From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AS8PR08MB8420.eurprd08.prod.outlook.com (2603:10a6:20b:566::10) by PAXPR08MB6942.eurprd08.prod.outlook.com with HTTPS; Thu, 3 Sep 2026 20:26:12 +0000 Received: from AM8P191CA0014.EURP191.PROD.OUTLOOK.COM (2603:10a6:20b:21a::19) by AS8PR08MB8420.eurprd08.prod.outlook.com (2603:10a6:20b:566::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 20:26:08 +0000 Received: from AMS0EPF0000056D.eurprd02.prod.outlook.com (2603:10a6:20b:21a:cafe::4f) by AM8P191CA0014.outlook.office365.com (2603:10a6:20b:21a::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.11 via Frontend Transport; Thu, 3 Sep 2026 20:26:08 +0000 Authentication-Results: spf=softfail (sender IP is 99.81.216.78) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning openvz.org discourages use of 99.81.216.78 as permitted sender) Received: from nat.eu.perception-point.io (99.81.216.78) by AMS0EPF0000056D.mail.protection.outlook.com (10.167.242.123) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 20:26:06 +0000 X-PERCEPTION-POINT-VERDICT: CLN X-PERCEPTION-POINT-SPF: X-PERCEPTION-POINT-SPAM: PASS X-PERCEPTION-POINT-SENDER-IP: 2a00:1450:4864:20::42c X-PP-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::42c;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x42c.google.com;PTR:mail-wr1-x42c.google.com;CAT:NONE;SFS:(13230040)(12012899012)(2092899012)(3072899012)(43022699015)(6059299003)(82310400026)(19002099009)(10067099003)(55112099003)(22082099003)(16102099003)(18002099003)(5063699009)(56012099006);DIR:INB; Received: from DB6PR07CU003.outbound.protection.outlook.com (mail-db6pr07cu00300.outbound.protection.outlook.com [40.93.64.88]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id 4khk53btmruq4lu9aeqdb1rdvcd8coapcp8c1vg1; Thu, 03 Sep 2026 20:26:02 +0000 (UTC) X-SES-Spam-Verdict: PASS X-SES-Virus-Verdict: PASS Received-SPF: softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.64.88 as permitted sender) client-ip=40.93.64.88; envelope-from=den@openvz.org; helo=DB6PR07CU003.outbound.protection.outlook.com; Authentication-Results-Original: amazonses.com; spf=softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.64.88 as permitted sender) client-ip=40.93.64.88; envelope-from=den@openvz.org; helo=DB6PR07CU003.outbound.protection.outlook.com; dkim=pass header.i=@openvz.org; dmarc=pass header.from=openvz.org; X-SES-RECEIPT: AEFBQUFBQUFBQUFHQTJ0WGtWa09XSEdNb0w0U2xNeHhQd2NyQStDejVvcXZEeUczOUw3TmlRalJsQWdacUhXOFJoRDNtYWRzeExWVVZSRmtReGtCUEdHYXp0WEVKTzBLMGJOUUswQXcyOFBKZ05XWllKTGdWdjhMUVNsQzkrTGVaallyRXM3QWdyc0cyT28yMVcvaUYyQkV0czQrY1NDUkVUUldlRjhBMk1Qd0g4UW9takszU0k3Q2x1bWtRc1VSaXhZVlZ2cFl3WEUzUmFWVUtyT2x4VUg3bUg1Nnp1VVNJcmVqY05KckNLbERjUGZocEcxaC8wS2YrelByZDM5TGNtWW1mSFZiRVlzUGJXT3piSnVPUzBDR1l1U09YTVBJMmE1SmU2dkV2M2o2V0c2WW5tTHdQK1E9PQ== X-SES-DKIM-SIGNATURE: