From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from PA6PR08MB10782.eurprd08.prod.outlook.com (2603:10a6:102:3d0::12) by PAXPR08MB6942.eurprd08.prod.outlook.com with HTTPS; Thu, 3 Sep 2026 20:26:09 +0000 Received: from AS9PR05CA0030.eurprd05.prod.outlook.com (2603:10a6:20b:488::24) by PA6PR08MB10782.eurprd08.prod.outlook.com (2603:10a6:102:3d0::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 20:26:05 +0000 Received: from AMS1EPF00000041.eurprd04.prod.outlook.com (2603:10a6:20b:488:cafe::34) by AS9PR05CA0030.outlook.office365.com (2603:10a6:20b:488::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.12 via Frontend Transport; Thu, 3 Sep 2026 20:26:05 +0000 Authentication-Results: spf=softfail (sender IP is 99.81.216.78) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning openvz.org discourages use of 99.81.216.78 as permitted sender) Received: from nat.eu.perception-point.io (99.81.216.78) by AMS1EPF00000041.mail.protection.outlook.com (10.167.16.38) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 20:26:04 +0000 X-PERCEPTION-POINT-VERDICT: CLN X-PERCEPTION-POINT-SPF: X-PERCEPTION-POINT-SPAM: PASS X-PERCEPTION-POINT-SENDER-IP: 2a00:1450:4864:20::42c X-PP-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::42c;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x42c.google.com;PTR:mail-wr1-x42c.google.com;CAT:NONE;SFS:(13230040)(2092899012)(82310400026)(43022699015)(12012899012)(6059299003)(3072899012)(13003099007)(19002099009)(56012099006)(10067099003)(5063699009)(22082099003)(16102099003)(55112099003)(18002099003);DIR:INB; Received: from DB6PR07CU003.outbound.protection.outlook.com (mail-db6pr07cu00301.outbound.protection.outlook.com [40.93.64.89]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id cvu7llgvidgbklp87oidkofbaep2tifhpj35cq01; Thu, 03 Sep 2026 20:26:02 +0000 (UTC) X-SES-Spam-Verdict: PASS X-SES-Virus-Verdict: PASS Received-SPF: softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.64.89 as permitted sender) client-ip=40.93.64.89; envelope-from=den@openvz.org; helo=DB6PR07CU003.outbound.protection.outlook.com; Authentication-Results-Original: amazonses.com; spf=softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.64.89 as permitted sender) client-ip=40.93.64.89; envelope-from=den@openvz.org; helo=DB6PR07CU003.outbound.protection.outlook.com; dkim=pass header.i=@openvz.org; dmarc=pass header.from=openvz.org; X-SES-RECEIPT: AEFBQUFBQUFBQUFGU0ZmWUEyQWhwdHlPU0JtYnBUTFB3ZUNsU1pNM1I0aXBjRkhsdXJIQzI2cnFXSDRMbS9UTEh2L0xpQTltWHhhNDVUVWViVVNRUHJyMXprMGhVTVB4ZEFIK3BaU3dnZ2lOWFBpS1JXU2VyaVh2bytBeWdKeDhBM3VoY3J6Z0w0Q1dZdnpLcUE3cVp0UkJrdlR2RHM0VnNBTVI4Nitia1RLL3dxVjU1SStBYitUeU9ORTBEcUVGWU1QM1F4SjdGQlhlUkRFcjFOZ3lobXpmNHJmVVR3SVpmVTBkSFNnWEZuZTduelZibWZuL2R5UWdtV0ROREx1RXRwYTA1d3VuajVVc3pWWUVCQmQ5Y1MzdSttRHI3bSs5Nm12Yy9rL21xamlGemJwaHR3Y3h3Znc9PQ== X-SES-DKIM-SIGNATURE: