From nobody Mon Apr 29 01:23:59 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linaro.org ARC-Seal: i=1; a=rsa-sha256; t=1669643389; cv=none; d=zohomail.com; s=zohoarc; b=YcxNb3AJ4ApGCbeT/eLGm9f1REEOlQ3TjAjsdw1fsa6qhcyC1o33sKZpt0K+Y3Ug3j4e0x5I31kRNzXJTX1XO7aqeU8gkMXaa/eJQDAqUDkZiGUQKgaCUZU+SS9S0d0hXh5mkOhZIvh1Ff010drWAHRJB4ZENDyzS3TFSvARX3U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1669643389; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=iYHeDZzoQ050kMmL2gly3nfjXqnhqur/NbBZzIah+Ds=; b=AyZ/FhBiASjnxnh/v7mItsVFFbla74YV+PDPPQA7x1MK+s/cBC3pAOONBXuNOfiHgJ7AeVqJN+V55ofJa8OrNtPs5eR2/Th9GozlmcmGHr47YO2SoIcBkDfoA/jYv7d0Vz7eaK278pIVVPbAswumzvKYU2SlVF6/Nb5GyeiYRwI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1669643389662564.6926303452508; Mon, 28 Nov 2022 05:49:49 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeV2-0004tP-OE; Mon, 28 Nov 2022 08:48:44 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeV1-0004t9-7a for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:43 -0500 Received: from mail-wm1-x329.google.com ([2a00:1450:4864:20::329]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeUz-0000Hq-6i for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:42 -0500 Received: by mail-wm1-x329.google.com with SMTP id ay14-20020a05600c1e0e00b003cf6ab34b61so11674651wmb.2 for ; Mon, 28 Nov 2022 05:48:40 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id s11-20020a5d69cb000000b002366f9bd717sm12819084wrw.45.2022.11.28.05.48.38 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=iYHeDZzoQ050kMmL2gly3nfjXqnhqur/NbBZzIah+Ds=; b=kYL3A7aqILslZh5SGQrbc1YKknxmIPXfWsAic8JV3eiYGqioyfBs1QYZIo/8AXiWg2 uQNo3+QQAiysWtOPy9hfbqC2CteMNFMAFb3Y6ytJtU54YHibyfIyeCw0htqJ9ZJ3qU+u NUBh5ZDavUvFSEmB44qTi40s4sweglbNe1UnBuS+Fe+HDCiFkpUlliyWRdcgynkRRKrA uK0YksAzKypQe/QPb31YY3D4CP9LlVD6gl61rfrLF/Ztcu9YAMj3S91HzuhaYgiANv7X ZUYhSQZ6F1+3PAkdbzxx3SLSg6z+BzO+pdaTPAqFyUdblZPa56XVOtl0bo9A0QxA6fEK M12g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=iYHeDZzoQ050kMmL2gly3nfjXqnhqur/NbBZzIah+Ds=; b=qnHTv13hOtVD8I2sU1nRtexknntVAF0U2qO7IVldXK8AwRXjUQjbJxAh7B7FH54cU5 TTGM8M7Gm2uR4oFG6aZE1NVv57njHlQNX6drpvUmuAjukfWisu3Iiyx1fWdS7/7jVnPy I0vTkNlbjtoU1HEhPcCp7Jnv/qyYpNJOyosI78NWZDExGoYtjRZfzP9At33zEYfVUXnq Pm+iVvPy29Uq19EwIzC3+ib/IiVFzBp89pZ/O8LqHy7ZJqtDFpDHy8T2gnYShVuBxaDA qqbDAvLDpDX4hDbVE4HQFjauC1hF/BlZmDiLmq2o1dYlOLvnQ3QVP+ety9FVJY1g/cJ3 v2aw== X-Gm-Message-State: ANoB5pmsOMyXD3WEjTXhucI+j3TWT8waeNA/STk7BWSg6xybBtzsoEDe RY1ndq+dWQEYyJfKuPn6JUEthA== X-Google-Smtp-Source: AA0mqf6Ei0MXNrSlqz/ppQBRb1UBW2uc/JNwDJA9jv7WL9kSBr5qJoR/Fb4fy7Z9PTP5RGdKGtcCDQ== X-Received: by 2002:a05:600c:3b8f:b0:3d0:2485:c06a with SMTP id n15-20020a05600c3b8f00b003d02485c06amr27019175wms.26.1669643319634; Mon, 28 Nov 2022 05:48:39 -0800 (PST) From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [PATCH-for-7.2 1/5] hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler Date: Mon, 28 Nov 2022 14:48:28 +0100 Message-Id: <20221128134832.84867-2-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::329; envelope-from=philmd@linaro.org; helo=mail-wm1-x329.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linaro.org) X-ZM-MESSAGEID: 1669643391965100011 Only 3 command types are logged: no need to call qxl_phys2virt() for the other types. Using different cases will help to pass different structure sizes to qxl_phys2virt() in a pair of commits. Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Philippe Mathieu-Daud=C3=A9 --- hw/display/qxl-logger.