8?B?TjAvZkl4N0pBYnU4VjFlTFk3TTAvZHpRYjMxcCtBZk52cE9GYTVUdEdHNkhi?= =?utf-8?B?VlNnYkMxN21KeWd0ZkdCWHVMeExiY20xOG0ySlNEK2FSNlNnTkR2cjNsODJ3?= =?utf-8?B?WWtOWGVtZmFpWXBLL214YlFkckc0cG4rQW1YRDlzeXRjekY2TlNFdGlSTDJp?= =?utf-8?B?bXhXaFgrczBxY1BoWnhPTHArNnpxM2xNMmNpWU5sdEw2NnJ3SFVrRVd5YjRl?= =?utf-8?B?Nk4vb3IwMEZvMWxSNmdKWHlJSVVnNW9xZzVPd2V6QUdsSTZzYmV1bXh6VURr?= =?utf-8?B?bWk2RW5Wai91b3BONTlpZGRqelEwMHIybGZzbGF0OHpmMUE0Wi84SWlqVmMw?= =?utf-8?B?N0RiYnQzeExXNGVLays5MWYyMDJ4dFNBNGZGclkvNEk4TDF4YVRsNnBCR2FG?= =?utf-8?B?Q2JpRmdwYUx2U3BqTGpKYVZNMEs1OVpXNXpQY2pOdWNjMVMxcGJHV0I2RHR5?= =?utf-8?B?UFQrT2lKWlBzYjRLNUIwL3FETlVKMDNMaythcnY3MUpibXVpNzFwRkV6dElx?= =?utf-8?B?Q2hwSzlpd3dab1drU0Z0Qms5TVUvSWJEMTNsTzVzRkN5bWJTcitsWkxkdTF2?= =?utf-8?B?eTZDNUFnNG81cjkxaDBJTWl0V1hsWDlQN05jT3V4RFkzTEt4WVlQZTBEQkhS?= =?utf-8?B?MC9uSk1FS2RqRllaZ3JIRDBhZ1hpeGQ0ckp0Tkg4MXZrczdERTlsVzRGQita?= =?utf-8?B?RlRqazU1VFNGNTc2WGl0SlRaQS81d2l1YTZqZVV4YlVLMGRZd0kraDk4NDU5?= =?utf-8?B?ak1CMVNvYitiVDh2UEkvWE5NYUVLSVlyUUx3d21tNmNmeE1IZUFyaTIzQXJV?= =?utf-8?B?VURoTEsrZEs4WTUxdWg5bHhWYVRCRmRzUWdtWHFNVGFxU0JiZFpIUVBibXRV?= =?utf-8?B?ZnFKSWpEb0VnOWhjOG50ejdDdDYyYjk3TyswN0dMRVN4SFJ0TTBra2N4TzFL?= =?utf-8?B?SXV1eG1jZFJRdWVPMlVVeFM1aDZGOWdHOTFDTmxCaHZkYVViZTBYRXF1cXMy?= =?utf-8?B?Ny95UU0yNlMzL2V2eUt1K1VjenVEb1VvbjgvNTVKb3VnRHdidXJIU1Z0REJ5?= =?utf-8?B?eWlhMjVxOWhOK09mTEs1V1NPWm1Bd1ZQZ3lOQ3RRS2dqVkw3UmVRU3dOWmVD?= =?utf-8?B?RFIrbHAvOVFzbDJJejhWckNNOEVkUE5ZNVd0K0ZFUm4rbGUvQWV4c3d2SlZu?= =?utf-8?Q?rkUd/09z+D426C?= MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: QEMU List-Id: A guest with a qxl display can make QEMU drop more references to a QEMUCursor than were taken. The cursor is freed while another owner still points at it, and that owner's later cursor_unref() decrements four bytes of a chunk the allocator has handed out again. Nothing aborts and nothing is logged; QEMU dies later in an unrelated allocation, in another thread. Two defects get there, and neither fix is sufficient alone: - qxl_spice_reset_cursor() replaces qxl->ssd.cursor with no lock held, while every other writer of that field takes ssd.lock. It runs on a vCPU thread from QXL_IO_DESTROY_PRIMARY and, unlike qxl_hard_reset(), leaves the SPICE display worker running. - QEMUCursor.refcount is a plain int, taken and dropped from the main loop, the SPICE worker, ui/cocoa.m and ui/dbus-listener.c, with no lock common to all of them, so an increment can be lost. A qxl device starts a spice-server instance for local rendering even with no -spice, so this is not limited to SPICE console setups. Patch 2 also asserts that the refcount was positive. Only qxl was exercised here, so if another display backend drops a reference it never took, that assert turns a silent leak into an abort. Reproducer: a libdrm program in the guest queues cursor SET commands, then disables the CRTC so the driver issues QXL_IO_DESTROY_PRIMARY. Unpatched QEMU dies within seconds; with the series it does not. Patches 1 and 2 were posted upstream and carry Marc-Andre's Reviewed-by, but are not merged yet, so they have no cherry-pick line: https://lore.kernel.org/qemu-devel/20260903192647.2677279-1-den@openvz.org/ Patches 3 to 7 are definitive stability fixes, cherry-picked from mainstream. All five are already reviewed and merged upstream, and none of them was present on our branch. They are unrelated to the crash above but sit in the same device, so they are worth taking in one go: 3/7 mono cursor validation reading past a cursor chunk 4/7 TOCTOU in cursor chunk data_size handling 5/7 monitors_config heads[] validation in phys2virt 6/7 vm_change_state handler and BHs left registered on unrealize 7/7 primary surface stride not validated against width Two of those carry CVE references in their upstream messages, 7/7 CVE-2026-16271 and 6/7 CVE-2026-63322. None of these seven touches qxl_post_load(), so none of them addresses the migration failure tracked separately in VSTOR-113533. Denis V. Lunev (2): hw/display/qxl: hold ssd.lock while replacing ssd.cursor #VSTOR-144000 ui/cursor: make the cursor refcount atomic #VSTOR-144000 Haotian Jiang (1): hw/display/qxl: unregister vm_change_state handler and BHs #VSTOR-144000 Marc-André Lureau (3): hw/display/qxl: fix TOCTOU in cursor chunk data_size handling #VSTOR-144000 hw/display/qxl: validate monitors_config heads[] in phys2virt #VSTOR-144000 hw/display/qxl: validate primary surface stride against width #VSTOR-144000 Thomas Huth (1): hw/display/qxl: Fix mono cursor validation that can read past a cursor chunk #VSTOR-144000 hw/display/qxl-render.c | 98 +++++++++++++++++++++++++---------------- hw/display/qxl.c | 79 ++++++++++++++++++++++++++++++++- hw/display/qxl.h | 3 ++ include/ui/console.h | 9 ++++ ui/cursor.c | 17 ++++--- 5 files changed, 160 insertions(+), 46 deletions(-) -- 2.53.0