a=rsa-sha256; q=dns/txt; b=Mqa7Ec8OJ2E0Xbl1LKPuMY8D4py1zT/nr7Ky5HnkAD+JlOUHSd2AM+omGjwRmPn4wSVAUWSTc5NsS2Wq8yYlqsnWbvWucwca0uHVqkeOKyUtz5EX30TeOeQ90+lJHjPDIszIN248M6TVbvckQqENrK2PC6/GbBcir7+m/bdeUkc=; c=relaxed/simple; s=shh3fegwg5fppqsuzphvschd53n6ihuv; d=amazonses.com; t=1788467163; v=1; bh=xJLXrsTloC6IXS9TZbKNE3kUDViH/unWy2yl6E9E6/I=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT; Received: from MI1PEPF000008C7.ITAP293.PROD.OUTLOOK.COM (2603:10a6:298:1::429) by BR2PR08MB999883.eurprd08.prod.outlook.com (2603:10a6:2c8:15::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Thu, 3 Sep 2026 20:26:00 +0000 Received: from MI3PEPF0000855F.eurprd05.prod.outlook.com (2603:10a6:298:1::9b) by MI1PEPF000008C7.outlook.office365.com (2603:10a6:298:1::429) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.12 via Frontend Transport; Thu, 3 Sep 2026 20:26:00 +0000 Authentication-Results-Original: spf=pass (sender IP is 2a00:1450:4864:20::42c) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::42c as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::42c; helo=mail-wr1-x42c.google.com; pr=C Received: from mail-wr1-x42c.google.com (2a00:1450:4864:20::42c) by MI3PEPF0000855F.mail.protection.outlook.com (2603:10a6:298:1::9b) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 20:25:59 +0000 Received: by mail-wr1-x42c.google.com with SMTP id ffacd0b85a97d-47de0093c42so293655f8f.3 for ; Thu, 03 Sep 2026 13:25:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1788467158; x=1789071958; darn=virtuozzo.com; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=RYVjsW6utKm7aAJtEvy59witIKku3CINcJgFCtCJsgg=; b=Xvgfo3Kz9aKmWjcv3BvYO6PKcTnokqFepARBDfh9dCizNSGVn2cEdUGIOc0c5QZZ6P tlTDGCbshV+1tJTG4HP+3tU3Rgsbtg0aGjcodMSJtavBeb4vkL3U5YOO+RZxTbqqo+DR 15heBvg5qy6emzvU4QDzh/jiKFJ/k4XvVJ67K4JxuaUZAW/apAHj+ll4CCXbfikXpBXh UZlbcSr9c35jmCeZdHjXXh9rsFUtRR4uKw8yzgnHPJPK1qK/ueaYAK0eqvYwvcxMOwyQ zPgoRryQw657asJHEpKF1RzR+4H42JKv6QIAoq5/pbH22huCN6qMAZUjFnPgn0XaETZr IdqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788467158; x=1789071958; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=RYVjsW6utKm7aAJtEvy59witIKku3CINcJgFCtCJsgg=; b=KiUq0VSxYpWJecHSXSYAku9D2bzTwblJyr7PK+LR8ILJ9XbiLOh9MK/jR0v8d7Mtwf JYeoHepcdsGmH78qrdUS5tWGvKVtsaK+3aotvU03G1tU1svnnTF0uBdm0I+wnbQoSy8F ZwQu0dAdCFAyBKLRx4KsD3DhHbmy8/nwykBYlmRX8bnAlaeMCrXmiFc0M5J1K0pG0W/x o+Vqomvw2tCoLQBH9McF55dMzQJrxE/5JvoAO1i15KDdFD6yJh2GxbMhTMCBc9B1l5g0 MGsu9+zbGfYraJdX+0kRD00YHqdQXCO2MVGykz8+yXVQYd6ltvCaZqPZuQmpJ+OyKkr+ uh7g== X-Gm-Message-State: AFuF++lFH4EQ8l20yWJAGFmQgwEVgDoqyFp3h19LwHGeodsqYUXL/TF7 