|
 |
9bac43 |
From 5a5e2e2d4f7cc2fd67fa970584f06a29ba69fc3a Mon Sep 17 00:00:00 2001
|
|
|
9bac43 |
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
9bac43 |
Date: Thu, 5 Oct 2017 09:49:33 +0200
|
|
|
9bac43 |
Subject: [PATCH 02/69] vga: fix display update region calculation (split
|
|
|
9bac43 |
screen)
|
|
|
9bac43 |
|
|
|
9bac43 |
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
9bac43 |
Message-id: <20171005094933.19435-2-kraxel@redhat.com>
|
|
|
9bac43 |
Patchwork-id: 76816
|
|
|
9bac43 |
O-Subject: [RHV7.5 qemu-kvm-rhev PATCH 1/1] vga: fix display update region calculation (split screen)
|
|
|
9bac43 |
Bugzilla: 1486648
|
|
|
9bac43 |
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
|
9bac43 |
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
9bac43 |
RH-Acked-by: Thomas Huth <thuth@redhat.com>
|
|
|
9bac43 |
|
|
|
9bac43 |
vga display update mis-calculated the region for the dirty bitmap
|
|
|
9bac43 |
snapshot in case split screen mode is used. This can trigger an
|
|
|
9bac43 |
assert in cpu_physical_memory_snapshot_get_dirty().
|
|
|
9bac43 |
|
|
|
9bac43 |
Impact: DoS for privileged guest users.
|
|
|
9bac43 |
|
|
|
9bac43 |
Fixes: CVE-2017-13673
|
|
|
9bac43 |
Fixes: fec5e8c92becad223df9d972770522f64aafdb72
|
|
|
9bac43 |
Cc: P J P <ppandit@redhat.com>
|
|
|
9bac43 |
Reported-by: David Buchanan <d@vidbuchanan.co.uk>
|
|
|
9bac43 |
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
9bac43 |
Message-id: 20170828123307.15392-1-kraxel@redhat.com
|
|
|
9bac43 |
(cherry picked from commit e65294157d4b69393b3f819c99f4f647452b48e3)
|
|
|
9bac43 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
9bac43 |
---
|
|
|
9bac43 |
hw/display/vga.c | 10 ++++++++--
|
|
|
9bac43 |
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
9bac43 |
|
|
|
9bac43 |
diff --git a/hw/display/vga.c b/hw/display/vga.c
|
|
|
9bac43 |
index 4c2ee0b..497c823 100644
|
|
|
9bac43 |
--- a/hw/display/vga.c
|
|
|
9bac43 |
+++ b/hw/display/vga.c
|
|
|
9bac43 |
@@ -1628,9 +1628,15 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
|
|
|
9bac43 |
y1 = 0;
|
|
|
9bac43 |
|
|
|
9bac43 |
if (!full_update) {
|
|
|
9bac43 |
+ ram_addr_t region_start = addr1;
|
|
|
9bac43 |
+ ram_addr_t region_end = addr1 + line_offset * height;
|
|
|
9bac43 |
vga_sync_dirty_bitmap(s);
|
|
|
9bac43 |
- snap = memory_region_snapshot_and_clear_dirty(&s->vram, addr1,
|
|
|
9bac43 |
- line_offset * height,
|
|
|
9bac43 |
+ if (s->line_compare < height) {
|
|
|
9bac43 |
+ /* split screen mode */
|
|
|
9bac43 |
+ region_start = 0;
|
|
|
9bac43 |
+ }
|
|
|
9bac43 |
+ snap = memory_region_snapshot_and_clear_dirty(&s->vram, region_start,
|
|
|
9bac43 |
+ region_end - region_start,
|
|
|
9bac43 |
DIRTY_MEMORY_VGA);
|
|
|
9bac43 |
}
|
|
|
9bac43 |
|
|
|
9bac43 |
--
|
|
|
9bac43 |
1.8.3.1
|
|
|
9bac43 |
|