a=rsa-sha256; q=dns/txt; b=A/dH/XSZWeZpK/070dyZEU5tP3nQWQpBsEGPkphP3K3OrKXYjB/wrgXhzQ6CoCWOM4WDyItWvldR67bTUw0AAmZseY2J7ZzqSz5QumctQRBJn+mEQQG1ETdBHnw5Wu5r+IEdc41vRjX+EwhxfX0dfGXHz7lCQjJpA5a3ExJRBrw=; c=relaxed/simple; s=shh3fegwg5fppqsuzphvschd53n6ihuv; d=amazonses.com; t=1788467162; v=1; bh=TuHa3oFjAMCWe/vyVBaQr73PkpNnDOISWfrmuZXT4/w=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT; Received: from PA7P264CA0031.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:34b::13) by GV1PR08MB10719.eurprd08.prod.outlook.com (2603:10a6:150:16f::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 20:25:56 +0000 Received: from MI3PEPF0000855E.eurprd05.prod.outlook.com (2603:10a6:102:34b:cafe::3f) by PA7P264CA0031.outlook.office365.com (2603:10a6:102:34b::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.12 via Frontend Transport; Thu, 3 Sep 2026 20:25:56 +0000 Authentication-Results-Original: spf=pass (sender IP is 2a00:1450:4864:20::42c) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::42c as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::42c; helo=mail-wr1-x42c.google.com; pr=C Received: from mail-wr1-x42c.google.com (2a00:1450:4864:20::42c) by MI3PEPF0000855E.mail.protection.outlook.com (2603:10a6:298:1::9a) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 20:25:56 +0000 Received: by mail-wr1-x42c.google.com with SMTP id ffacd0b85a97d-4843efcbdb2so208122f8f.2 for ; Thu, 03 Sep 2026 13:25:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1788467156; x=1789071956; darn=virtuozzo.com; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=6JSl906HgkLiCNUX0G2e1zH0MXok/IcyRAsZkHozPag=; b=PTiko06ZRMbXv2iYIx0+EwpmRA5jukKyWwCrdUwlb20FeAB5yCeGa9TT9R5luD6M54 gUILTAZ+HTORaLcd/JQkOv1ThnceYl9G9PfrbibFigYnJdf5x1P3aqhybLAYiV6xc6zx U9OuaBalOCGzA2+2KGEHxrP26FbnJy8eWNr2kijXqL4mpy6Va0oZyKZv6kKTGlVZcz2c fd27o5JoahYNv4T1fy4J92OtoDXrPzH5e9SViJ1wQWoPLrBHQf0RRW8uQgtgIsfUWaV3 +NCaldg8wyaMb4CS4PQebZ20shx2xHC3CuVBwg+mekdozFunwnDupxW8PjZZrtb2XfON 9b2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788467156; x=1789071956; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=6JSl906HgkLiCNUX0G2e1zH0MXok/IcyRAsZkHozPag=; b=Qg/a2C/55Lu7oYYvgkj+TgniIuhUztFAe7MkguLVrJTeFRF8Wz6ynmJXJzlm41bQZN dbsqZTT6CkMh1cucxqCmhyRhPIP2Z6xDBsDOTpjKz/O+XA9YF66nnoN+Gmn4b0k61lQ5 ksgWcP4PEu5Pg8On8K21KtZLUiss/AIssM8qw1lATy9Z2CHms1x+AWEV7SEF517TgT6L Ie1p6MZNF6H+X9x7o1umotIL4K+lEyuQ73IKdEWu8AdcL6ENPkNDRyB427grRvvp2A17 uQ1/g3vilEf1DFWpRwB+8UldF27/7nPjxvDi8SpggYP0z3TNjickXVagNRmPRvIcxgbU ilrg== X-Gm-Message-State: AFuF++kytPDK4xq6Qz440ZvOVXuz5CkNqlIJq5qscgMwZgin/P/rSDQj GO4gMY8vQlfGoILr+KDK2KX1bTGIy7/YRuM16z3M5m21mAqeFwYSCLBPB9c/l50cts1ysH+EU7K km2utQ1w= X-Gm-Gg: AYBFou3TQJ6sTN64Jjc8rvsYz7Zjvc+Il3zoTzM3dHbEz0RZmG4tWqUFsKvTpjz5znl gNuB4XkhS3RHdYCWwBg8x85511oMCbipJE0qC9Ba+XVEqD3WaaxfJXMlgXT5WSUAgXmormA93wY