o+tDxN8BUnVZHCxXiooOPcjfHXbNy2i2pBhP7s6dCgmcOBM3NXE4J+rEQWNP/oub2zPFi9JTuX1 SyvVvfBQ= X-Gm-Gg: AYBFou1HkrBGYZPUM+mGl2pWzn1IilWqACP/oFg3xRxetxQQffSiWngaaCKd7CKSZw1 XuZnHCeZIuIxKZtqFKCTbMlVjqqksDoMBw8VjX7t7o8IlG3ThVOPNT0ctYQhzNzMR7BqWpH4hYO VlSNOFCrz49ZQEJCIfbE6e+0DuVQQRte+SerPl9o5OgMoFNstjfwYcvbI2YecBjh/ZBYQF9ov7e fRvz9N4QPlXORD0QaJEq5IFYMsj+d50Hj5/M3Q++HtWmuNG8FvkxzjKz5YMFZzZtpAOIIDcc7Q4 aFeb/+/KGnOFRde1dkFa8/YXD8ahYeYX2b2z+Lr4WHDwZfx00K1zXMLBI08wLhmTNEM7AyMKBnj aUWwRJxawlxymTpeIdy1yYDP/NzvXbUnki5/GGSl4Wv5/vbky7RpXntpmgvmreA7jZQ/cL/c39K EwHVEBQvA3gbdk30GwEzIW4d1Ew3w5cHDwPUE+u1LRv8e8iYd2as85qYcuqqBM9rpBjdo= X-Received: by 2002:a05:6000:310e:b0:481:4f9b:282b with SMTP id ffacd0b85a97d-485872b8e42mr2158912f8f.21.1788467158438; Thu, 03 Sep 2026 13:25:58 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:83cc:ab98:cda9:7dc]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48588394fa1sm950600f8f.8.2026.09.03.13.25.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Sep 2026 13:25:58 -0700 (PDT) From: "Denis V. Lunev" To: svt-core@virtuozzo.com Cc: den@openvz.org Subject: [QEMU HCI-8.0 PATCH 6/7] hw/display/qxl: unregister vm_change_state handler and BHs #VSTOR-144000 Date: Thu, 3 Sep 2026 22:25:48 +0200 Message-ID: <20260903202549.2754937-7-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260903202549.2754937-1-den@openvz.org> References: <20260903202549.2754937-1-den@openvz.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 1 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:1 X-MS-TrafficTypeDiagnostic: MI3PEPF0000855F:EE_|BR2PR08MB999883:EE_|AMS0EPF0000056D:EE_|AS8PR08MB8420:EE_|PAXPR08MB6942:EE_ X-MS-Office365-Filtering-Correlation-Id: 66ed28ee-3b9d-4e7d-7c35-08df09f99584 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA|SL X-PERCEPTION-POINT-CUSTOM: vzpp X-Microsoft-Antispam-Untrusted: BCL:0;ARA:13230040|12012899012|2092899012|3072899012|43022699015|6059299003|82310400026|19002099009|10067099003|55112099003|22082099003|16102099003|18002099003|5063699009|56012099006; X-Microsoft-Antispam-Message-Info-Original: =?utf-8?B?WXhVMlpwbDArQ0F4NGwvTzkxbFlSTEltOVFwbkM4MEhFRmFmNTNmRnFVeW9p?= =?utf-8?B?bFFYVCtUYlptK05ndzNhQzByNzBjL1JyaFdXaDFDTWRtWEJBQVc1MmtkQjdR?= =?utf-8?B?ZFhpUGRaaVRnRGN4Wjd0ckM4R0hzWkhrbUhDanlRWFB3bmlabDBKZEF0WVRz?= =?utf-8?B?NDc4WnVNL2hhMGRZeGdIWWJDdC9hVFNMaEJ4SnlyNm83N2lPZTVpR25OQTRk?= =?utf-8?B?Q3JZMzBwVUJhM1AwQVRDNGxoM0VyeDhFYkM1SDVuUFNydkQrVjNTeGtyanE3?= =?utf-8?B?RkptaVlwZnd3blF6OCtIeEtuUmEyU1lYeHRhVHlQSXY5N1d0djQrV05QRVNQ?= =?utf-8?B?K0tlcVZIZXdEbzhJdlViQ3dYbXluTldJQ3ltOUVFU1dUaUw1MXJxbEgvYmtQ?= =?utf-8?B?ZjRtUlFxQVVDRENBUmxub091M3BtQU1FSURFOVFXa1ZSQVJ5MmpVVWswUDJ4?= =?utf-8?B?bWhzZmpjWmZYNUlqbmsrZnlDWHBLOU5aOCtNT1ZlSEl6UTZBOXFMOFR1RERi?