qemu: display: CVE-2016-9912
virtio-gpu: memory leakage when destroying gpu resource Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9912 Reference to upstream patch: http://git.qemu-project.org/?p=qemu.git;a=patch;h=b8e23926c568f2e963af39028b71c472e3023793 (From OE-Core rev: 8bf7ade372b46b8a872661a7904fbaa30fa262a2) Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
parent
5724b1e3d9
commit
0884c80070
|
@ -0,0 +1,45 @@
|
||||||
|
From b8e23926c568f2e963af39028b71c472e3023793 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Li Qiang <liq3ea@gmail.com>
|
||||||
|
Date: Mon, 28 Nov 2016 21:29:25 -0500
|
||||||
|
Subject: [PATCH] virtio-gpu: call cleanup mapping function in resource destroy
|
||||||
|
|
||||||
|
If the guest destroy the resource before detach banking, the 'iov'
|
||||||
|
and 'addrs' field in resource is not freed thus leading memory
|
||||||
|
leak issue. This patch avoid this.
|
||||||
|
|
||||||
|
CVE: CVE-2016-9912
|
||||||
|
Upstream-Status: Backport
|
||||||
|
|
||||||
|
Signed-off-by: Li Qiang <liq3ea@gmail.com>
|
||||||
|
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
||||||
|
Message-id: 1480386565-10077-1-git-send-email-liq3ea@gmail.com
|
||||||
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
|
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
|
||||||
|
---
|
||||||
|
hw/display/virtio-gpu.c | 3 +++
|
||||||
|
1 file changed, 3 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
|
||||||
|
index ed2b6d3..6a26258 100644
|
||||||
|
--- a/hw/display/virtio-gpu.c
|
||||||
|
+++ b/hw/display/virtio-gpu.c
|
||||||
|
@@ -28,6 +28,8 @@
|
||||||
|
static struct virtio_gpu_simple_resource*
|
||||||
|
virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id);
|
||||||
|
|
||||||
|
+static void virtio_gpu_cleanup_mapping(struct virtio_gpu_simple_resource *res);
|
||||||
|
+
|
||||||
|
#ifdef CONFIG_VIRGL
|
||||||
|
#include <virglrenderer.h>
|
||||||
|
#define VIRGL(_g, _virgl, _simple, ...) \
|
||||||
|
@@ -364,6 +366,7 @@ static void virtio_gpu_resource_destroy(VirtIOGPU *g,
|
||||||
|
struct virtio_gpu_simple_resource *res)
|
||||||
|
{
|
||||||
|
pixman_image_unref(res->image);
|
||||||
|
+ virtio_gpu_cleanup_mapping(res);
|
||||||
|
QTAILQ_REMOVE(&g->reslist, res, next);
|
||||||
|
g->hostmem -= res->hostmem;
|
||||||
|
g_free(res);
|
||||||
|
--
|
||||||
|
1.9.1
|
||||||
|
|
|
@ -29,6 +29,7 @@ SRC_URI += " \
|
||||||
file://0003-Introduce-condition-in-TPM-backend-for-notification.patch \
|
file://0003-Introduce-condition-in-TPM-backend-for-notification.patch \
|
||||||
file://0004-Add-support-for-VM-suspend-resume-for-TPM-TIS.patch \
|
file://0004-Add-support-for-VM-suspend-resume-for-TPM-TIS.patch \
|
||||||
file://CVE-2016-9908.patch \
|
file://CVE-2016-9908.patch \
|
||||||
|
file://CVE-2016-9912.patch \
|
||||||
"
|
"
|
||||||
|
|
||||||
SRC_URI_append_class-native = " \
|
SRC_URI_append_class-native = " \
|
||||||
|
|
Loading…
Reference in New Issue