FHEBF2lVCtZN0UioK0sqWBp1ygzwyB88jefurApJACWgNpEkH+uWFz8Li6Rmxb9Z/YrSLhNt3EK MKPrcUISgl7VapkbA7dkeXdingaK39g9v/MDe3G30Yyav/Y3jQK1jBXv19FZ1JRnqK4aBig5gZL KVX9iZfJ2MDTh7nqDMH1rD58vs5u8MCayLWxyCFb+eBO68odeNI5Kv2TrtHK4auFMYf9oz7FAfE dR/1TW51bxuTmMNZmvuHkkenGIInNfqpRpBi81SpwXLcCroYYwF0GxNE1lVmetarC9yTH9fWcZB zUPlPf7imI/dsm5W5vvoWyJWL5MpGvo3/tfVN8zLyY4DeBYh2c8W+XI0WsgGwFm3T3YIU= X-Received: by 2002:a5d:64eb:0:b0:482:e4bc:51a8 with SMTP id ffacd0b85a97d-485870899cfmr3554571f8f.7.1788467155793; Thu, 03 Sep 2026 13:25:55 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:83cc:ab98:cda9:7dc]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48588394fa1sm950600f8f.8.2026.09.03.13.25.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Sep 2026 13:25:55 -0700 (PDT) From: "Denis V. Lunev" To: svt-core@virtuozzo.com Cc: den@openvz.org Subject: [QEMU HCI-8.0 PATCH 4/7] hw/display/qxl: fix TOCTOU in cursor chunk data_size handling #VSTOR-144000 Date: Thu, 3 Sep 2026 22:25:46 +0200 Message-ID: <20260903202549.2754937-5-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260903202549.2754937-1-den@openvz.org> References: <20260903202549.2754937-1-den@openvz.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 1 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:1 X-MS-TrafficTypeDiagnostic: MI3PEPF0000855E:EE_|GV1PR08MB10719:EE_|AMS1EPF00000041:EE_|PA6PR08MB10782:EE_|PAXPR08MB6942:EE_ X-MS-Office365-Filtering-Correlation-Id: e7784885-9365-4a29-2a10-08df09f99488 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA|SL X-PERCEPTION-POINT-CUSTOM: vzpp X-Microsoft-Antispam-Untrusted: BCL:0;ARA:13230040|2092899012|82310400026|43022699015|12012899012|6059299003|3072899012|13003099007|19002099009|56012099006|10067099003|5063699009|22082099003|16102099003|55112099003|18002099003; X-Microsoft-Antispam-Message-Info-Original: =?utf-8?B?b2NtMlZaSVNTNWpHVE5NMUtmSUNicTRBa3JjQ3NzNVEwSmJBbC94Nnl5WmlN?= =?utf-8?B?MWI5cU1uV1NoWUgyQVhpU2xhSVZhNHdRVXVic1NadUNKSS9wRlN5NldqaG96?= =?utf-8?B?RzFmczQzeXUrTlZuZTdZWUFWbDVRbVdwRDVVSzNoamF4RnZJWFhFUnNtOXRK?= =?utf-8?B?cVQ2R055RWZ4d1lPZVN4bXhkT0lNZldIQjFlUEV0ai9QcDlYcEJTQkZXMHhQ?= =?utf-8?B?dllnN3M1dDJJSk1DZ2VhSGNXbXIzVC96R0NuRUxKeHBWYkZaeHFpazBpU3Nl?= =?utf-8?B?dmpTRUhXRys5V1ZHWnJkeE5Gc25LSm9QYUFTMlBnOGROTUNDaE1xL2puWkN1?= =?utf-8?B?QmE4eHpTaHZCak1hZXd2MXgzZ2t3bFNRelozRXQ0b0pCN1FoeEd1bWdlOEcz?= =?utf-8?B?N0Z5a1M2b0hmZ09vTkcrNUkxSU5KR1NCRHB0cnk5cjhoOGJCck5WOVYydytH?= =?utf-8?B?RTZHRVpGeDg4VVRaRDlwUWdLYnp4YzRCNWhuVHczV1RwSU1yM3JHU3czL25u?= =?utf-8?B?SXBYVkptZkZJUTlVeWVSUWtaVHFtQWozUWZxcDhNdHRQR1NCdzNNV21lS2Fa?= =?utf-8?B?Um1HMTB6dmQybjlXSlRXaUZISVhvL2oraEpwQlR0bFNMakVEN2pNd2tHMlBs?= =?utf-8?B?Q0pEL2R4LzRRWjM0eVVUU3Q3eDNveS9Ub2RXWDlFRkpwTk8wM2llN2k5NFRz?= =?utf-8?B?aU9qSGVMbUNZUmJUY3B5M2NONWY5TURXYk1KUkhTcU1CUGRZZGRhZ1NvdG1T?= =?utf-8?B?Zm9iOFBsOVR4YW9GYi9RY3pQUWNOTVNRN0oxaERodE4vWFVIMXI0ZUZDa2hi?