= =?utf-8?B?ckZ6S3M2VTgycy9VNS93aUJrREpFbXNtSEMzb1lJTThQdFhOczErek8rZzcz?= =?utf-8?B?d0NacTJHa2hYbnZ4RE12cWtiK3RFNmJ3MGtiaFN6Qytyd0IwaE5lS0VTWTk5?= =?utf-8?B?ZU1HZjJQMzNMZUtuTS8wUUlBSHpzRzBQaXZ6QXdrTzVCNitCL3l6UmdiRGU4?= =?utf-8?B?dEpIOGxmWkdPRkpKTEJ3N1NMVGJzNnREN2loS21nRGk0aEZXRzhjNkRLMGRn?= =?utf-8?B?dkM4WVdLRG5EVmVUbkxNWEF2MXFJbU5hSGJXc2FCTkVCNjdqVlFMS2dFMGR0?= =?utf-8?B?cGRsbWRsMTlCUlplOGJFdzl5cGx4VTUrT3hJSHZqSDN0VmZLb2dPUW9PZitS?= =?utf-8?B?RE1aRGtiUnhnZDVFRGIyNVZodVlvU2RFZHFTaTBmNVYzdXpRWkFKQkdicC9q?= =?utf-8?B?S09Bbi9heXlTT3AwcXJxZUdtdTByQWgyaWtGYmtwTEY5NldHWXZLKzRJUGJO?= =?utf-8?B?c0R0ZExOR2pHU0Q5SXJFMFplNFVGUkRlcXJSUGFRWWdESzYxZ3F3eXA3S3Vq?= =?utf-8?B?cjdyVTlkcit6UkdCcEhBVS9HTDNQNlM1QkRSZ2RiUFB6YlZWc2JqQkhMTVhX?= =?utf-8?B?TFJhSWpDVldvOVI5YVlZVHdoYkkrOXhwQ0w3RU1IREdHK1creVZWeGpDeUF1?= =?utf-8?B?RlVnUndVcER2UnlVNW9MZkZXVTFpTjlqSC90VWZIVWZsVG9McmtqZzhKSVZv?= =?utf-8?B?VUViMnVZUmZCZEYyTlFRL1RIZ1B2UkxDUzQ2dDY0MFFJNXFYeFlLYzkrb0ht?= =?utf-8?B?dEVJTXQwSSt4QjEzUEtaWTQzeWYraml3Q2xpeDE1dHQvbzVNcFVQZk44N0g2?= =?utf-8?B?eG1pUEZZeVh1Y3lnbStZQUpuMTdUT2tzaHkrKzduL2haR05NU2cyUE9qclZw?= =?utf-8?B?RFMwb0plUm5vb2gyN2ZUTnhkWmZLdzc0Q2JIemhyZXA2S1k1SmZFSlhaZGQ0?= =?utf-8?B?Y0NpeXZ4RUhiNHVLUE9GMzR4RzhsVURTanNKMktySTBHZEVTZVJlTktVWjBD?= =?utf-8?B?Y25hVkRkRnA1U3RGOHRDL2JIclRIMkRpTkd3YXRUSXpTdmpqajd6ZFppc1B5?= =?utf-8?B?UW56WDBXVzVVckRDNGovblU3bW5DRkdHTGJvT285TnliaUtHSjYvY05IWnhI?= =?utf-8?B?NzNiRlptY3JVOElSeU02MmRSU2JHUG9oektYWHh5bTM0bEtiWEIySVZIZjZV?= =?utf-8?B?VkZCdXNBbEZWL2pyV1o2RjdDS0haQkVFS0RSZnpjUEJ3YjNWS3Q3eVdCaXhi?= =?utf-8?B?NnBsTXllTFFjMjg0MUlJQ0pEOEcrSk1MRnc1ZVcrSEs0QjRia2txZFowcXFp?= =?utf-8?B?SmIzRmprUnhBV2VJdERuUVlkYnpRRFFqbE9YQ2hEVWJlSEd3UmFPR1phdjRO?= =?utf-8?B?WmI5NVB3aExKdlZGbkYraGVQN0h0ZVBsTldqZ2xKbTI0dlM4cDBBOUJVUVY5?= =?utf-8?B?WUFhVUh3SEx3NDhJUld5eEpHOXRjZ1hOaEpFZ1dMRSs5WUEwekJFRUE4TlJP?= =?utf-8?B?RzJVM0NBV1dHS3ROZDdWMFdGRkhkUi9aQ2dPLzVFbmoxYmU1NnRLWXJQMmE0?= =?utf-8?B?bkQxcWtDb3ZNb0JpaTRLTzE5ZjZwV3JVSm1BR1dWT3QyMy9DOUhYaXhzWjdY?= =?utf-8?B?SnduKzJieTJWY1lJOG5CODF5VTdnRnJkZ1hYcE9yUU9FaGdkU0xCNTZSQ0lu?= =?utf-8?B?UTZVNlBpQm1NTitqNUxXUW9BdkhkYmpEOHVJYXhrQk05ckt0QVk2WWVUYUF4?= =?utf-8?B?S2pvNytnRjFjSEV0aEhlaTUwcXpPQ0JlTlRMdnBwQnpNbWcrUElXemw5aEcw?= =?utf-8?B?Zi90SzFjTlhWR0FvM2hNYk4vRG55SVBEcjRCKzlhUmZ4WXJlZEsxZUc0U1FQ?= =?utf-8?B?Q0dVYVYzQXNmL1p6T3ZkcW1HVjF3ckRaNUphR0NQL3JtcUtuSFVPRGtDMDZY?= =?utf-8?B?bVVnSUhnTEpWYlo2TjZHcWlkQlhIVWdLRGZ3YURYWkFqWitJL3JLV2UzRmNR?= =?utf-8?B?NEdhbVg3Qkp0L1NKZUpOK0dabFVxOWpXQU8wRWFmdXEwb1VuMVYrMkxXZDVt?= =?utf-8?B?VEhlU0dQZzdmdjh1RVRsdUVlTVB0b3ZwY2hmWEkremlWMldUOUxwV1RBWkRp?= =?utf-8?B?eHNHVVdtRlVVU213WDY2Ukx3NE5OZXoyL0FpTThOS1lSbVpPeDNKSkRldG00?= =?utf-8?B?cTRYKzVYTERnNGhwWENuRzl5azROVlI4V1JwcGo0bytEVm16WThOZlM1MXdX?= =?utf-8?B?UU8waWZOaTFsYmVsVU5yYStNcDIxWUNrSFZxMEZMdEcwUmprZ1dwNEJxaHJ2?