From d0803a90c8fa54c3867ab1ae4b9aee7e57d2e0d2 Mon Sep 17 00:00:00 2001 From: Dmitry Osipenko Date: Wed, 4 Mar 2026 16:50:39 +0000 Subject: [PATCH] virtio-gpu: Validate hostmem mapping offset MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Check hostmem mapping boundaries originated from guest. Suggested-by: Akihiko Odaki Reviewed-by: Akihiko Odaki Signed-off-by: Dmitry Osipenko Message-ID: <20260303151422.977399-16-dmitry.osipenko@collabora.com> Message-ID: <20260304165043.1437519-18-alex.bennee@linaro.org> Signed-off-by: Alex Bennée --- hw/display/virtio-gpu-virgl.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c index abf7c176a6..f4d1113827 100644 --- a/hw/display/virtio-gpu-virgl.c +++ b/hw/display/virtio-gpu-virgl.c @@ -791,6 +791,7 @@ static void virgl_cmd_resource_map_blob(VirtIOGPU *g, struct virtio_gpu_resource_map_blob mblob; struct virtio_gpu_virgl_resource *res; struct virtio_gpu_resp_map_info resp; + VirtIOGPUBase *b = VIRTIO_GPU_BASE(g); int ret; VIRTIO_GPU_FILL_CMD(mblob); @@ -804,6 +805,15 @@ static void virgl_cmd_resource_map_blob(VirtIOGPU *g, return; } + if (mblob.offset + res->base.blob_size > b->conf.hostmem || + mblob.offset + res->base.blob_size < mblob.offset) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: failed to map virgl resource: invalid offset\n", + __func__); + cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; + return; + } + ret = virtio_gpu_virgl_map_resource_blob(g, res, mblob.offset); if (ret) { cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;