Re: [PATCH 1/7] hw/display/virtio-gpu-rutabaga: zero-init capset info response

On 2026/07/25 23:00, Marc-André Lureau wrote:
> rutabaga_cmd_get_capset_info() only fills in capset_id,
> capset_max_version and capset_max_size before sending the response to
> the guest. The remaining fields of struct virtio_gpu_resp_capset_info,
> including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with
> stack garbage and leaked to the guest, including host pointers useful
> for an ASLR bypass.
> 
> Zero the response first, matching virgl_cmd_get_capset_info().
> 
> Not a real risk thanks to -ftrivial-auto-var-init=zero.

GCC only added -ftrivial-auto-var-init=zero in GCC 12, while QEMU still 
supports GCC 10.4/11.

Regards,
Akihiko Odaki

> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3609
> Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstream")
> Reported-by: Haotian Jiang <[email protected]>
> Signed-off-by: Marc-André Lureau <[email protected]>
> ---
>   hw/display/virtio-gpu-rutabaga.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
> index 4d7d7b245929..95a19eed7eda 100644
> --- a/hw/display/virtio-gpu-rutabaga.c
> +++ b/hw/display/virtio-gpu-rutabaga.c
> @@ -555,6 +555,8 @@ rutabaga_cmd_get_capset_info(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd)
>   
>       VIRTIO_GPU_FILL_CMD(info);
>   
> +    memset(&resp, 0, sizeof(resp));
> +
>       result = rutabaga_get_capset_info(vr->rutabaga, info.capset_index,
>                                         &resp.capset_id, &resp.capset_max_version,
>                                         &resp.capset_max_size);
>