= =?utf-8?B?OWE3VzExRnIreUE1OFpmQnNlQlRFK0NyRHVzYU9ZUGNacDUyRWdqbG43R1pw?= =?utf-8?B?SVEzSVpEcVlVWS9QbGZ4WkFrdkpNVDg4MWFMZXhGMFFjekJ5WWVMem85bldh?= =?utf-8?B?YXAyRHRGVDYyMmpJUk9tUHU5MUlHZStJTDdIaWsrMXQ4WmJkWGxEZ1dMcVQv?= =?utf-8?B?eHJvOFRLNGxpbmdscVVLWFZKYXdabDJZeW9ZTVpIdThuNnJLZ3NOeTU4TVlN?= =?utf-8?B?aE5WTUV5SmhMcWJWeTZQcEdGNVZwNzlpS29qZlNjSFZMVmhFeS9wWk0wQWRK?= =?utf-8?B?RlJRNmc0QmdZZVVKUTZ4cmlCb3JlK0x5Wlk5dU5QK2ZlUjlRWWo5ZS9VNWJ1?= =?utf-8?B?enNGN0pjdlhpdWQrVisxUzRCYlJnRzZ3Y2Y5cmVuUzNyZE1RdUM3U01oaE1C?= =?utf-8?B?Mm9LcmNBWEFOY3VLcmw1amZZZlkyMkhnPT0=?= X-Forefront-Antispam-Report-Untrusted: CIP:2a00:1450:4864:20::42c;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr1-x42c.google.com;PTR:mail-wr1-x42c.google.com;CAT:NONE;SFS:(13230040)(12012899012)(2092899012)(3072899012)(43022699015)(6059299003)(82310400026)(19002099009)(10067099003)(55112099003)(22082099003)(16102099003)(18002099003)(5063699009)(56012099006);DIR:INB; X-Auto-Response-Suppress: DR, OOF, AutoReply X-Exchange-RoutingPolicyChecked: 0s/doE32I09gsRnrfaZ9FHavIWiMl6pBE7tMIWivcSUx6KAvthDxq4kEXY7Smxm0EM82X1X/D7rcGpxG5w98XWtCOQ/k85KbulKVCJZfMjptaaXj9NgaraLXeNkD2G3FaAZSjiPBfCybruGKOACq/nHPLINhH+KeOvgb7HS0WySSTA4xuUJlVA5GKQcGV7JxcgSTLtwz96lxS7vcQbX5ow25PsoQ78M5P3/fjnjiUGjt8XhU3NGq8tMeVOlgWr1yJbJrBDren8uq5unPxYLrjqMMRr7kVhvzkR/WOrzbyqkIBIr6+EL3+SqEkCV2GVUy+j7BgNVcHT5zgborVCgE6Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BR2PR08MB999883 X-MS-Exchange-Organization-ExpirationStartTime: 03 Sep 2026 20:26:06.9894 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: 66ed28ee-3b9d-4e7d-7c35-08df09f99584 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-Exchange-Transport-CrossTenantHeadersStripped: AMS0EPF0000056D.eurprd02.prod.outlook.com X-MS-PublicTrafficType: Email X-MS-Exchange-Organization-AuthSource: AMS0EPF0000056D.eurprd02.prod.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id-Prvs: 34a38101-7073-490c-6e4c-08df09f990e9 X-MS-Exchange-Organization-SCL: -1 X-Microsoft-Antispam: BCL:0;ARA:13230040|12012899012|43022699015|3072899012|2092899012|82310400026|6059299003|35042699022|19002099009|10067099003|5063699009|5133699003|22082099003|55112099003|16102099003|57112099003|18003699003; X-Forefront-Antispam-Report: CIP:99.81.216.78;CTRY:IE;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:nat.eu.perception-point.io;PTR:nat2.eu.perception-point.io;CAT:NONE;SFS:(13230040)(12012899012)(43022699015)(3072899012)(2092899012)(82310400026)(6059299003)(35042699022)(19002099009)(10067099003)(5063699009)(5133699003)(22082099003)(55112099003)(16102099003)(57112099003)(18003699003);DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Sep 2026 20:26:06.2056 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 66ed28ee-3b9d-4e7d-7c35-08df09f99584 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: AMS0EPF0000056D.