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/hw/display/qxl-logger.c b/hw/display/qxl-logger.c index 68bfa47568..1bcf803db6 100644 --- a/hw/display/qxl-logger.c +++ b/hw/display/qxl-logger.c @@ -247,6 +247,16 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *rin= g, QXLCommandExt *ext) qxl_name(qxl_type, ext->cmd.type), compat ? "(compat)" : ""); =20 + switch (ext->cmd.type) { + case QXL_CMD_DRAW: + break; + case QXL_CMD_SURFACE: + break; + case QXL_CMD_CURSOR: + break; + default: + goto out; + } data =3D qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); if (!data) { return 1; @@ -269,6 +279,7 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring= , QXLCommandExt *ext) qxl_log_cmd_cursor(qxl, data, ext->group_id); break; } +out: fprintf(stderr, "\n"); return 0; } --=20 2.38.1 From nobody Mon Apr 29 01:23:59 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linaro.org ARC-Seal: i=1; a=rsa-sha256; t=1669643388; cv=none; d=zohomail.com; s=zohoarc; b=a6WpF7GGI9SKQRROcc/w+0C7Iy0R2MT0HRmEKTVsMbtBbMd1YLCNMomEXrvs3fyBixEvns2sNqB80ZYNRyhuhF+6IBMbrf+SSnM1su0Xa5q9N6ToLNJKiIr+CiDu73jIGJndvQbGCEBVoWBrxlgOjnqtTOeELhepnJiwPDhcAE8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1669643388; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=W0LmLK78PoGRSMUT27s353jmU2diODdc3ZkNcicNIYI=; b=g1xp5+/pxwraMuCWTuDmZaLixdZC95CufJ4MPi+t4myx4XfxHPTWRFg+hU6qnK/4ND28XM6tOa/BIKYzNg+wZ2XdQhKCZpIuXEsdttdefTI+61xyaFQkISRzsz1rTg4oBXquqGFiN082WnmsVePFgDMLCvs+011aaL8SSQ9PBVY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1669643388746480.05007108453606; Mon, 28 Nov 2022 05:49:48 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeVB-0004vg-Ji; Mon, 28 Nov 2022 08:48:53 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeV5-0004u1-D9 for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:47 -0500 Received: from mail-wm1-x336.google.com ([2a00:1450:4864:20::336]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeV3-0000Ih-Tv for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:47 -0500 Received: by mail-wm1-x336.google.com with SMTP id t25-20020a1c7719000000b003cfa34ea516so9488092wmi.1 for ; Mon, 28 Nov 2022 05:48:45 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id u22-20020a7bc056000000b003c6c1686b10sm18591855wmc.7.2022.11.28.05.48.43 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=W0LmLK78PoGRSMUT27s353jmU2diODdc3ZkNcicNIYI=; b=Oby9ef7PoHRY6bMl/8OjOSyn41pKYJCZMMbvmgG1Tt3Epu4yFqSKOKTQJzT5P1jHoW p7J8PJy9MbAT++jQ3XUEwL6fWgd3bMytwUUxGQQLzxGvqHsCQ8P6CDXKjlNDdBPfpis0 CwU8XQOlvz0C/XpZkvNMG3T/sxOkq6XY7GGGX13PDHhLs+z9qiJoP9zzlurlp8cLKzGD 0I3KnJSMpWqbe/vIaWpMyKKYk40L0TS5evntWecPeRau/D5MIewzD3IxQ6YnzRAhKYg1 MAt/mzbY2Wn7P3hIGPipt85/A3rstEj5nmDmxWXAvURhVk6slODpLon5QiFFqU6wEotI bXWA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=W0LmLK78PoGRSMUT27s353jmU2diODdc3ZkNcicNIYI=; b=RvwB5TaySx/M6s+g6Br//1qgVxMlDsAkf7WYcboXiU1lwaLiUWqyz3vokJYaAE7H5X NQDY+9akq/nBIYKhgzjtZ+JXWaB7Qexo3wVMGafyHEtCc4RtBFh5Bk9b4EdWT26GksmM a26iouB2SI3M/dcGHqUUEu4Rk93l3enxYex5hJ6KCXXBXgq7emJcMgkZun3VvNyvvPgj C2JkVW2mHMYPeE3zv1EFXKwKx75q58aLtY9rQfyQkcyO26lGQNRNo5VpzlFaq98ConNg pId/wUYbEIt/Fk43MiYm+Ye3OA6Ghd740ufpB1D6rkpTvM3SDL4uQ1r8k2kmYXsCgM+7 d27Q== X-Gm-Message-State: ANoB5pme4Xbc8AlIOzFkiohxL/NbSeqZRmzv+hEF/QjlfmgXJCkcDglg D83DqJVUKOCUGN3Vo/Ug/3uOUNcBnwjJuz6m X-Google-Smtp-Source: AA0mqf6KFrzWvTKmyO4x9YlmsAGTxb68w+/KUZuGlVnvhdNVi9FtFMFMR0lUjWN+rWFO72MNNdVPzQ== X-Received: by 2002:a05:600c:1f0f:b0:3d0:2a82:1cb2 with SMTP id bd15-20020a05600c1f0f00b003d02a821cb2mr23452111wmb.206.1669643324692; Mon, 28 Nov 2022 05:48:44 -0800 (PST) From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [PATCH-for-7.2 2/5] hw/display/qxl: Document qxl_phys2virt() Date: Mon, 28 Nov 2022 14:48:29 +0100 Message-Id: <20221128134832.84867-3-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::336; envelope-from=philmd@linaro.org; helo=mail-wm1-x336.