= =?utf-8?B?Rm54NlVkcFdqYzUrRVBIVVVRbUo4QVl4dmZ5OGZHL1Q3M04xVkJ1VXVHTk83?= =?utf-8?B?TDdrVXRjRlc2dnNVRHhmWkdSVXo1WVJzNXhwQk5rUGRhSVNKZU1wVzBnb04x?= =?utf-8?B?Z1FrWEVwbHBVMUJ0dFZ2b0cwTWUzSCsyVlcwTm9zRm9xQXFFbDBiTnJhaGdm?= =?utf-8?B?dDFOMDYwMjVhZDEvVVdNdEh6VzF2aXA3akF5SFYzY1U0Zi9Id2wwcFFOdXRr?= =?utf-8?B?VitSaDVWVUhzaFBkaWcxc2lDaTlVUk9OUFVrRFAyS1ljcFpIU0hheGR5YnI5?= =?utf-8?B?bTlhOXZKeU5SdmhHMy9QWEc0WkVyeDV3Z25aMWwvcENBMkNDNTMzRjBocHZN?= =?utf-8?B?dXBmWE5RaHo2eUhLZ1h1VnVwK09yalE3YUFwcUdPMnQ5SnlpS21Ia2FGY1c5?= =?utf-8?B?OG10b3JydGZWTU9hMk5EQzhUQTljaFIvRXN1RllXZ05pdkgzVVVBTXptMU1M?= =?utf-8?B?R2orMG1rVlhEdzUvU2tEamtWS1dCdlpiOW51cTJUejcvYnpRUmNHLzJmdmR6?= =?utf-8?B?RUlVMlp1SkNpejdObUl3NzhaTk1LMDRrLzFoZnRlaFlzZ0hXT0tjNEhXZ0pY?= =?utf-8?B?OUM2NjFUalFieXk0T3pVV3JLUGc4aUx5d2JoajV1WmhscWRRTXhkNkptWHpu?= =?utf-8?B?ZDlVZnVVMTRXWllPbmJXSHF3M1lOdFljNmpLZjFCUEtsLzJSNHdQNlRtZHFm?= =?utf-8?B?MnVpb1NOaW5hY1FQa0g1QjJIM2dZcmJzVjV4NFBKR3M0bEgyZFdsMnZDUVBp?= =?utf-8?B?cGQwM2xkRzRDVXdVcmJxNWxLb09rSUtJTDRLSTlXTDRRY3BzMDBQQ0NsVUFp?= =?utf-8?B?am4yV09lUkpHZDFneG5EemhYUFhNMWx1V2Z4ZEFPdFNhQVpzdEdLR0txalV4?= =?utf-8?B?RFppc2kzVGhWeWZRNlNjUFdVeTVaa2VNc00rMEhLck9Zbjc5cG50citjY0ZV?= =?utf-8?B?dzdnVm5namhtZ2M4cDR6S3RNRCsvQjVIVjdTOVNaOFBYUjlGdHVxTG81bUVX?= =?utf-8?B?b0FjaUNBMnQwUElSL2djUTJKc3pHNjdKZ1lBcTB1SnhDZVZCZlZDbW50U3Bt?= =?utf-8?B?YzdFZE9KYkpycW00WkJaZjN6Ujk2c0UrYml1VlNOVWJnanUzTW5aV3JVMXkw?= =?utf-8?B?Wi9VR1lsZ0c4Y0tzaE1ic1hCekRPNms0QTdIOThWamF3dUJPNkRYTlpXQmt1?= =?utf-8?B?aUFOR2s0dWRlZ2NScVNBeGRmMFZCSlJSenhZNW1hdjYwa2Fja2g4elZBUE5i?= =?utf-8?B?ZTJ2YkpoYysvWmQ5Q2lRdzR2WDhyUzY0Vk9FcjdIUG5zWXFKQ1dkNGJEMjVT?= =?utf-8?B?K1J5Q1RDN3RYZ1hJR0NrUVBsbGVEK2Q5a3lyWld0cUdqMkRDeXRjQjY3S1Rh?= =?utf-8?B?Smh4cS9JSE1jY3V6TGtLeWlmVXV5S2pRSTZ0dnZlSjJGZzFCKzRJbUIxMHpP?= =?utf-8?B?MkdjYXJPcnRKeTRnanlMd05wTzgrVExHamNlWC9UVU5RODNadlg2YUZEOC9H?= =?utf-8?B?NnpmTWVEUDkvMDloM3JsRVRISm9RTVpzdE9kY1lyV2lMRE1ya1d2eHVxbVJp?= =?utf-8?B?UG0wWTRHeHJZbXFVMTlsRFF4cHlpaW9BcUQybzh3Q0phK1NTRDJEc1RUN1E1?= =?utf-8?B?anB3RStYSi9ZaFd5Z09UcUVIT3ZMUEpEaWxicWc2QTFIYVYyeDJlcHRWTUpN?= =?utf-8?B?cEhrdElNeERicXd4REVDZHR5QzhhNUlvK05MS2FqSlp3cVUrNnEvZzAvR0Va?= =?utf-8?B?QXJ1VjFORHBTR2ZyNE9tNTJaeFVpdGJtdDZFVWZ5QTNpa3ptTnFJZlQ5ekx6?= =?utf-8?B?bHoxTEZVcFp0bVZ5Z3BMUTR6M1JubHgyV0ZnOXhSQWtabXhIeGY3d1duQmxO?= =?utf-8?B?aEZwVTJIMVkyTXF6cG81RXlpdjE0OHZCalJwd2dKOTQ1K1FDVVU2Vytsb2dl?= =?utf-8?B?QXRSWEdndE93Z1RSOGhFUTRidWxRL2JmeG4ycjhuUU55N0tlMjJzQXl4NW1r?= =?utf-8?B?bHgzYlFsY0hsRkxtVy9vNkhjWGVsZHh3WVFXM3cwb01kOGtTdkFCNjRlNTRD?= =?utf-8?B?aHVjQTJDN3pCSE1CTFRjVFZpVjhZZ2VFbERkT2pyV0c0OHJmTG42WlpTMXRM?= =?utf-8?B?NDJudldWOFpsNmZCNk9xWW11N29lZnhNZXNCdnYxRmFEcXYrcHM3YXU1S2VK?= =?utf-8?B?R1krSTJyVFVMTTJrajh5TjQ5V041RXdYUWxJWmtZRDlsRnJxeU05TWhqWFFr?= =?utf-8?B?OE80NmN1NCtUejBBYWF0Q005U3VOcXhxc1IyVW1adz09?