Re: [PATCH 1/7] hw/display/virtio-gpu-rutabaga: zero-init capset info response

On 2026/07/26 17:24, Marc-André Lureau wrote:
> Hi
> 
> On Sun, Jul 26, 2026 at 11:33 AM Akihiko Odaki
> <[email protected]> wrote:
>>
>> On 2026/07/25 23:00, Marc-André Lureau wrote:
>>> rutabaga_cmd_get_capset_info() only fills in capset_id,
>>> capset_max_version and capset_max_size before sending the response to
>>> the guest. The remaining fields of struct virtio_gpu_resp_capset_info,
>>> including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with
>>> stack garbage and leaked to the guest, including host pointers useful
>>> for an ASLR bypass.
>>>
>>> Zero the response first, matching virgl_cmd_get_capset_info().
>>>
>>> Not a real risk thanks to -ftrivial-auto-var-init=zero.
>>
>> GCC only added -ftrivial-auto-var-init=zero in GCC 12, while QEMU still
>> supports GCC 10.4/11.
>>
> 
> Good point, may be we should update:
> https://patchew.org/QEMU/[email protected]/
> 
> ack otherwise?

Yes:

Reviewed-by: Akihiko Odaki <[email protected]>

Regards.
Akihiko Odaki

> 
>> Regards,
>> Akihiko Odaki
>>
>>>
>>> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3609
>>> Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstream")
>>> Reported-by: Haotian Jiang <[email protected]>
>>> Signed-off-by: Marc-André Lureau <[email protected]>
>>> ---
>>>    hw/display/virtio-gpu-rutabaga.c | 2 ++
>>>    1 file changed, 2 insertions(+)
>>>
>>> diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
>>> index 4d7d7b245929..95a19eed7eda 100644
>>> --- a/hw/display/virtio-gpu-rutabaga.c
>>> +++ b/hw/display/virtio-gpu-rutabaga.c
>>> @@ -555,6 +555,8 @@ rutabaga_cmd_get_capset_info(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd)
>>>
>>>        VIRTIO_GPU_FILL_CMD(info);
>>>
>>> +    memset(&resp, 0, sizeof(resp));
>>> +
>>>        result = rutabaga_get_capset_info(vr->rutabaga, info.capset_index,
>>>                                          &resp.capset_id, &resp.capset_max_version,
>>>                                          &resp.capset_max_size);
>>>
>>
>