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linaro.org) X-ZM-MESSAGEID: 1669643390110100001 Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Philippe Mathieu-Daud=C3=A9 --- hw/display/qxl.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/hw/display/qxl.h b/hw/display/qxl.h index e74de9579d..78b3a6c9ba 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -147,6 +147,25 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) #define QXL_DEFAULT_REVISION (QXL_REVISION_STABLE_V12 + 1) =20 /* qxl.c */ +/** + * qxl_phys2virt: Get a pointer within a PCI VRAM memory region. + * + * @qxl: QXL device + * @phys: physical offset of buffer within the VRAM + * @group_id: memory slot group + * + * Returns a host pointer to a buffer placed at offset @phys within the + * active slot @group_id of the PCI VGA RAM memory region associated with + * the @qxl device. If the slot is inactive, or the offset is out + * of the memory region, returns NULL. + * + * Use with care; by the time this function returns, the returned pointer = is + * not protected by RCU anymore. If the caller is not within an RCU criti= cal + * section and does not hold the iothread lock, it must have other means of + * protecting the pointer, such as a reference to the region that includes + * the incoming ram_addr_t. + * + */ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id); void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...) G_GNUC_PRINTF(2, 3); --=20 2.38.1 From nobody Mon Apr 29 01:23:59 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linaro.org ARC-Seal: i=1; a=rsa-sha256; t=1669643430; cv=none; d=zohomail.com; s=zohoarc; b=ZNSC6HHJRT3hIzopxzXbqlBHvbLoxCgG/yL3txh213ROdOzjQGbeQyG5KdgZ0XO5ObQq6plGfBor2KYbixWfzuORrBJRqI881hgs1x7eGWi3oemo+LbqvWnAa1laH+fBELdNhdn5MSmwfBgkk5NJKBEeBfRefDM8jsQ41FapEsA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1669643430; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=cLBqjxMlolU+cJ4fFCwWxvJIFOEEf1cRd8fhzl0z5Pw=; b=LyclA0JIxPc+tW5v1oSA3iJ3qzwGuVKqmy28Tg7WLajbMuf3Wr1AhrygdrbpU3ZAOpyYhANynj81emqAaVki5HUupKESeIffosdi4ndRr3TIF+NYlYHGyYQe5W4WHQw51kg8MxhTZzr6r4QrSBEincuU/N/jPypTnnS5CPiZqq4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1669643430691219.9439753217107; Mon, 28 Nov 2022 05:50:30 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeVE-0004wB-C8; Mon, 28 Nov 2022 08:48:56 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeVC-0004w1-Fe for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:54 -0500 Received: from mail-wm1-x331.google.com ([2a00:1450:4864:20::331]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeVA-0000JN-KW for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:54 -0500 Received: by mail-wm1-x331.google.com with SMTP id c65-20020a1c3544000000b003cfffd00fc0so11695181wma.1 for ; Mon, 28 Nov 2022 05:48:51 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id a12-20020adfe5cc000000b0022cc3e67fc5sm10674115wrn.65.2022.11.28.05.48.48 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=cLBqjxMlolU+cJ4fFCwWxvJIFOEEf1cRd8fhzl0z5Pw=; b=HxlkcG019F78hDHWklx7b3JvpZQDvFiwRQqjOn04g5BYWdnFoEpaSEooBeXLfZ55SU PYj0gXwSmKBTHbxsLeeFFYOpB5Dbk8ANQ7VonQoIuG8chMEm4+ZDra45OfAzmLwk1vAo /gKpMiXIFgGWOLCRdLeG3wwSavuLkN1qbAAwsRJuNc41kWg3PGw33SYX3MhsjuSU0kKO