= X-Forefront-Antispam-Report-Untrusted: CIP:2a00:1450:4864:20::42c;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x42c.google.com;PTR:mail-wr1-x42c.google.com;CAT:NONE;SFS:(13230040)(2092899012)(82310400026)(43022699015)(12012899012)(6059299003)(3072899012)(13003099007)(19002099009)(56012099006)(10067099003)(5063699009)(22082099003)(16102099003)(55112099003)(18002099003);DIR:INB; X-Auto-Response-Suppress: DR, OOF, AutoReply X-Exchange-RoutingPolicyChecked: 5TimNjIbHnVOBsiBJJhYvMGB5U9emeXpT/AeUukNroQqsiyE07pAlwFjRXQYaH4dbEol35VzsGaWSUSSRrN9GEArMnG8jKLL5m1iuIuIx8YFOlil0hdefPR+SU6TtvyJTOy8qRLFZgsCqkvTscILMm+1GWdB4+/v64MyCfs8k045BFYSUEJCq/81DunWbEbTPaNBWNBbxJW+zfWismjbXnDZJWv5yiLnqOiXYcdV4oyitu6V6PaY3yVZA5/3BqmemXdj/mbedRQHFeABAyQyRaPeqmH0fSdhqFjip/tNcI5dobE/Z6YWYjuyzkMKxIV+/3EMTmDz+2rlY5CJQ0BcKQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1PR08MB10719 X-MS-Exchange-Organization-ExpirationStartTime: 03 Sep 2026 20:26:05.3358 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: e7784885-9365-4a29-2a10-08df09f99488 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-Exchange-Transport-CrossTenantHeadersStripped: AMS1EPF00000041.eurprd04.prod.outlook.com X-MS-PublicTrafficType: Email X-MS-Exchange-Organization-AuthSource: AMS1EPF00000041.eurprd04.prod.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id-Prvs: 9ea0a76a-963c-44b9-212e-08df09f98f38 X-MS-Exchange-Organization-SCL: -1 X-Microsoft-Antispam: BCL:0;ARA:13230040|2092899012|82310400026|43022699015|12012899012|6059299003|35042699022|3072899012|13003099007|19002099009|56012099006|10067099003|5063699009|22082099003|5133699003|18003699003|16102099003|55112099003; X-Forefront-Antispam-Report: CIP:99.81.216.78;CTRY:IE;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:nat.eu.perception-point.io;PTR:nat2.eu.perception-point.io;CAT:NONE;SFS:(13230040)(2092899012)(82310400026)(43022699015)(12012899012)(6059299003)(35042699022)(3072899012)(13003099007)(19002099009)(56012099006)(10067099003)(5063699009)(22082099003)(5133699003)(18003699003)(16102099003)(55112099003);DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Sep 2026 20:26:04.7421 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e7784885-9365-4a29-2a10-08df09f99488 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: AMS1EPF00000041.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA6PR08MB10782 X-MS-Exchange-Transport-EndToEndLatency: 00:00:04.5211704 X-MS-Exchange-Processed-By-BccFoldering: 15.21.0382.004 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910005)(944506478)(944626604)(920097)(930201)(20251009189)(140003); X-Microsoft-Antispam-Message-Info: =?utf-8?B?NmlIeFJ4NXpUZERnNkwzRlVvWGROdk8vY1NxQTZ4S296Q0dEeVRCTWU2c0pE?= =?utf-8?B?OGpnRGd1cnFTcjk0TXhwZXVIQ1FNb1A0Tkw3VVZLTkhGTWM3VUlWdmRvSHcx?= =?utf-8?B?T09CWndRT3FOUDRHbm04MDAwbFBBQkE3MEE4L24yck8wODNicHFYRkxOTkts?= =?utf-8?B?OEhSSVJkUXZTR0gvUHRITVAwQjkxbTMyQlVwem1Md0JjQmx0U1BuT0srQkdI?