[qemu-xen master] vga: fix display update region calculation (split screen)

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

[qemu-xen master] vga: fix display update region calculation (split screen)

patchbot
commit 99207110178edf883c797035cc70d8d6a80f616c
Author:     Gerd Hoffmann <[hidden email]>
AuthorDate: Mon Aug 28 14:33:07 2017 +0200
Commit:     Stefano Stabellini <[hidden email]>
CommitDate: Wed Oct 4 10:15:54 2017 -0700

    vga: fix display update region calculation (split screen)
   
    vga display update mis-calculated the region for the dirty bitmap
    snapshot in case split screen mode is used.  This can trigger an
    assert in cpu_physical_memory_snapshot_get_dirty().
   
    Impact:  DoS for privileged guest users.
   
    (cherry picked from commit e65294157d4b69393b3f819c99f4f647452b48e3)
   
    Fixes: CVE-2017-13673
    Fixes: fec5e8c92becad223df9d972770522f64aafdb72
    Cc: P J P <[hidden email]>
    Reported-by: David Buchanan <[hidden email]>
    Signed-off-by: Gerd Hoffmann <[hidden email]>
    Signed-off-by: Stefano Stabellini <[hidden email]>
    Message-id: [hidden email]
---
 hw/display/vga.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/display/vga.c b/hw/display/vga.c
index 63421f9..ab33668 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -1628,9 +1628,15 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
     y1 = 0;
 
     if (!full_update) {
+        ram_addr_t region_start = addr1;
+        ram_addr_t region_end = addr1 + line_offset * height;
         vga_sync_dirty_bitmap(s);
-        snap = memory_region_snapshot_and_clear_dirty(&s->vram, addr1,
-                                                      line_offset * height,
+        if (s->line_compare < height) {
+            /* split screen mode */
+            region_start = 0;
+        }
+        snap = memory_region_snapshot_and_clear_dirty(&s->vram, region_start,
+                                                      region_end - region_start,
                                                       DIRTY_MEMORY_VGA);
     }
 
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#master

_______________________________________________
Xen-changelog mailing list
[hidden email]
https://lists.xenproject.org/xen-changelog