{"id":806558,"url":"http://patchwork.ozlabs.org/api/1.0/patches/806558/?format=json","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/1.0/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20170828123307.15392-1-kraxel@redhat.com>","date":"2017-08-28T12:33:07","name":"[v2] vga: fix display update region calculation (split screen)","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"18012907494944ee397ccd9bf4d9bd69b1dea769","submitter":{"id":589,"url":"http://patchwork.ozlabs.org/api/1.0/people/589/?format=json","name":"Gerd Hoffmann","email":"kraxel@redhat.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20170828123307.15392-1-kraxel@redhat.com/mbox/","series":[{"id":158,"url":"http://patchwork.ozlabs.org/api/1.0/series/158/?format=json","date":"2017-08-28T12:33:07","name":"[v2] vga: fix display update region calculation (split screen)","version":2,"mbox":"http://patchwork.ozlabs.org/series/158/mbox/"}],"check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/806558/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=pass (mailfrom) smtp.mailfrom=nongnu.org\n\t(client-ip=2001:4830:134:3::11; helo=lists.gnu.org;\n\tenvelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n\treceiver=)","ext-mx03.extmail.prod.ext.phx2.redhat.com;\n\tdmarc=none (p=none dis=none) header.from=redhat.com","ext-mx03.extmail.prod.ext.phx2.redhat.com;\n\tspf=fail smtp.mailfrom=kraxel@redhat.com"],"Received":["from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11])\n\t(using TLSv1 with cipher AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xgrm84sLNz9sDB\n\tfor ;\n\tMon, 28 Aug 2017 22:33:44 +1000 (AEST)","from localhost ([::1]:39659 helo=lists.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.71) (envelope-from\n\t)\n\tid 1dmJEc-0004ew-KZ\n\tfor incoming@patchwork.ozlabs.org; Mon, 28 Aug 2017 08:33:42 -0400","from eggs.gnu.org ([2001:4830:134:3::10]:42180)\n\tby lists.gnu.org with esmtp (Exim 4.71)\n\t(envelope-from ) id 1dmJEE-0004er-1k\n\tfor qemu-devel@nongnu.org; Mon, 28 Aug 2017 08:33:18 -0400","from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)\n\t(envelope-from ) id 1dmJE9-0006mq-4r\n\tfor qemu-devel@nongnu.org; Mon, 28 Aug 2017 08:33:18 -0400","from mx1.redhat.com ([209.132.183.28]:47924)\n\tby eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)\n\t(Exim 4.71) (envelope-from ) id 1dmJE8-0006mX-Us\n\tfor qemu-devel@nongnu.org; Mon, 28 Aug 2017 08:33:13 -0400","from smtp.corp.redhat.com\n\t(int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16])\n\t(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby mx1.redhat.com (Postfix) with ESMTPS id CD72B7E43C;\n\tMon, 28 Aug 2017 12:33:11 +0000 (UTC)","from sirius.home.kraxel.org (ovpn-116-70.ams2.redhat.com\n\t[10.36.116.70])\n\tby smtp.corp.redhat.com (Postfix) with ESMTP id 2A4F165E80;\n\tMon, 28 Aug 2017 12:33:09 +0000 (UTC)","by sirius.home.kraxel.org (Postfix, from userid 1000)\n\tid 70C5A16E06; Mon, 28 Aug 2017 14:33:07 +0200 (CEST)"],"DMARC-Filter":"OpenDMARC Filter v1.3.2 mx1.redhat.com CD72B7E43C","From":"Gerd Hoffmann ","To":"qemu-devel@nongnu.org","Date":"Mon, 28 Aug 2017 14:33:07 +0200","Message-Id":"<20170828123307.15392-1-kraxel@redhat.com>","X-Scanned-By":"MIMEDefang 2.79 on 10.5.11.16","X-Greylist":"Sender IP whitelisted, not delayed by milter-greylist-4.5.16\n\t(mx1.redhat.com [10.5.110.27]);\n\tMon, 28 Aug 2017 12:33:11 +0000 (UTC)","X-detected-operating-system":"by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]\n\t[fuzzy]","X-Received-From":"209.132.183.28","Subject":"[Qemu-devel] [PATCH v2] vga: fix display update region calculation\n\t(split screen)","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.21","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"Gerd Hoffmann , d@vidbuchanan.co.uk,\n\tP J P ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"\"Qemu-devel\"\n\t"},"content":"vga display update mis-calculated the region for the dirty bitmap\nsnapshot in case split screen mode is used. This can trigger an\nassert in cpu_physical_memory_snapshot_get_dirty().\n\nImpact: DoS for privileged guest users.\n\nFixes: CVE-2017-13673\nFixes: fec5e8c92becad223df9d972770522f64aafdb72\nCc: P J P \nReported-by: David Buchanan \nSigned-off-by: Gerd Hoffmann \n---\n hw/display/vga.c | 10 ++++++++--\n 1 file changed, 8 insertions(+), 2 deletions(-)","diff":"diff --git a/hw/display/vga.c b/hw/display/vga.c\nindex 63421f9ee8..ab33668402 100644\n--- a/hw/display/vga.c\n+++ b/hw/display/vga.c\n@@ -1628,9 +1628,15 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)\n y1 = 0;\n \n if (!full_update) {\n+ ram_addr_t region_start = addr1;\n+ ram_addr_t region_end = addr1 + line_offset * height;\n vga_sync_dirty_bitmap(s);\n- snap = memory_region_snapshot_and_clear_dirty(&s->vram, addr1,\n- line_offset * height,\n+ if (s->line_compare < height) {\n+ /* split screen mode */\n+ region_start = 0;\n+ }\n+ snap = memory_region_snapshot_and_clear_dirty(&s->vram, region_start,\n+ region_end - region_start,\n DIRTY_MEMORY_VGA);\n }\n \n","prefixes":["v2"]}