= =?utf-8?B?US9nazRsSmxzVzBCMnlSVXh6czUzU25UeXl6QU9DaVd6dGxRdE5SWCtabDFW?= =?utf-8?B?ZlRsMjlNWkpSMmhTMmtkd1prWUFyVkpIdGVKVFdRM2dFVU1HWnhJZ2l2NHlE?= =?utf-8?B?NVg0SjBmOUs4cFhzTDVXM1hwUDJCRDZ0cnV3Ui9GZUZyNmdrTmc4ZjlaSW1k?= =?utf-8?B?c3ZYZncyWEtZTEJqaHVySFdHTDduL1NyRXFLc0JMVUVSQTM3dlBvWkI5aU9j?= =?utf-8?B?M2lCaGhiajNkaFVxUlFnUXVKRUZMM2VUR1J1U3dqVndiMkI3STNCb1pIbzVS?= =?utf-8?B?WGg2TlpsM0FoeDFPam1sUTdLYUlvYzJ3S2pyMHMxZ2oxNlQySkNFM09WZTJI?= =?utf-8?B?TEY5SXdNb1h0eFBaN0paWUNCR1pSUzZ6QzFyWktESUVsVldiNUlhM1psWTlp?= =?utf-8?B?aWlCajZ6bUZUTnE5MGNMeTR2LzMxaUdyZ2xSeTNvemJhMVVYRFI4UGpqUjUv?= =?utf-8?B?MnVhbmxFTGJXd0Y4YkxGZGNDVndqOUhhY1NmRGhxRDBibkN5MUlWOGJrWE1V?= =?utf-8?B?T0VIMEs5TUJnSjFoK29VWWVlVUNnQitkeGU3U0FkNGh5d2JBQ0NCL1BzOGQy?= =?utf-8?B?b2tNVzdCVUpQcXJMMVc2ZUl2aEI2VUF0cWluQm1pT0tqWjlQQytWTnhXOTk2?= =?utf-8?B?T1lRcW5uQzV5RklFaktGckFDNTVHLys4aXdWY3pqeEdhSjc0UThyVUtFaGxZ?= =?utf-8?B?dVdaZkxOZ3ExUVhyUUdpanhKQVA4WkNSUm9qYjVidU1OU3pHWWNJVDU2bFBa?= =?utf-8?B?TWtuMUN0cUdMZmM4TVJ2YXhGOTE1K3hsY0UrS21waXh3NlVjazRoeTlUWUhI?= =?utf-8?B?RUx4VndrdlNqQTZQTHhaMngyRFlVb1R4Y0N3ZHJhQmw1UWtCbDN2Ulk2VGFM?= =?utf-8?B?dndrdHV4SXRpSWFKSkxQV2tzSXZOT1hhQ2IyOURrdER5SjZnUEZrZVFreFlj?= =?utf-8?B?Y2R4Y21yVkkvWkdXZ2drWm5WZ0ppLzRlY2RSN01ZbGh5R2pQZVZ5dHNSL2R4?= =?utf-8?B?a3dVR3hFdCthSDIzVWhEL0pHZW9UTG13aFJNYU1qMHFkWG5EcysvYnF3ekFt?= =?utf-8?B?bUlnNmJuRCttVy9TSjltZXV1djk1UjVjSjFscmUxVU1lcFRobE5JZFhvaFdY?= =?utf-8?B?aWRIUG10a2tmV09Eb25WSkZEVTJROG4rU05oY2xtK2ZtRm55OVhYK2hRSDVL?= =?utf-8?B?SGo0Q3R4d3dEZTNYSnllZnZneU9ZUXo3aUQ1N2J3Z2daZ0ZLa2RPbGh3Mkhl?= =?utf-8?B?endVdHJ4K3JGU0NpVkZVNGdxbUJhaEh3cFJSZFhnYlREdnM1TTNOR1FaOE1E?= =?utf-8?B?eW5aVjg2Z2tCUzJPSVl1UHNIN2tQNzNDd2kwNDkyZTZWSkl5ZHJoQXJoRFo5?= =?utf-8?B?alhlV0hNaG1RNHEyZElSR2lyVDVaV09JOEdaRGhwQmR1aUd0VktSMjRqZytT?= =?utf-8?B?MlBpaXZvNExnekJlaTRJQjEwazNINnN5NmpveDdNdmlxTWRJY3ZDb2lpVnJN?= =?utf-8?B?M3I2WHNzdjdnWXZnbGZ5MFdGMFQ0bmdROXlmbWlyOVpRVFdVU3hLbVhNSWw4?= =?utf-8?B?SHRpSU5BT1ZQcmVtZ1MxeVl6aGlaTTcxUTlLRXE2R0JOTDdUaVFqTUk0MlVa?= =?utf-8?B?TEFzNE1tRWVQYjJKd0ZMbzB6aHZDK0h3UUhoalo2L0VoL1hVNjYyUEp1UFlX?= =?utf-8?B?Ymp1MjY5cUk5aUtQeVhkcldVMnkwRTFDa2F6OUxiUW1QVEVyaVZtd2RzTjFk?= =?utf-8?B?bndUZ3FQeHJZb0FXQmlwbnVtcFJ5Q3RFditoN2lLQWhaNkhIM1hIc1dXaWkx?= =?utf-8?B?YzAwZ3RLbHVlamlDSGViZjdYd1FVbEhiVmpZaFd0aHJyMDhod1FiQWg0eWxv?= =?utf-8?B?UGszRHNHU2dlckEzTU1OeHVTcTVKZW1qRlJNU1FRdDFCWGVwNlV2MTFyaGY2?= =?utf-8?B?RWJjbGxDT0JnbE04dTlTcE9lU0pOaDdpWmFzODR4WEZkdEVXbDBGdkdLWHNH?= =?utf-8?B?eFJNOWdxTDVoUk1pczdSeFVUSHpranlSckJKK0E2QTE3MEFGVG5KSWNNYVNr?= =?utf-8?B?YTl3Q3ROYkZSRnhCMmpTZWIvREpnRFhWd0l2TG54YlhJTTVBZ2VhYmx3aXJw?= =?utf-8?B?VXJuY3FPRmNoOHpWK0k0MzczcWhpYTNBQ3NrTmJ6U25IczFpZXRUMlF1dmhB?= =?utf-8?B?WS9sNVdnblNFVkhldVRUdXlZWjU4UWljM2pELzRxQTA2SThUUlBveldCRTNF?= =?utf-8?B?WW8wV2JHa0hiY3NTT2ZTYncxZlJtcjd2ZVJwRmFYL3pBbnU3dnU0Z3ZhajI3?= =?utf-8?B?QkNYMmpWZUs3MkFRTTlmcjVvaGQ4MGZKRGQrWHlpL2daaGdsSkx0SEVodS9y?