From 167d97a3def77ee2dbf6e908b0ecbfe2103977db Mon Sep 17 00:00:00 2001 From: Prasad J Pandit Date: Thu, 8 Sep 2016 18:15:54 +0530 Subject: [PATCH 1/3] vmsvga: correct bitmap and pixmap size checks When processing svga command DEFINE_CURSOR in vmsvga_fifo_run, the computed BITMAP and PIXMAP size are checked against the 'cursor.mask[]' and 'cursor.image[]' array sizes in bytes. Correct these checks to avoid OOB memory access. Reported-by: Qinghao Tang Reported-by: Li Qiang Signed-off-by: Prasad J Pandit Message-id: 1473338754-15430-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann --- hw/display/vmware_vga.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c index e51a05ea7e..6599cf078d 100644 --- a/hw/display/vmware_vga.c +++ b/hw/display/vmware_vga.c @@ -676,11 +676,13 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s) cursor.bpp = vmsvga_fifo_read(s); args = SVGA_BITMAP_SIZE(x, y) + SVGA_PIXMAP_SIZE(x, y, cursor.bpp); - if (cursor.width > 256 || - cursor.height > 256 || - cursor.bpp > 32 || - SVGA_BITMAP_SIZE(x, y) > sizeof cursor.mask || - SVGA_PIXMAP_SIZE(x, y, cursor.bpp) > sizeof cursor.image) { + if (cursor.width > 256 + || cursor.height > 256 + || cursor.bpp > 32 + || SVGA_BITMAP_SIZE(x, y) + > sizeof(cursor.mask) / sizeof(cursor.mask[0]) + || SVGA_PIXMAP_SIZE(x, y, cursor.bpp) + > sizeof(cursor.image) / sizeof(cursor.image[0])) { goto badcmd; } From 597966d1100ab507382da75d50a798bbb5f79977 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Thu, 8 Sep 2016 09:17:17 +0200 Subject: [PATCH 2/3] virtio-gpu-pci: tag as not hotpluggable We can't hotplug display adapters in qemu, tag virtio-gpu-pci accordingly (virtio-vga already has this). Signed-off-by: Gerd Hoffmann Acked-by: Michael S. Tsirkin Message-id: 1473319037-27645-1-git-send-email-kraxel@redhat.com --- hw/display/virtio-gpu-pci.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/display/virtio-gpu-pci.c b/hw/display/virtio-gpu-pci.c index 34a724c754..ef92c4ad6f 100644 --- a/hw/display/virtio-gpu-pci.c +++ b/hw/display/virtio-gpu-pci.c @@ -48,6 +48,7 @@ static void virtio_gpu_pci_class_init(ObjectClass *klass, void *data) set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories); dc->props = virtio_gpu_pci_properties; + dc->hotpluggable = false; k->realize = virtio_gpu_pci_realize; pcidev_k->class_id = PCI_CLASS_DISPLAY_OTHER; } From c2843e93907a4084e91573994486e810cec248a0 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Thu, 8 Sep 2016 09:16:52 +0200 Subject: [PATCH 3/3] virtio-vga: adapt to page-per-vq=off Signed-off-by: Gerd Hoffmann Message-id: 1473319012-27560-1-git-send-email-kraxel@redhat.com --- hw/display/virtio-vga.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/hw/display/virtio-vga.c b/hw/display/virtio-vga.c index 5b510a17fd..f77b401264 100644 --- a/hw/display/virtio-vga.c +++ b/hw/display/virtio-vga.c @@ -122,6 +122,17 @@ static void virtio_vga_realize(VirtIOPCIProxy *vpci_dev, Error **errp) */ vpci_dev->modern_mem_bar = 2; vpci_dev->msix_bar = 4; + + if (!(vpci_dev->flags & VIRTIO_PCI_FLAG_PAGE_PER_VQ)) { + /* + * with page-per-vq=off there is no padding space we can use + * for the stdvga registers. Make the common and isr regions + * smaller then. + */ + vpci_dev->common.size /= 2; + vpci_dev->isr.size /= 2; + } + offset = memory_region_size(&vpci_dev->modern_bar); offset -= vpci_dev->notify.size; vpci_dev->notify.offset = offset;