YmfyoaOzjW0CAGTM6u/Z/cn+FcZwl96dAQfYTXKUZEu6SvKUKYvGRnXSG6iE8AeqJVah 0QpxMYugczZtn5+8xDQFyGuKYBBgv0kz0XdQeWagQ9SfHQbzEM9snmePvq8JydJtrr3g fvpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cLBqjxMlolU+cJ4fFCwWxvJIFOEEf1cRd8fhzl0z5Pw=; b=bYyoxW2gSD2sj+q5rMtRhXCDf33R8qp7wbZUEbd7pgEkgPk1oWgixfKJZTtDISGFZD ZVLQ2nsHpseIKfRyLhuGO3xloTlrdqVqqf48OC2x38BJePZYKSGzaCmdbW/k9xkGn06p o67+Jt6CXDJgfqMywvSmrUvqEpJKHvjgq+rYayJDS85zN5UbKKcjo5TVls8wtRrPPVJB W9au15Xl8G9iUw9k6lVpKcO7oM3JGIN+kKeZ2l65d7ai2SuhDLD8uBE1Mt9RzJdOUdZp vV7IrZJhI2bvRCapQGetR6tXp+KrenvjeTN+46ZKLY98DTanyPtnUJvVl0bSQLhTyc+s 9zaw== X-Gm-Message-State: ANoB5pkdGhajNXQu6nQX8wimyXoRu14eQR2/wQH1zmuxiV49965I8rkF 6krkeQN3NO2gW+h6O3nYBIA2IA== X-Google-Smtp-Source: AA0mqf6v/FiRff+w8ZT3jUeK8YB3FscRk4cFB5qErh9WzMDufleXNE/TiebhtBV2UZCMap1YzX6WlA== X-Received: by 2002:a7b:cb91:0:b0:3c6:cb54:ef66 with SMTP id m17-20020a7bcb91000000b003c6cb54ef66mr27123949wmi.90.1669643329584; Mon, 28 Nov 2022 05:48:49 -0800 (PST) From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [RFC PATCH-for-7.2 3/5] hw/display/qxl: Pass requested buffer size to qxl_phys2virt() Date: Mon, 28 Nov 2022 14:48:30 +0100 Message-Id: <20221128134832.84867-4-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::331; envelope-from=philmd@linaro.org; helo=mail-wm1-x331.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linaro.org) X-ZM-MESSAGEID: 1669643431386100001 Currently qxl_phys2virt() doesn't check for buffer overrun. In order to do so in the next commit, pass the buffer size as argument. Signed-off-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Marc-Andr=C3=A9 Lureau --- RFC: Please double-check qxl_render_update_area_unlocked() --- hw/display/qxl-logger.c | 11 ++++++++--- hw/display/qxl-render.c | 12 ++++++++---- hw/display/qxl.c | 14 +++++++++----- hw/display/qxl.h | 4 +++- 4 files changed, 28 insertions(+), 13 deletions(-) diff --git a/hw/display/qxl-logger.c b/hw/display/qxl-logger.c index 1bcf803db6..35c38f6252 100644 --- a/hw/display/qxl-logger.c +++ b/hw/display/qxl-logger.c @@ -106,7 +106,7 @@ static int qxl_log_image(PCIQXLDevice *qxl, QXLPHYSICAL= addr, int group_id) QXLImage *image; QXLImageDescriptor *desc; =20 - image =3D qxl_phys2virt(qxl, addr, group_id); + image =3D qxl_phys2virt(qxl, addr, group_id, sizeof(QXLImage)); if (!image) { return 1; } @@ -214,7 +214,8 @@ int qxl_log_cmd_cursor(PCIQXLDevice *qxl, QXLCursorCmd = *cmd, int group_id) cmd->u.set.position.y, cmd->u.set.visible ? "yes" : "no", cmd->u.set.shape); - cursor =3D qxl_phys2virt(qxl, cmd->u.set.shape, group_id); + cursor =3D qxl_phys2virt(qxl, cmd->u.set.shape, group_id, + sizeof(QXLCursor)); if (!cursor) { return 1; } @@ -236,6 +237,7 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring= , QXLCommandExt *ext) { bool compat =3D ext->flags & QXL_COMMAND_FLAG_COMPAT; void *data; + size_t datasz; int ret; =20 if (!qxl->cmdlog) { @@ -249,15 +251,18 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ri= ng, QXLCommandExt *ext) =20 switch (ext->cmd.type) { case QXL_CMD_DRAW: + datasz =3D compat ? sizeof(QXLCompatDrawable) : sizeof(QXLDrawable= ); break; case QXL_CMD_SURFACE: + datasz =3D sizeof(QXLSurfaceCmd); break; case QXL_CMD_CURSOR: + datasz =3D sizeof(QXLCursorCmd); break; default: goto out; } - data =3D qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + data =3D qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, datasz); if (!data) { return 1; } diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index ca217004bf..0a4bfa8aa6 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -107,7 +107,9 @@ static void qxl_render_update_area_unlocked(PCIQXLDevic= e *qxl) qxl->guest_primary.resized =3D 0; qxl->guest_primary.data =3D qxl_phys2virt(qxl, qxl->guest_primary.surface= .mem, - MEMSLOT_GROUP_GUEST); + MEMSLOT_GROUP_GUEST, + qxl->guest_primary.abs_str= ide + * height); if (!qxl->guest_primary.data) { goto end; } @@ -228,7 +230,7 @@ static void qxl_unpack_chunks(void *dest, size_t size, = PCIQXLDevice *qxl, if (offset =3D=3D size) { return; } - chunk =3D qxl_phys2virt(qxl, chunk->next_chunk, group_id); + chunk =3D qxl_phys2virt(qxl, chunk->next_chunk, group_id, bytes); if (!chunk) { return; } @@ -295,7 +297,8 @@ fail: /* called from spice server thread context only */ int qxl_render_cursor(PCIQXLDevice *qxl, QXLCommandExt *ext) { - QXLCursorCmd *cmd =3D qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + QXLCursorCmd *cmd =3D qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, + sizeof(QXLCursorCmd)); QXLCursor *cursor; QEMUCursor *c; =20 @@ -314,7 +317,8 @@ int qxl_render_cursor(PCIQXLDevice *qxl, QXLCommandExt = *ext) } switch (cmd->type) { case QXL_CURSOR_SET: - cursor =3D qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id); + cursor =3D qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id, + sizeof(QXLCursor)); if (!cursor) { return 1; } diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 5b10f697f1..231d733250 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -274,7 +274,8 @@ static void qxl_spice_monitors_config_async(PCIQXLDevic= e *qxl, int replay) QXL_IO_MONITORS_CONFIG_ASYNC)); } =20 - cfg =3D qxl_phys2virt(qxl, qxl->guest_monitors_config, MEMSLOT_GROUP_G= UEST); + cfg =3D qxl_phys2virt(qxl, qxl->guest_monitors_config, MEMSLOT_GROUP_G= UEST, + sizeof(QXLMonitorsConfig)); if (cfg !=3D NULL && cfg->count =3D=3D 1) { qxl->guest_primary.resized =3D 1; qxl->guest_head0_width =3D cfg->heads[0].width; @@ -459,7 +460,8 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct = QXLCommandExt *ext) switch (le32_to_cpu(ext->cmd.type)) { case QXL_CMD_SURFACE: { - QXLSurfaceCmd *cmd =3D qxl_phys2virt(qxl, ext->cmd.data, ext->grou= p_id); + QXLSurfaceCmd *cmd =3D qxl_phys2virt(qxl, ext->cmd.data, ext->grou= p_id, + sizeof(QXLSurfaceCmd)); =20 if (!cmd) { return 1; @@ -494,7 +496,8 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct = QXLCommandExt *ext) } case QXL_CMD_CURSOR: { - QXLCursorCmd *cmd =3D qxl_phys2virt(qxl, ext->cmd.data, ext->group= _id); + QXLCursorCmd *cmd =3D qxl_phys2virt(qxl, ext->cmd.data, ext->group= _id, + sizeof(QXLCursorCmd)); =20 if (!cmd) { return 1; @@ -1456,7 +1459,8 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice *q= xl, QXLPHYSICAL pqxl, } =20 /* can be also called from spice server thread context */ -void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id) +void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, + size_t size) { uint64_t offset; uint32_t slot; @@ -1964,7 +1968,7 @@ static void qxl_dirty_surfaces(PCIQXLDevice *qxl) } =20 cmd =3D qxl_phys2virt(qxl, qxl->guest_surfaces.cmds[i], - MEMSLOT_GROUP_GUEST); + MEMSLOT_GROUP_GUEST, sizeof(QXLSurfaceCmd)); assert(cmd); assert(cmd->type =3D=3D QXL_SURFACE_CMD_CREATE); qxl_dirty_one_surface(qxl, cmd->u.surface_create.data, diff --git a/hw/display/qxl.h b/hw/display/qxl.h index 78b3a6c9ba..bf03138ab4 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -153,6 +153,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) * @qxl: QXL device * @phys: physical offset of buffer within the VRAM * @group_id: memory slot group + * @size: size of the buffer * * Returns a host pointer to a buffer placed at offset @phys within the * active slot @group_id of the PCI VGA RAM memory region associated with @@ -166,7 +167,8 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) * the incoming ram_addr_t. * */ -void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id); +void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id, + size_t size); void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...) G_GNUC_PRINTF(2, 3); =20 --=20 2.38.1 From nobody Mon Apr 29 01:23:59 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linaro.org ARC-Seal: i=1; a=rsa-sha256; t=1669643388; cv=none; d=zohomail.com; s=zohoarc; b=eTFG5gGY/6QFZyXmYrAy7dDSKq4UuvQmWujqSen4/9ySpPjNFBdqGwfvpCnL6kj1xeilo5cl/XdqHI3RNtjC8lpxZOaiLZ29iCuHshz8oMTENxAFrn2nacpXK1PAVTFFIjKct6Ozkfl7AZFmRrG0L4lpD0gwby9hQaoTtB90eLo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1669643388; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=mjNbgTf1E7AI00TEfhwYXvMQtqcc4snLWTKJDvPZcks=; b=UPgXmLdvFdiUu7nhfwJIrzreox+TR9VwzztJzVaviFUppacrDKdmV3MvObZv2AdwAHVspx8XRTQRTatA6iNwloFQgf1uIRaIX9o7Q0N8PCDZ2W3OWawW433qxXkebyAdyf+EoBbVRaOi6JKXqG0BzHe6vu16ai/z0sE5f1AmTBE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 16696433889161004.0319534795028; Mon, 28 Nov 2022 05:49:48 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeVH-0004yl-H2; Mon, 28 Nov 2022 08:48:59 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeVG-0004xN-09 for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:58 -0500 Received: from mail-wr1-x434.google.com ([2a00:1450:4864:20::434]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeVE-0000Jt-9l for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:57 -0500 Received: by mail-wr1-x434.google.com with SMTP id g12so16877168wrs.10 for ; Mon, 28 Nov 2022 05:48:55 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id q4-20020adff944000000b002366c3eefccsm10955690wrr.109.2022.11.28.05.48.53 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=mjNbgTf1E7AI00TEfhwYXvMQtqcc4snLWTKJDvPZcks=; b=rtgMN5PwHDJ4483KQ5llJcVXxtK9fVGm60c5eWEbrX3MKDl2fKksm9eD4V4RKe/VoN zV5ws3igg5SdydWqYU3AUIZX4Al46H9DjmgG5Z7ab6RJMzuYjMM9YvKW9AFtENzg0ggX yAEqvcSMpweFZ67UsFVVdRFvGswg/BCQIByu7MCUobGrVV1LLRkzTXGyG4t5GidXL6kW 0m3IkGyQMpLmjLyuwVB5uNVJiSD5BnK9NYSpNJOKvkIre/QOcYX6JGnjp/jFDbRv+3wV 9qao2u2ETGfQ4AQVzLuMVj+A7gJrI87NzIbCtLbsu9fAkEpafyxyodx3qRW0tNs9Qz0p CFBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mjNbgTf1E7AI00TEfhwYXvMQtqcc4snLWTKJDvPZcks=; b=de+EXQpaUyZbzYoB1OppY3S6Xt6zCmX7uVWzQNxuO7hhvueCzVqFfPL4U1lfZQzBJ8 7jLVS1oG20FptRiQnb2Xuk9lDbYcoNLCHm5hiENW0WDfXnvCSYTDt5XZ1yZ22Kd385WL SmKHTRy+lwf166Pj/Qwi+HzbD+Y56/OUwc8XIku/lOLsD9hwsZBiix+BKsU+b7M6/7Ef ICmV4z8I6nIK6+ewT2YfgcdpaNwAoVVIqoaIoINcC8CajMZNnir/KHUFr38fpXP7hT2D b3Eef9pDp+G6F5aLgCEBQCJ44K6jogDR222+tisJ9MjmUGhKuLuLy+0Rkbg7xJmgYLYj f1Ew== X-Gm-Message-State: ANoB5pnmCA3N31VU6wBod3ONmZ11HfFz8aWpnYUYILpfCD8eWff7Ee+O tu9d/ywEgGGXUtgtxbtCUU/rfA== X-Google-Smtp-Source: AA0mqf6bfQUmfL/pPILkqaumYha/XFflvy3Tn7+T4HxgqTC0YB75ORSEU6MWivN5KZOsFz/ke9h/xA== X-Received: by 2002:adf:e68a:0:b0:242:1926:7838 with SMTP id r10-20020adfe68a000000b0024219267838mr2461131wrm.200.1669643334893; Mon, 28 Nov 2022 05:48:54 -0800 (PST) From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [RFC PATCH-for-7.2 4/5] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144) Date: Mon, 28 Nov 2022 14:48:31 +0100 Message-Id: <20221128134832.84867-5-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::434; envelope-from=philmd@linaro.org; helo=mail-wr1-x434.