b38b0f
From 29e3a6aebf124a88b26fd49a2dd0a99c38f918aa Mon Sep 17 00:00:00 2001
b38b0f
From: Gerd Hoffmann <kraxel@redhat.com>
b38b0f
Date: Thu, 4 Jul 2019 10:32:07 +0200
b38b0f
Subject: [PATCH 4/4] virtio-gpu: fix unmap in error path
b38b0f
MIME-Version: 1.0
b38b0f
Content-Type: text/plain; charset=UTF-8
b38b0f
Content-Transfer-Encoding: 8bit
b38b0f
b38b0f
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
b38b0f
Message-id: <20190704103207.29158-4-kraxel@redhat.com>
b38b0f
Patchwork-id: 89373
b38b0f
O-Subject: [RHEL-8.1.0 qemu-kvm PATCH v2 3/3] virtio-gpu: fix unmap in error path
b38b0f
Bugzilla: 1531543
b38b0f
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
b38b0f
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
b38b0f
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
b38b0f
b38b0f
We land here in case not everything we've asked for could be mapped.
b38b0f
So unmap only the bytes which have actually been mapped.
b38b0f
b38b0f
Also we didn't access anything, so acces_len can be 0.
b38b0f
b38b0f
Reported-by: Laszlo Ersek <lersek@redhat.com>
b38b0f
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
b38b0f
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
b38b0f
Reviewed-by: Li Qiang <liq3ea@gmail.com>
b38b0f
Message-id: 20190628072357.31782-1-kraxel@redhat.com
b38b0f
(cherry picked from commit a7f85e03b94ffaca75332cddf06426fc85ac611a)
b38b0f
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
b38b0f
---
b38b0f
 hw/display/virtio-gpu.c | 4 ++--
b38b0f
 1 file changed, 2 insertions(+), 2 deletions(-)
b38b0f
b38b0f
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
b38b0f
index 327c2be..07712d0 100644
b38b0f
--- a/hw/display/virtio-gpu.c
b38b0f
+++ b/hw/display/virtio-gpu.c
b38b0f
@@ -1158,9 +1158,9 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
b38b0f
                 if (res->iov[i].iov_base) {
b38b0f
                     dma_memory_unmap(VIRTIO_DEVICE(g)->dma_as,
b38b0f
                                      res->iov[i].iov_base,
b38b0f
-                                     res->iov[i].iov_len,
b38b0f
+                                     len,
b38b0f
                                      DMA_DIRECTION_TO_DEVICE,
b38b0f
-                                     res->iov[i].iov_len);
b38b0f
+                                     0);
b38b0f
                 }
b38b0f
                 /* ...and the mappings for previous loop iterations */
b38b0f
                 res->iov_cnt = i;
b38b0f
-- 
b38b0f
1.8.3.1
b38b0f