= =?utf-8?B?OC9YZE9yT2I2ZTI2TldGVHJFR3M0RU9iL3ZNNWhPT0ljaUk4RmovUFVsVEZu?= =?utf-8?B?by8xR2Fhd0djVW5WZ3pWM0NPdkFWS0ZYbjBMZjF0WG56UmxES0dMdTJFeXp1?= =?utf-8?B?S0QrUGxIN1pNNkZ2cXg1SGVHT1lEdXVUaVVXS2RPK3NCNlN3NFdwWVJYendP?= =?utf-8?B?WFB2M2tJZlZRN281RXNFdFljeCtWRzNjQ2NWZFhhTHBlZzNSSVlpenJDRVJK?= =?utf-8?B?L0I0cHZlMTNDUHlBclprQ09rSGwrYk5rVnBLcVJKMVNTWXI2K1pkdzZIMEZE?= =?utf-8?B?a3NLcERGeVNMVm55cS8yNnVPYmhCemFhUzc4SnBaMjV1R1JCWTVjMW8rOFRU?= =?utf-8?B?SlpVQVFUWVYyRExxR1dOZTBsWkZmSEo1bnlFL0sxL2xETjM3ZlJVYmdqMmRn?= =?utf-8?B?SUFTZGJyZEZFcTYraW9udzVyakFWWGdOaCtOQTRNNGdBRmRRZmJxR1RoQnpY?= =?utf-8?B?T1J4UHA4cXYwamFsV0VRT1N3cHY5cjZQVkxlOHN1VGNDN2R1MEhLdWwySVRL?= =?utf-8?B?WElMLzU4dEQ5MjRib01pNHlYRDJyK3Q3Vkp1SVRocGUrUXdRWm1XNVFCVTU1?= =?utf-8?B?QjRNMFdMRzY5Nm1hS2xuUWJVcmxXQStoL01KbkE2bFJRbVllcVh0MnlWdXl3?= =?utf-8?B?ZzNRM0dpVEkzbFlBRXZOeFFtYisvb3hjK0IvT0Q1ZzBwZTRzWWw4YkJ6YXhF?= =?utf-8?B?bDQwdTJ4ZVVxRlUxVlNjeTVqS01LS0w1bEM1R0pIOXlEUkJML2ZyZ2dzT3Ft?= =?utf-8?B?Mng0Qmc2Y1BSeEtxdGdpZWh1NGlyZ00xakRTQkpGTUVZYUJjaTk4K04wKzFL?= =?utf-8?B?KzhwSkx1MmhBMmtKTGxrNms0blFoUnM1NFRUa1VOcU5pd0NOL1dHN2tHVWk5?= =?utf-8?B?TnlpME9PSXErQ2hXSTRrVndpaUpSRWN2c2taZTJUOXhkaWR5OGhEbzdoRFNj?= =?utf-8?B?OXJ3SUV4UnVBZ3c0YVdJUmgzd2liMnpyRzByeThQRUI5QjZYSE1IN0Nmc21x?= =?utf-8?B?eG1SRVF6U2NQOW5CNm5HTUpJdHR3VEFoRm1PeldjbmcwdXppcXBJNkYvTGth?= =?utf-8?Q?uJ1pLHf?= MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: QEMU List-Id: From: Marc-André Lureau Snapshot chunk.data_size into a host-local variable before passing it to qxl_phys2virt() for validation, and pass it through qxl_cursor() and qxl_unpack_chunks() so that no subsequent code re-reads the field. Without this, a racing vCPU can inflate data_size between the qxl_phys2virt() validation and the memcpy in qxl_unpack_chunks(), causing a source read past the validated region. In practice the read stays within the guest's own VRAM mmap, so the impact is limited. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3757 Reported-by: Feifan Qian Signed-off-by: Marc-Andre Lureau Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260710134352.2313675-1-marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit a3cc0069e151e5eb5db57bb4e86b00861d5b97ab) --- hw/display/qxl-render.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index 1fe63b6f5ca..cf0f6849cd0 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -217,7 +217,8 @@ void qxl_render_update_area_done(PCIQXLDevice *qxl, QXLCookie *cookie) } static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl, - QXLDataChunk *chunk, uint32_t group_id) + QXLDataChunk *chunk, uint32_t group_id, + uint32_t chunk_data_size) { uint32_t max_chunks = 32; size_t offset = 0; @@ -225,22 +226,21 @@ static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl, QXLPHYSICAL next_chunk_phys = 0; for (;;) { - bytes = MIN(size - offset, chunk->data_size); + bytes = MIN(size - offset, chunk_data_size); memcpy(dest + offset, chunk->data, bytes); offset += bytes; if (offset == size) { return; } next_chunk_phys = chunk->next_chunk; - /* fist time, only get the next chunk's data size */ chunk = qxl_phys2virt(qxl, next_chunk_phys, group_id, sizeof(QXLDataChunk)); if (!chunk) { return; } - /* second time, check data size and get data */ + chunk_data_size = chunk->data_size; chunk = qxl_phys2virt(qxl, next_chunk_phys, group_id, - sizeof(QXLDataChunk) + chunk->data_size); + sizeof(QXLDataChunk) + chunk_data_size); if (!chunk) { return; } @@ -252,7 +252,7 @@ static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl, } static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor, - uint32_t group_id) + uint32_t group_id, uint32_t chunk_data_size) { QEMUCursor *c; uint8_t *and_mask, *xor_mask; @@ -272,11 +272,11 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor, case SPICE_CURSOR_TYPE_MONO: /* Assume that the full cursor is available in a single chunk. */ size = 2 * cursor_get_mono_bpl(c) * c->height; - if (size != cursor->data_size || cursor->chunk.data_size < size) { + if (size != cursor->data_size || chunk_data_size < size) { qxl_set_guest_bug(qxl, "%s: bad monochrome cursor %ux%u" " data_size %u chunk_size %u", __func__, c->width, c->height, - cursor->data_size, cursor->chunk.data_size); + cursor->data_size, chunk_data_size); goto fail; } and_mask = cursor->chunk.data; @@ -288,7 +288,8 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor, break; case SPICE_CURSOR_TYPE_ALPHA: size = sizeof(uint32_t) * c->width * c->height; - qxl_unpack_chunks(c->data, size, qxl, &cursor->chunk, group_id); + qxl_unpack_chunks(c->data, size, qxl, &cursor->chunk, group_id, + chunk_data_size); if (qxl->debug > 2) { cursor_print_ascii_art(c, "qxl/alpha"); } @@ -325,19 +326,23 @@ int qxl_render_cursor(PCIQXLDevice *qxl, QXLCommandExt *ext) } switch (cmd->type) { case QXL_CURSOR_SET: + { + uint32_t chunk_data_size; + /* First read the QXLCursor to get QXLDataChunk::data_size ... */ cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id, sizeof(QXLCursor)); if (!cursor) { return 1; } + chunk_data_size = cursor->chunk.data_size; /* Then read including the chunked data following QXLCursor. */ cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id, - sizeof(QXLCursor) + cursor->chunk.data_size); + sizeof(QXLCursor) + chunk_data_size); if (!cursor) { return 1; } - c = qxl_cursor(qxl, cursor, ext->group_id); + c = qxl_cursor(qxl, cursor, ext->group_id, chunk_data_size); if (c == NULL) { c = cursor_builtin_left_ptr(); } @@ -351,6 +356,7 @@ int qxl_render_cursor(PCIQXLDevice *qxl, QXLCommandExt *ext) qemu_mutex_unlock(&qxl->ssd.lock); qemu_bh_schedule(qxl->ssd.cursor_bh); break; + } case QXL_CURSOR_MOVE: qemu_mutex_lock(&qxl->ssd.lock); qxl->ssd.mouse_x = cmd->u.position.x; -- 2.53.0