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB8420 X-MS-Exchange-Transport-EndToEndLatency: 00:00:06.2350534 X-MS-Exchange-Processed-By-BccFoldering: 15.21.0382.004 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910005)(944506478)(944626604)(920097)(930201)(20251009189)(140003); X-Microsoft-Antispam-Message-Info: =?utf-8?B?SEN1SkdCcWlZdFRBaGc3Zk9ZV1g4L3Z5eWg3R2I3TWNpTy81QTR2eDBQTFNN?= =?utf-8?B?R2FicVN5UFhSME5MZ2V5QjZydUJzUU1GcWVFZVIrc3pKblBHeUNPM3dwT0hh?= =?utf-8?B?Vld4UDdTNXZvckV1RG9sWFJ1QWpxOTlmUEVsb0NUMlh3a3FKZEVNRm5JcWp5?= =?utf-8?B?TnZhM0IrMXNUVlpPTFRrS3VZM0hSVFlXMEpMd1pHeUxLbU1ubElDblMvUEVK?= =?utf-8?B?bFVhZkFEQ29lTGxOcW1WZ0JMWFEvYlJLaXdLR25FVXM1SW5BL1lvT1hJZTZC?= =?utf-8?B?K3VEVUNjU3RIK0VkdkpiUUg4djJvYnpYelp1QWErMzBrWmJUMFZLTUtRb29j?= =?utf-8?B?Qmc4RE5BR1RCVHd5Z0NkLzZjQ0VLQU5qbjNQVjBaMnVSQWlvU2lIdDd2Q1Vq?= =?utf-8?B?c0lOOHFIOEJoU2Q3N3lpcS83TXhRRG1xMTlVUFUwY2pXS3prZ0RlVmo4NVEv?= =?utf-8?B?MTdqcklRUDJXTnhhc1o5R01JYXlLMVM0SENLNElubXBMeGRRZVlSamFqdkJx?= =?utf-8?B?QVdEUU5iOHRCYXgrNWQ1UkNiT1VwNWV1cWE0ZHRQYloyQ1lQUGUxdW9aVFlq?= =?utf-8?B?UWZxdmRBMkhhZUxJTEdLdjltL05sdStZa0ZOZC95cFlMdk5ESjBFWGhjb3Ri?= =?utf-8?B?Vloydkt3cXVyMHhUNWgzSTRVRDNJUkdlQzZSWkFEZlpSTEE1MzRjS21vT3Zw?= =?utf-8?B?bU42QjM4TkJkbkJXdmxTYTdPdFZmZk5IS3dJa2pNMlU1VG9iOWRoOUN0MFpO?= =?utf-8?B?dTVwODVFSm5JU2pBUWJPRG41eFZubnNleFEzVFU1NW9zbURwdGw0TDN1empF?= =?utf-8?B?SUVXQkthOTRSZ3JtVkhBM29LY2RIT2xSOEhCN2JKcENKaUpUbU5ROWVFSkV2?= =?utf-8?B?UloxL2pkZ3c3T09oU3lGK0xkcWdSZDRhNHhST0dSOVhZN2duRmhMZVNwamdZ?= =?utf-8?B?S1hBUmFrdVEyZmFQSDNUUyt5eE5XcVR5NGlmc1BnL3g0REdyektDa1cyLzA2?= =?utf-8?B?aDBvcFBlbHRDYS92SVdKNytydDRkU3Z5VHovajFNRU1QKzRHczl1Nnh4VTA3?= =?utf-8?B?SDRFS2JCcjliWnQ4OE9GRzZrOUJsWnhwalIxVXliYlR6N1RXaFhqYy81N2tm?= =?utf-8?B?b2JGZWg4ZGJIUlhRMjZSYm8xNi9RSC9zeUZNR1l1YlZaaXZiMDM3Q2hKdk52?= =?utf-8?B?em1lM3d6bXhSTmRpT28zaWxvNDVXZmZUeG43WVkrbEhGTmN6d3U5RkJjbWNZ?= =?utf-8?B?ZHpNS2hvbXFMZ1owcnRLcW93Sm9rUW44K0JUSTc2cVBZTGhHZEFYVFBIcFRV?= =?utf-8?B?WHgycEQweHRUUlI1M0xIWlRXWlF0WDl5dzZnMVNicTV4dlRsRzM3RjFSWFkw?= =?utf-8?B?QmN5YXFodmVUTjNRWHpMTDd5OWxFeUs5WjlhQlFjOGdIUmowVmxnYVU5MFdk?= =?utf-8?B?T256YTN6TW1FL1FBSmxkTlNrdVJ5b1czQWdzeENFcm9RZ0crRUFvbzJ3bzQx?= =?utf-8?B?MTM1bk5KL2hMV0pUOTA4SU9VSkNWWHF2TU94c3ZyVGh5amxMbVRtQmFuTFZJ?= =?utf-8?B?OUNBUWVscm10MFg5cGhkNW9vcmhLdXpkUTBPN1g2OVhnbW9pNHNtL21mYWFU?= =?utf-8?B?THdVOXR6OTlzMnhvQmlEZ0ZiaHByKzlVVkZ1TlNVU0ttSWVjeUxkZzBjWG8r?= =?utf-8?B?MC80MXdNbFUvWlVRYVI2bWVnREtLWE5CZXhFT1BGS1FHdWc1REdqZmZDb1J4?= =?utf-8?B?bU5iVXFmMlNJR1NraFhKWVZTUXI4YlhlUTBJNm1NamdCaXprK2MvOGMxRXly?= =?utf-8?B?enRhUGVkYWN3aThhWHg4M24yYjRMcVVvanozUG1PTUNrRnFKRUQ4NnV3QnlO?