From nobody Mon Apr 29 14:21:37 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1507645070923959.7419110406064; Tue, 10 Oct 2017 07:17:50 -0700 (PDT) Received: from localhost ([::1]:35316 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e1vLi-0002WH-3t for importer@patchew.org; Tue, 10 Oct 2017 10:17:34 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44740) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e1vHo-0007nf-PC for qemu-devel@nongnu.org; Tue, 10 Oct 2017 10:13:38 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e1vHk-0001eR-9D for qemu-devel@nongnu.org; Tue, 10 Oct 2017 10:13:32 -0400 Received: from mx1.redhat.com ([209.132.183.28]:45964) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e1vHk-0001dR-3Q for qemu-devel@nongnu.org; Tue, 10 Oct 2017 10:13:28 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id F09A7C04B303; Tue, 10 Oct 2017 14:13:26 +0000 (UTC) Received: from sirius.home.kraxel.org (ovpn-116-239.ams2.redhat.com [10.36.116.239]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5606168872; Tue, 10 Oct 2017 14:13:24 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 87E1416A887; Tue, 10 Oct 2017 16:13:23 +0200 (CEST) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com F09A7C04B303 Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=kraxel@redhat.com From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Tue, 10 Oct 2017 16:13:21 +0200 Message-Id: <20171010141323.14049-2-kraxel@redhat.com> In-Reply-To: <20171010141323.14049-1-kraxel@redhat.com> References: <20171010141323.14049-1-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Tue, 10 Oct 2017 14:13:27 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v3 1/3] vga: drop line_offset variable X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Gerd Hoffmann , d@vidbuchanan.co.uk Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" --- hw/display/vga.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/hw/display/vga.c b/hw/display/vga.c index ed24ef7076..bf774e3402 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1464,7 +1464,7 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) { DisplaySurface *surface =3D qemu_console_surface(s->con); int y1, y, update, linesize, y_start, double_scan, mask, depth; - int width, height, shift_control, line_offset, bwidth, bits; + int width, height, shift_control, bwidth, bits; ram_addr_t page0, page1; DirtyBitmapSnapshot *snap =3D NULL; int disp_width, multi_scan, multi_run; @@ -1614,7 +1614,6 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) s->cursor_invalidate(s); } =20 - line_offset =3D s->line_offset; #if 0 printf("w=3D%d h=3D%d v=3D%d line_offset=3D%d cr[0x09]=3D0x%02x cr[0x1= 7]=3D0x%02x linecmp=3D%d sr[0x01]=3D0x%02x\n", width, height, v, line_offset, s->cr[9], s->cr[VGA_CRTC_MODE], @@ -1629,7 +1628,7 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) =20 if (!full_update) { ram_addr_t region_start =3D addr1; - ram_addr_t region_end =3D addr1 + line_offset * height; + ram_addr_t region_end =3D addr1 + s->line_offset * height; vga_sync_dirty_bitmap(s); if (s->line_compare < height) { /* split screen mode */ @@ -1681,7 +1680,7 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) if (!multi_run) { mask =3D (s->cr[VGA_CRTC_MODE] & 3) ^ 3; if ((y1 & mask) =3D=3D mask) - addr1 +=3D line_offset; + addr1 +=3D s->line_offset; y1++; multi_run =3D multi_scan; } else { --=20 2.9.3 From nobody Mon Apr 29 14:21:37 2024 Delivered-To: importer@patchew.org Received-SPF: temperror (zoho.com: Error in retrieving data from DNS) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=temperror (zoho.com: Error in retrieving data from DNS) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 150764494508029.034203671182013; Tue, 10 Oct 2017 07:15:45 -0700 (PDT) Received: from localhost ([::1]:35303 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e1vJd-0000YK-7G for importer@patchew.org; Tue, 10 Oct 2017 10:15:25 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44739) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e1vHo-0007ne-Op for qemu-devel@nongnu.org; Tue, 10 Oct 2017 10:13:38 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e1vHk-0001ef-Iw for qemu-devel@nongnu.org; Tue, 10 Oct 2017 10:13:32 -0400 Received: from mx1.redhat.com ([209.132.183.28]:47018) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e1vHk-0001dv-BD for qemu-devel@nongnu.org; Tue, 10 Oct 2017 10:13:28 -0400 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 7BADC81E1D; Tue, 10 Oct 2017 14:13:27 +0000 (UTC) Received: from sirius.home.kraxel.org (ovpn-116-239.ams2.redhat.com [10.36.116.239]) by smtp.corp.redhat.com (Postfix) with ESMTP id 63B206954A; Tue, 10 Oct 2017 14:13:24 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 8F5BB16A88F; Tue, 10 Oct 2017 16:13:23 +0200 (CEST) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 7BADC81E1D Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=kraxel@redhat.com From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Tue, 10 Oct 2017 16:13:22 +0200 Message-Id: <20171010141323.14049-3-kraxel@redhat.com> In-Reply-To: <20171010141323.14049-1-kraxel@redhat.com> References: <20171010141323.14049-1-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Tue, 10 Oct 2017 14:13:27 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v3 2/3] vga: handle cirrus vbe mode wraparounds. X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Gerd Hoffmann , d@vidbuchanan.co.uk, P J P Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_6 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Commit "3d90c62548 vga: stop passing pointers to vga_draw_line* functions" is incomplete. It doesn't handle the case that the vga rendering code tries to create a shared surface, i.e. a pixman image backed by vga video memory. That can not work in case the guest display wraps from end of video memory to the start. So force shadowing in that case. Also adjust the snapshot region calculation. Can trigger with cirrus only, when programming vbe modes using the bochs api (stdvga, also qxl and virtio-vga in vga compat mode) wrap arounds can't happen. Fixes: CVE-2017-13672 Fixes: 3d90c6254863693a6b13d918d2b8682e08bbc681 Cc: P J P Reported-by: David Buchanan Signed-off-by: Gerd Hoffmann --- hw/display/vga.