Re: [PATCH 1/7] hw/display/virtio-gpu-rutabaga: zero-init capset info response

Hi

On Sun, Jul 26, 2026 at 11:33 AM Akihiko Odaki
<[email protected]> wrote:
>
> On 2026/07/25 23:00, Marc-André Lureau wrote:
> > rutabaga_cmd_get_capset_info() only fills in capset_id,
> > capset_max_version and capset_max_size before sending the response to
> > the guest. The remaining fields of struct virtio_gpu_resp_capset_info,
> > including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with
> > stack garbage and leaked to the guest, including host pointers useful
> > for an ASLR bypass.
> >
> > Zero the response first, matching virgl_cmd_get_capset_info().
> >
> > Not a real risk thanks to -ftrivial-auto-var-init=zero.
>
> GCC only added -ftrivial-auto-var-init=zero in GCC 12, while QEMU still
> supports GCC 10.4/11.
>

Good point, may be we should update:
https://patchew.org/QEMU/[email protected]/

ack otherwise?

> Regards,
> Akihiko Odaki
>
> >
> > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3609
> > Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstream")
> > Reported-by: Haotian Jiang <[email protected]>
> > Signed-off-by: Marc-André Lureau <[email protected]>
> > ---
> >   hw/display/virtio-gpu-rutabaga.c | 2 ++
> >   1 file changed, 2 insertions(+)
> >
> > diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
> > index 4d7d7b245929..95a19eed7eda 100644
> > --- a/hw/display/virtio-gpu-rutabaga.c
> > +++ b/hw/display/virtio-gpu-rutabaga.c
> > @@ -555,6 +555,8 @@ rutabaga_cmd_get_capset_info(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd)
> >
> >       VIRTIO_GPU_FILL_CMD(info);
> >
> > +    memset(&resp, 0, sizeof(resp));
> > +
> >       result = rutabaga_get_capset_info(vr->rutabaga, info.capset_index,
> >                                         &resp.capset_id, &resp.capset_max_version,
> >                                         &resp.capset_max_size);
> >
>