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linaro.org) X-ZM-MESSAGEID: 1669643390158100003 Have qxl_get_check_slot_offset() return false if the requested buffer size does not fit within the slot memory region. Similarly qxl_phys2virt() now returns NULL in such case, and qxl_dirty_one_surface() aborts. This avoids buffer overrun in the host pointer returned by memory_region_get_ram_ptr(). Fixes: CVE-2022-4144 (out-of-bounds read) Reported-by: Wenxu Yin (@awxylitol) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336 Signed-off-by: Philippe Mathieu-Daud=C3=A9 --- hw/display/qxl.c | 22 ++++++++++++++++++---- hw/display/qxl.h | 2 +- 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 231d733250..afa157d327 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -1424,11 +1424,13 @@ static void qxl_reset_surfaces(PCIQXLDevice *d) =20 /* can be also called from spice server thread context */ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, - uint32_t *s, uint64_t *o) + uint32_t *s, uint64_t *o, + size_t size_requested) { uint64_t phys =3D le64_to_cpu(pqxl); uint32_t slot =3D (phys >> (64 - 8)) & 0xff; uint64_t offset =3D phys & 0xffffffffffff; + uint64_t size_available; =20 if (slot >=3D NUM_MEMSLOTS) { qxl_set_guest_bug(qxl, "slot too large %d >=3D %d", slot, @@ -1453,6 +1455,18 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice *= qxl, QXLPHYSICAL pqxl, return false; } =20 + size_available =3D memory_region_size(qxl->guest_slots[slot].mr); + assert(qxl->guest_slots[slot].offset + offset < size_available); + size_available -=3D qxl->guest_slots[slot].offset + offset; + if (size_requested > size_available) { + qxl_set_guest_bug(qxl, + "slot %d offset %"PRIu64" size %zu: " + "overrun by %"PRIu64" bytes\n", + slot, offset, size_requested, + size_requested - size_available); + return false; + } + *s =3D slot; *o =3D offset; return true; @@ -1471,7 +1485,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pq= xl, int group_id, offset =3D le64_to_cpu(pqxl) & 0xffffffffffff; return (void *)(intptr_t)offset; case MEMSLOT_GROUP_GUEST: - if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) { + if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) { return NULL; } ptr =3D memory_region_get_ram_ptr(qxl->guest_slots[slot].mr); @@ -1937,9 +1951,9 @@ static void qxl_dirty_one_surface(PCIQXLDevice *qxl, = QXLPHYSICAL pqxl, uint32_t slot; bool rc; =20 - rc =3D qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset); - assert(rc =3D=3D true); size =3D (uint64_t)height * abs(stride); + rc =3D qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size); + assert(rc =3D=3D true); trace_qxl_surfaces_dirty(qxl->id, offset, size); qxl_set_dirty(qxl->guest_slots[slot].mr, qxl->guest_slots[slot].offset + offset, diff --git a/hw/display/qxl.h b/hw/display/qxl.h index bf03138ab4..7894bd5134 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -157,7 +157,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) * * Returns a host pointer to a buffer placed at offset @phys within the * active slot @group_id of the PCI VGA RAM memory region associated with - * the @qxl device. If the slot is inactive, or the offset is out + * the @qxl device. If the slot is inactive, or the offset + size are out * of the memory region, returns NULL. * * Use with care; by the time this function returns, the returned pointer = is --=20 2.38.1 From nobody Mon Apr 29 01:23:59 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linaro.org ARC-Seal: