|
 |
bf143f |
From 100f33ff8a1d55986e43b99ba8726abc29ee8d26 Mon Sep 17 00:00:00 2001
|
|
|
bf143f |
From: Jon Maloy <jmaloy@redhat.com>
|
|
|
bf143f |
Date: Mon, 5 Dec 2022 15:32:55 -0500
|
|
|
bf143f |
Subject: [PATCH 5/5] hw/display/qxl: Assert memory slot fits in preallocated
|
|
|
bf143f |
MemoryRegion
|
|
|
bf143f |
MIME-Version: 1.0
|
|
|
bf143f |
Content-Type: text/plain; charset=UTF-8
|
|
|
bf143f |
Content-Transfer-Encoding: 8bit
|
|
|
bf143f |
|
|
|
bf143f |
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|
|
bf143f |
RH-MergeRequest: 240: hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler
|
|
|
bf143f |
RH-Bugzilla: 2148545
|
|
|
bf143f |
RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
bf143f |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
bf143f |
RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
|
bf143f |
RH-Commit: [5/5] f809ce48e7989dd6547b7c8bf1a5efc3fdcacbac (jmaloy/jons-qemu-kvm)
|
|
|
bf143f |
|
|
|
bf143f |
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=2148545
|
|
|
bf143f |
CVE: CVE-2022-4144
|
|
|
bf143f |
Upstream: Merged
|
|
|
bf143f |
|
|
|
bf143f |
commit 86fdb0582c653a9824183679403a85f588260d62
|
|
|
bf143f |
Author: Philippe Mathieu-Daudé <philmd@linaro.org>
|
|
|
bf143f |
Date: Mon Nov 28 21:27:41 2022 +0100
|
|
|
bf143f |
|
|
|
bf143f |
hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion
|
|
|
bf143f |
|
|
|
bf143f |
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
|
|
bf143f |
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
bf143f |
Message-Id: <20221128202741.4945-6-philmd@linaro.org>
|
|
|
bf143f |
|
|
|
bf143f |
(cherry picked from commit 86fdb0582c653a9824183679403a85f588260d62)
|
|
|
bf143f |
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
|
bf143f |
---
|
|
|
bf143f |
hw/display/qxl.c | 1 +
|
|
|
bf143f |
1 file changed, 1 insertion(+)
|
|
|
bf143f |
|
|
|
bf143f |
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
|
|
|
bf143f |
index 2a4b2d4158..bcd9e8716a 100644
|
|
|
bf143f |
--- a/hw/display/qxl.c
|
|
|
bf143f |
+++ b/hw/display/qxl.c
|
|
|
bf143f |
@@ -1372,6 +1372,7 @@ static int qxl_add_memslot(PCIQXLDevice *d, uint32_t slot_id, uint64_t delta,
|
|
|
bf143f |
qxl_set_guest_bug(d, "%s: pci_region = %d", __func__, pci_region);
|
|
|
bf143f |
return 1;
|
|
|
bf143f |
}
|
|
|
bf143f |
+ assert(guest_end - pci_start <= memory_region_size(mr));
|
|
|
bf143f |
|
|
|
bf143f |
virt_start = (intptr_t)memory_region_get_ram_ptr(mr);
|
|
|
bf143f |
memslot.slot_id = slot_id;
|
|
|
bf143f |
--
|
|
|
bf143f |
2.37.3
|
|
|
bf143f |
|