Re: [PATCH] hw/display/virtio-gpu: Fix empty blob discrimination

On 2026/07/28 6:35, Michael Tokarev wrote:
> On 7/25/26 10:12, Akihiko Odaki wrote:
>> Discriminating blobs by checking whether blob_size is nonzero fails for
>> empty blobs. Identify 2D resources by their non-NULL image instead.
>>
>> Fixes: bdd53f739273 ("virtio-gpu: Update cursor data using blob")
>> Fixes: f66767f75c9c ("virtio-gpu: add virtio-gpu/blob vmstate 
>> subsection")
>> Signed-off-by: Akihiko Odaki <[email protected]>
>> ---
>>   hw/display/virtio-gpu.c | 18 +++++++++---------
>>   1 file changed, 9 insertions(+), 9 deletions(-)
> 
> Is this a qemu-stable material?  I've no idea from the description
> about the implication of the previous behavior.

This fix is not important nor a regression but you may still pick it.

The consequence of the bug this patch fixes is a NULL pointer 
dereference and denial-of-service. docs/devel/stable-process.rst says:

 > Generally, the following patches are considered stable material:
 >
 > * Patches that fix severe issues, like fixes for CVEs
 >
 > * Patches that fix regressions

And I don't think this match with the description. It still does fix a 
bug, and I think you can cleanly backport it and you tend to backport 
such a patch.

Regards,
Akihiko Odaki

> 
> Thanks,
> 
> /mjt
> 
>> diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
>> index 718ba3039290..6413df029b8e 100644
>> --- a/hw/display/virtio-gpu.c
>> +++ b/hw/display/virtio-gpu.c
>> @@ -56,18 +56,18 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g,
>>           return;
>>       }
>> -    if (res->blob_size) {
>> -        if (res->blob_size < (s->current_cursor->width *
>> -                              s->current_cursor->height * 4)) {
>> -            return;
>> -        }
>> -        data = res->blob;
>> -    } else {
>> +    if (res->image) {
>>           if (pixman_image_get_width(res->image)  != s- 
>> >current_cursor->width ||
>>               pixman_image_get_height(res->image) != s- 
>> >current_cursor->height) {
>>               return;
>>           }
>>           data = pixman_image_get_data(res->image);
>> +    } else {
>> +        if (res->blob_size < (s->current_cursor->width *
>> +                              s->current_cursor->height * 4)) {
>> +            return;
>> +        }
>> +        data = res->blob;
>>       }
>>       pixels = s->current_cursor->width * s->current_cursor->height;
>> @@ -1279,7 +1279,7 @@ static int virtio_gpu_save(QEMUFile *f, void 
>> *opaque, size_t size,
>>       assert(QTAILQ_EMPTY(&g->cmdq));
>>       QTAILQ_FOREACH(res, &g->reslist, next) {
>> -        if (res->blob_size) {
>> +        if (!res->image) {
>>               continue;
>>           }
>>           qemu_put_be32(f, res->resource_id);
>> @@ -1430,7 +1430,7 @@ static int virtio_gpu_blob_save(QEMUFile *f, 
>> void *opaque, size_t size,
>>       assert(QTAILQ_EMPTY(&g->cmdq));
>>       QTAILQ_FOREACH(res, &g->reslist, next) {
>> -        if (!res->blob_size) {
>> +        if (res->image) {
>>               continue;
>>           }
>>           assert(!res->image);
>>
>> ---
>> base-commit: 006a22cb26998998385b104db1ff9466ef2f3153
>> change-id: 20260725-image-6c8566fb1253
>>
>> Best regards,
>> -- 
>> Akihiko Odaki <[email protected]>
>>
>>
>