= =?utf-8?B?UkxpbUNmM2NRZ1hYck1zQk5tL3lud0E4TXZDQlByTFJxcEx1QnVWR1NTWEFI?= =?utf-8?B?S3JZOHFGV2NaZUN4N0Nod1AveFpKcHhiNGxNTE9nWWZZSHhuMVpZcmRrS1ZE?= =?utf-8?B?bXcvb1l2N0hEN25JQzJ5Rkdoa0FYdm1HQk9YS0w1cUpkSmNuRDltSWFDS1dw?= =?utf-8?B?U2xPOVQ3UVFWRDBIV3ZSOStLNzdObTl4dXRxdGFFMUR3bHQzMXJkNXFrWElq?= =?utf-8?B?NCtLSDgvMkw3eFBZSnJKckdiek4xbWEycWxybVlrYmlQQ3dnalpac0pHVjFV?= =?utf-8?B?dEp5V1lkRVc4T3A1cnVkRmxYOW9McEQvc3JDelBka3V0dUduQjlUODMwU3NX?= =?utf-8?B?SlVQNHVyM0NId3FyeXZUVlBhK1FZYzlGRUhDUWpCZjhmdTRPeGVyTGd3cG9m?= =?utf-8?B?L1AvN1ZFTkRYc0JweU9rNlJ2ODhLOUEvayswa283Mk9kOTNZTUptQ3VBOWZp?= =?utf-8?B?REcwQzRJUzhkT0ZHck11ckxMVkZkUDVFUVcwTFNBbTY1QXd5aEZaQnJDZGMx?= =?utf-8?B?di8wcWZqVVFhREJ5c2FiVWRTUG8vODRaNWZEWmJGMkNhNGFaMzRNWDF0UC9n?= =?utf-8?B?T1NrNDR0N1RsS0hNbVAvbmRGakczMGsyNk9QL3dtcWdHSFFyM2hRV01OZmpr?= =?utf-8?B?M0lnaVhQV09QeDVqcDlucG4yNzV0Y1F3eS9OZDdDMThpRHQya2dxaFBWWjZh?= =?utf-8?B?UHhEaXRLODNBZ3pDWUp2TzV0ZTUzUjlNV0t0WXlINDc0WndhTlVudE1BZDh1?= =?utf-8?B?eTMwM1R4aStUVk8xVHdBV1JyZloyQmRCOW1VblhxLzJ2dzV5V20zRzZOdHM5?= =?utf-8?B?ckZpVmlYY0c0MUh4ZTFRNEk1ZFdTUDlmNUdFbGxEQzg5NHNOZU9zWjNRTURX?= =?utf-8?B?bW5sMldxTnFCWTZpV2gvYkVBMzFoZ2Joa2psNFFnVXAzL1dQSHhuT0xEQzRG?= =?utf-8?B?NkZqb3dPbTI1QXY0aUFNcENSMmtjMHFOUFkwcVpvNFpmZXFEMXd0ZXMvWXdh?= =?utf-8?B?OS9hL256b21nSENHcjNENmo4TWVheXdhWCttOW01ckxiYzZ3ZWwzUjR2TWlH?= =?utf-8?B?TlI1ai93TEd2Vm0wOWJwTlRLdUlnZHpUWk4yV2Z5bjFWLytQU3lOc0pwa0x0?= =?utf-8?B?NTExVWQ2eVI5QVh1U3Q4SFRPTHg0RTNrcnd2ZHhOMitST2s1ejRvRlZ6UWNJ?= =?utf-8?B?YW5yeCtFTVdFUmNhdVQycFRpQlcxdEVHNkpDWnRCYzRISEQrV3dTK0VrQzRt?= =?utf-8?B?R0t1c0RXZFIzaW9MQjRzUGtRUkdBT3lZTkRQbDVLVFd1cXJQYnpZUHlhUFdL?= =?utf-8?B?UFpreFJnQi9XN3dvWWZIbGNUTDNZL2cyV0tPVzhZS05yVi9xdWczY0ZVR243?= =?utf-8?B?ZXB5SWZNa2dRdlZsV21aWXUybjV4SnZzSWNkYUFzazRDL2Vvd2NuRU9RT1Vp?= =?utf-8?B?bEN0UEVMMkZ4dEltYlVSZXJwUkw0azlOWXJkaHl5UStNRnZiRVpZQ1JIbkh3?= =?utf-8?B?ZkhoWHRLVmNONFFZZzh0Z1ZCamcydXNqYnZTaktPNllqVitpbU1zQ1NTOU9Q?= =?utf-8?B?VXREdzdRenlOdHA1S3JUU0tyeEdKQnJZUWo4VnpPNmx4aXNRSjZ1bFdSeUl5?= =?utf-8?B?R2RlU1Fmb1dDUUpSUzlycmVUSWRER0t3TWNXS3BFY09Sb3JUMDRRRlFNdEZE?= =?utf-8?B?NXU1b2t6aFNyL1YzamQ4VURjR0hhQUJVdFNESENwalBEVUIwZUwwdTBOd1Qy?= =?utf-8?B?YmhFbWJKN0didz09?= MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: QEMU List-Id: From: Haotian Jiang qxl_realize_common() registers a vm_change_state handler via qemu_add_vm_change_state_handler() and creates three bottom halves (update_irq, update_area_bh, cursor_bh), but none are ever cleaned up. The return value of qemu_add_vm_change_state_handler() is discarded, so the handler is never removed from the global list, and there is no PCIDeviceClass.exit callback to delete the BHs. When a secondary QXL device (hotpluggable by default) is hot-unplugged via device_del, the PCIQXLDevice memory is freed but