sysmo-bts
/
generic-poky
9
0
Fork 0
Code Pull Requests Releases Activity

qemu: display: CVE-2016-9912 

virtio-gpu: memory leakage when destroying gpu resource

Reference:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9912

Reference to upstream patch:
http://git.qemu-project.org/?p=qemu.git;a=patch;h=b8e23926c568f2e963af39028b71c472e3023793

(From OE-Core rev: 8bf7ade372b46b8a872661a7904fbaa30fa262a2)

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Sona Sarmadi 2017-03-03 12:51:42 +01:00 committed by Richard Purdie
parent 5724b1e3d9
commit 0884c80070
2 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch Normal file
View File

@ -0,0 +1,45 @@
From b8e23926c568f2e963af39028b71c472e3023793 Mon Sep 17 00:00:00 2001
From: Li Qiang <liq3ea@gmail.com>
Date: Mon, 28 Nov 2016 21:29:25 -0500
Subject: [PATCH] virtio-gpu: call cleanup mapping function in resource destroy
If the guest destroy the resource before detach banking, the 'iov'
and 'addrs' field in resource is not freed thus leading memory
leak issue. This patch avoid this.
CVE: CVE-2016-9912
Upstream-Status: Backport
Signed-off-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 1480386565-10077-1-git-send-email-liq3ea@gmail.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
---
hw/display/virtio-gpu.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index ed2b6d3..6a26258 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -28,6 +28,8 @@
static struct virtio_gpu_simple_resource*
virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id);
+static void virtio_gpu_cleanup_mapping(struct virtio_gpu_simple_resource *res);
+
#ifdef CONFIG_VIRGL
#include <virglrenderer.h>
#define VIRGL(_g, _virgl, _simple, ...) \
@@ -364,6 +366,7 @@ static void virtio_gpu_resource_destroy(VirtIOGPU *g,
struct virtio_gpu_simple_resource *res)
{
pixman_image_unref(res->image);
+ virtio_gpu_cleanup_mapping(res);
QTAILQ_REMOVE(&g->reslist, res, next);
g->hostmem -= res->hostmem;
g_free(res);
--
1.9.1

1
meta/recipes-devtools/qemu/qemu_2.8.0.bb
View File

@ -29,6 +29,7 @@ SRC_URI += " \
file://0003-Introduce-condition-in-TPM-backend-for-notification.patch \
file://0004-Add-support-for-VM-suspend-resume-for-TPM-TIS.patch \
file://CVE-2016-9908.patch \
file://CVE-2016-9912.patch \
"
SRC_URI_append_class-native = " \