i=1; a=rsa-sha256; t=1669643466; cv=none; d=zohomail.com; s=zohoarc; b=Upmvq9XEMKEYXNJZ7aYsGHfKqkUrZn595Nund6APvctMh9v8amujbhzLdtNZqEl4k9FLplqqSjE/c0IlylkSpqpgJeZneybLo7lV93tt79hcL87byOP2ljH67qUWAoEjy9QxrlCcnAKi9EfKU1ivujWXa1PsswzxhWiLE3F79XM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1669643466; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=/R4Inekw/oUXtvtZ44ZwPbcG/FwqT8jbw12rj3DWxAg=; b=d5KPXwu+2ggUFybrInFKZ+egjyN2knaqtfWEH+sg9wStCgQA9yRR1+3iSHqwG4C/OUHfFOfCh0fRWn5GZ5/hts6iOibv6HxRsI+pHU5Y10MO2z5+n2u8vP1nWgIQ+iY3DEbaol9pbDYgW83gg3Ygdiloy6skYUfimDRZ25OxR4E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1669643466317915.06069543049; Mon, 28 Nov 2022 05:51:06 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeVP-00050j-4J; Mon, 28 Nov 2022 08:49:07 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeVK-0004zm-Mz for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:49:04 -0500 Received: from mail-wr1-x42a.google.com ([2a00:1450:4864:20::42a]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeVJ-0000KL-6d for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:49:02 -0500 Received: by mail-wr1-x42a.google.com with SMTP id b12so16933107wrn.2 for ; Mon, 28 Nov 2022 05:49:00 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id v8-20020adfebc8000000b00236545edc91sm10979357wrn.76.2022.11.28.05.48.58 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=/R4Inekw/oUXtvtZ44ZwPbcG/FwqT8jbw12rj3DWxAg=; b=u7kjgjDTgjTvxi4mknc59fI7NJa892rSTq3VdryfY7+y62JcQYQ/kDQe562HyViDgK I0BR+pPTd8iIpxTohjrOpdqMkQFoXdP7/gFWLDLlD+yoHDXWgHLcU0xOsO3HaTXlVAGd LbSTtrX1T0RNFXLugfvfZHtGevxGh4ja+BWrFGIqdewyFnnEXrC+MrPolyHrl3O2v3LT AUDbSiqis6tmxJyrfNqxUJqOd+Uo9nkWRrdAIjHAtCoE7Kfz6QmTPL2U7dPOnKfxUB+F 1qD/NB4UmsLtpNb9MqLWgz+WQF0k/zlkUpJ8mHH7GpwRDNsPU0PJw9VUSBiClCRsGLow zzPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/R4Inekw/oUXtvtZ44ZwPbcG/FwqT8jbw12rj3DWxAg=; b=tww5s3+NFMXNLUe1fxp5pHsJsdxPakgtKccZ8Z3TjscKBIUdjGweNic+kbCXohSrb2 Y2CTpCY5gXqxBCy1mVjOGp4C6BQ/5lIdF5UT+gPx+I5ZY11HKa5GdpWghQ8FJ/HPGLej Vow5Z1ixkr/UvOSBa0p/ZzX4XXETSQT2RJAKV3ags4lCsdbChB8voQUGOrIle4qVysCD 5TsKzYl9GjABv9rx3KxJZTNZHb5xvJ6YbiBTdFisbctWE6mghKxApR+fui4NDL6cQPph 9P7Olx42n8V9njAH55XUoGQ4+9P7Kl6WkG+4sogfaP67zEyLRM2DN4TvPC4IKSi0btGi MUww== X-Gm-Message-State: ANoB5pmYoes3gnEPkG/oonkwpUWvK/D6RS8aqnG6M9hsV/4ivkuFNnmf H8WakraRYAR7DMXDokwmwUkGdw== X-Google-Smtp-Source: AA0mqf43lFca6m0O+Eo3HPA1DXEIa++geamLZRELxHu4Svn8C4EVNQ9cQUOSplBKEKb76fSuV9glJg== X-Received: by 2002:adf:f0d1:0:b0:242:285:6b21 with SMTP id x17-20020adff0d1000000b0024202856b21mr11735439wro.35.1669643339906; Mon, 28 Nov 2022 05:48:59 -0800 (PST) From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [PATCH-for-8.0 5/5] hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion Date: Mon, 28 Nov 2022 14:48:32 +0100 Message-Id: <20221128134832.84867-6-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::42a; envelope-from=philmd@linaro.org; helo=mail-wr1-x42a.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linaro.org) X-ZM-MESSAGEID: 1669643467537100001 Signed-off-by: Philippe Mathieu-Daud=C3=A9 --- hw/display/qxl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/display/qxl.c b/hw/display/qxl.c index afa157d327..8468513f41 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -1384,6 +1384,7 @@ static int qxl_add_memslot(PCIQXLDevice *d, uint32_t = slot_id, uint64_t delta, qxl_set_guest_bug(d, "%s: pci_region =3D %d", __func__, pci_region= ); return 1; } + assert(guest_end - pci_start <=3D memory_region_size(mr)); =20 virt_start =3D (intptr_t)memory_region_get_ram_ptr(mr); memslot.slot_id =3D slot_id; --=20 2.38.1