the vm_state handler and BH entries remain with dangling opaque pointers. On the next VM state change (stop/cont/migrate) or BH dispatch, the callback dereferences freed memory, causing a use-after-free. Fix this by storing the VMChangeStateEntry returned by qemu_add_vm_change_state_handler() and adding a qxl_exit() callback that deletes the vm_state handler, all three BHs, and the guest_surfaces.cmds allocation before the device memory is freed. Fixes: a19cbfb34642 ("spice: add qxl device") Fixes: CVE-2026-63322 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3607 Signed-off-by: Haotian Jiang Cc: qemu-stable@nongnu.org [ Marc-André - tweak commit message, add TODO ] Reviewed-by: Marc-André Lureau Message-ID: <20260720024855.3757499-1-jianghaotian.sunday@gmail.com> (cherry picked from commit 4727cc883b7e81d2c30b9801af54482d65b84292) --- hw/display/qxl.c | 16 +++++++++++++++- hw/display/qxl.h | 1 + 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/hw/display/qxl.c b/hw/display/qxl.c index a6eea18730e..994bfcaa522 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -2225,7 +2225,8 @@ static void qxl_realize_common(PCIQXLDevice *qxl, Error **errp) } #endif - qemu_add_vm_change_state_handler(qxl_vm_change_state_handler, qxl); + qxl->vmstate_handler = + qemu_add_vm_change_state_handler(qxl_vm_change_state_handler, qxl); qxl->update_irq = qemu_bh_new_guarded(qxl_update_irq_bh, qxl, &DEVICE(qxl)->mem_reentrancy_guard); @@ -2504,6 +2505,18 @@ static const Property qxl_properties[] = { subsystem_vendor_id, PCI_VENDOR_ID_REDHAT_QUMRANET), }; +static void qxl_exit(PCIDevice *dev) +{ + PCIQXLDevice *qxl = PCI_QXL(dev); + + /* TODO: complete cleanup, error paths etc */ + g_clear_pointer(&qxl->vmstate_handler, qemu_del_vm_change_state_handler); + g_clear_pointer(&qxl->update_irq, qemu_bh_delete); + g_clear_pointer(&qxl->update_area_bh, qemu_bh_delete); + g_clear_pointer(&qxl->ssd.cursor_bh, qemu_bh_delete); + g_clear_pointer(&qxl->guest_surfaces.cmds, g_free); +} + static void qxl_pci_class_init(ObjectClass *klass, const void *data) { DeviceClass *dc = DEVICE_CLASS(klass); @@ -2511,6 +2524,7 @@ static void qxl_pci_class_init(ObjectClass *klass, const void *data) k->vendor_id = REDHAT_PCI_VENDOR_ID; k->device_id = QXL_DEVICE_ID_STABLE; + k->exit = qxl_exit; set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories); device_class_set_legacy_reset(dc, qxl_reset_handler); dc->vmsd = &qxl_vmstate; diff --git a/hw/display/qxl.h b/hw/display/qxl.h index 4afdbdd1ed8..a25d9865453 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -83,6 +83,7 @@ struct PCIQXLDevice { /* thread signaling */ QEMUBH *update_irq; + VMChangeStateEntry *vmstate_handler; /* ram pci bar */ QXLRam *ram; -- 2.53.0