From nobody Tue Dec 16 09:00:16 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1512590391461511.80051204214453; Wed, 6 Dec 2017 11:59:51 -0800 (PST) Received: from localhost ([::1]:57444 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eMfr9-0001n2-KE for importer@patchew.org; Wed, 06 Dec 2017 14:59:47 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50165) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eMfCr-0001B0-AR for qemu-devel@nongnu.org; Wed, 06 Dec 2017 14:18:11 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eMfCo-0001Av-5P for qemu-devel@nongnu.org; Wed, 06 Dec 2017 14:18:09 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:33034 helo=mx0a-001b2d01.pphosted.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eMfCn-0001AU-VI for qemu-devel@nongnu.org; Wed, 06 Dec 2017 14:18:06 -0500 Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id vB6JFUdo011870 for ; Wed, 6 Dec 2017 14:18:05 -0500 Received: from e12.ny.us.ibm.com (e12.ny.us.ibm.com [129.33.205.202]) by mx0a-001b2d01.pphosted.com with ESMTP id 2epphvr3gw-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Wed, 06 Dec 2017 14:18:05 -0500 Received: from localhost by e12.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 6 Dec 2017 14:18:04 -0500 Received: from b01cxnp22036.gho.pok.ibm.com (9.57.198.26) by e12.ny.us.ibm.com (146.89.104.199) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Wed, 6 Dec 2017 14:18:02 -0500 Received: from b01ledav001.gho.pok.ibm.com (b01ledav001.gho.pok.ibm.com [9.57.199.106]) by b01cxnp22036.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id vB6JI14w48037970; Wed, 6 Dec 2017 19:18:01 GMT Received: from b01ledav001.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A14D42803E; Wed, 6 Dec 2017 14:17:28 -0500 (EST) Received: from localhost (unknown [9.80.93.86]) by b01ledav001.gho.pok.ibm.com (Postfix) with ESMTP id 5E7852803A; Wed, 6 Dec 2017 14:17:28 -0500 (EST) From: Michael Roth To: qemu-devel@nongnu.org Date: Wed, 6 Dec 2017 13:16:48 -0600 X-Mailer: git-send-email 2.11.0 In-Reply-To: <20171206191648.18208-1-mdroth@linux.vnet.ibm.com> References: <20171206191648.18208-1-mdroth@linux.vnet.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 17120619-0048-0000-0000-00000210AF9A X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00008161; HX=3.00000241; KW=3.00000007; PH=3.00000004; SC=3.00000244; SDB=6.00956379; UDB=6.00483442; IPR=6.00736416; BA=6.00005729; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00018387; XFM=3.00000015; UTC=2017-12-06 19:18:03 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17120619-0049-0000-0000-0000436208A0 Message-Id: <20171206191648.18208-56-mdroth@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-12-06_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1712060273 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.158.5 Subject: [Qemu-devel] [PATCH 55/55] vga: handle cirrus vbe mode wraparounds. X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: P J P , qemu-stable@nongnu.org, Gerd Hoffmann Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Gerd Hoffmann Commit "3d90c62548 vga: stop passing pointers to vga_draw_line* functions" is incomplete. It doesn't handle the case that the vga rendering code tries to create a shared surface, i.e. a pixman image backed by vga video memory. That can not work in case the guest display wraps from end of video memory to the start. So force shadowing in that case. Also adjust the snapshot region calculation. Can trigger with cirrus only, when programming vbe modes using the bochs api (stdvga, also qxl and virtio-vga in vga compat mode) wrap arounds can't happen. Fixes: CVE-2017-13672 Fixes: 3d90c6254863693a6b13d918d2b8682e08bbc681 Cc: P J P Reported-by: David Buchanan Signed-off-by: Gerd Hoffmann Message-id: 20171010141323.14049-3-kraxel@redhat.com (cherry picked from commit 28f77de26a4f9995458ddeb9d34bb06c0193bdc9) Signed-off-by: Michael Roth --- hw/display/vga.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/hw/display/vga.c b/hw/display/vga.c index 895e95c3f4..06ca3daa4c 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1465,13 +1465,13 @@ static void vga_draw_graphic(VGACommonState *s, int= full_update) DisplaySurface *surface =3D qemu_console_surface(s->con); int y1, y, update, linesize, y_start, double_scan, mask, depth; int width, height, shift_control, bwidth, bits; - ram_addr_t page0, page1; + ram_addr_t page0, page1, region_start, region_end; DirtyBitmapSnapshot *snap =3D NULL; int disp_width, multi_scan, multi_run; uint8_t *d; uint32_t v, addr1, addr; vga_draw_line_func *vga_draw_line =3D NULL; - bool share_surface; + bool share_surface, force_shadow =3D false; pixman_format_code_t format; #ifdef HOST_WORDS_BIGENDIAN bool byteswap =3D !s->big_endian_fb; @@ -1484,6 +1484,15 @@ static void vga_draw_graphic(VGACommonState *s, int = full_update) s->get_resolution(s, &width, &height); disp_width =3D width; =20 + region_start =3D (s->start_addr * 4); + region_end =3D region_start + s->line_offset * height; + if (region_end > s->vbe_size) { + /* wraps around (can happen with cirrus vbe modes) */ + region_start =3D 0; + region_end =3D s->vbe_size; + force_shadow =3D true; + } + shift_control =3D (s->gr[VGA_GFX_MODE] >> 5) & 3; double_scan =3D (s->cr[VGA_CRTC_MAX_SCAN] >> 7); if (shift_control !=3D 1) { @@ -1523,7 +1532,7 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) format =3D qemu_default_pixman_format(depth, !byteswap); if (format) { share_surface =3D dpy_gfx_check_format(s->con, format) - && !s->force_shadow; + && !s->force_shadow && !force_shadow; } else { share_surface =3D false; } @@ -1627,8 +1636,6 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) y1 =3D 0; =20 if (!full_update) { - ram_addr_t region_start =3D addr1; - ram_addr_t region_end =3D addr1 + s->line_offset * height; vga_sync_dirty_bitmap(s); if (s->line_compare < height) { /* split screen mode */ @@ -1651,10 +1658,17 @@ static void vga_draw_graphic(VGACommonState *s, int= full_update) addr =3D (addr & ~0x8000) | ((y1 & 2) << 14); } update =3D full_update; - page0 =3D addr; - page1 =3D addr + bwidth - 1; + page0 =3D addr & s->vbe_size_mask; + page1 =3D (addr + bwidth - 1) & s->vbe_size_mask; if (full_update) { update =3D 1; + } else if (page1 < page0) { + /* scanline wraps from end of video memory to the start */ + assert(force_shadow); + update =3D memory_region_snapshot_get_dirty(&s->vram, snap, + page0, 0); + update |=3D memory_region_snapshot_get_dirty(&s->vram, snap, + page1, 0); } else { update =3D memory_region_snapshot_get_dirty(&s->vram, snap, page0, page1 - page0= ); --=20 2.11.0