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/hw/display/vga.c b/hw/display/vga.c index bf774e3402..1afceb6f16 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1465,13 +1465,13 @@ static void vga_draw_graphic(VGACommonState *s, int= full_update) DisplaySurface *surface =3D qemu_console_surface(s->con); int y1, y, update, linesize, y_start, double_scan, mask, depth; int width, height, shift_control, bwidth, bits; - ram_addr_t page0, page1; + ram_addr_t page0, page1, region_start, region_end; DirtyBitmapSnapshot *snap =3D NULL; int disp_width, multi_scan, multi_run; uint8_t *d; uint32_t v, addr1, addr; vga_draw_line_func *vga_draw_line =3D NULL; - bool share_surface; + bool share_surface, force_shadow =3D false; pixman_format_code_t format; #ifdef HOST_WORDS_BIGENDIAN bool byteswap =3D !s->big_endian_fb; @@ -1484,6 +1484,15 @@ static void vga_draw_graphic(VGACommonState *s, int = full_update) s->get_resolution(s, &width, &height); disp_width =3D width; =20 + region_start =3D (s->start_addr * 4); + region_end =3D region_start + s->line_offset * height; + if (region_end > s->vbe_size) { + /* wraps around (can happen with cirrus vbe modes) */ + region_start =3D 0; + region_end =3D s->vbe_size; + force_shadow =3D true; + } + shift_control =3D (s->gr[VGA_GFX_MODE] >> 5) & 3; double_scan =3D (s->cr[VGA_CRTC_MAX_SCAN] >> 7); if (shift_control !=3D 1) { @@ -1523,7 +1532,7 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) format =3D qemu_default_pixman_format(depth, !byteswap); if (format) { share_surface =3D dpy_gfx_check_format(s->con, format) - && !s->force_shadow; + && !s->force_shadow && !force_shadow; } else { share_surface =3D false; } @@ -1627,8 +1636,6 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) y1 =3D 0; =20 if (!full_update) { - ram_addr_t region_start =3D addr1; - ram_addr_t region_end =3D addr1 + s->line_offset * height; vga_sync_dirty_bitmap(s); if (s->line_compare < height) { /* split screen mode */ @@ -1651,10 +1658,17 @@ static void vga_draw_graphic(VGACommonState *s, int= full_update) addr =3D (addr & ~0x8000) | ((y1 & 2) << 14); } update =3D full_update; - page0 =3D addr; - page1 =3D addr + bwidth - 1; + page0 =3D addr & s->vbe_size_mask; + page1 =3D (addr + bwidth - 1) & s->vbe_size_mask; if (full_update) { update =3D 1; + } else if (page1 < page0) { + /* scanline wraps from end of video memory to the start */ + assert(force_shadow); + update =3D memory_region_snapshot_get_dirty(&s->vram, snap, + page0, 0); + update |=3D memory_region_snapshot_get_dirty(&s->vram, snap, + page1, 0); } else { update =3D memory_region_snapshot_get_dirty(&s->vram, snap, page0, page1 - page0= ); --=20 2.9.3 From nobody Mon Apr 29 14:21:37 2024 Delivered-To: importer@patchew.org Received-SPF: temperror (zoho.com: Error in retrieving data from DNS) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=temperror (zoho.com: Error in retrieving data from DNS) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 15076449450281015.5444883784968; Tue, 10 Oct 2017 07:15:45 -0700 (PDT) Received: from localhost ([::1]:35301 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e1vJb-0000WK-2p for importer@patchew.org; Tue, 10 Oct 2017 10:15:23 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44741) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e1vHo-0007ng-PE for qemu-devel@nongnu.org; Tue, 10 Oct 2017 10:13:38 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e1vHj-0001e5-Vf for qemu-devel@nongnu.org; Tue, 10 Oct 2017 10:13:32 -0400 Received: from mx1.redhat.com ([209.132.183.28]:52756) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e1vHj-0001dA-PF for qemu-devel@nongnu.org; Tue, 10 Oct 2017 10:13:27 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id DFB5580484; Tue, 10 Oct 2017 14:13:26 +0000 (UTC) Received: from sirius.home.kraxel.org (ovpn-116-239.ams2.redhat.com [10.36.116.239]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5844468889; Tue, 10 Oct 2017 14:13:24 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 9653416A89E; Tue, 10 Oct 2017 16:13:23 +0200 (CEST) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com DFB5580484 Authentication-Results: ext-mx04.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx04.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=kraxel@redhat.com From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Tue, 10 Oct 2017 16:13:23 +0200 Message-Id: <20171010141323.14049-4-kraxel@redhat.com> In-Reply-To: <20171010141323.14049-1-kraxel@redhat.com> References: <20171010141323.14049-1-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Tue, 10 Oct 2017 14:13:27 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v3 3/3] vga: add ram_addr_t cast X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Gerd Hoffmann , d@vidbuchanan.co.uk Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_6 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Reported by Coverity. Fixes: CID 1381409 Signed-off-by: Gerd Hoffmann --- hw/display/vga.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/display/vga.c b/hw/display/vga.c index 1afceb6f16..1d19f6bc48 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1485,7 +1485,7 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) disp_width =3D width; =20 region_start =3D (s->start_addr * 4); - region_end =3D region_start + s->line_offset * height; + region_end =3D region_start + (ram_addr_t)s->line_offset * height; if (region_end > s->vbe_size) { /* wraps around (can happen with cirrus vbe modes) */ region_start =3D 0; --=20 2.9.3