diff options
| author |   Sona Sarmadi <sona.sarmadi@enea.com> | 2017-03-03 12:51:42 +0100 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2017-03-08 11:13:47 +0000 |
| commit | 8bf7ade372b46b8a872661a7904fbaa30fa262a2 (patch) | |
| tree | 64a156e15fca66e6b53adc21f3fe1ea3db8a5103 | |
| parent | f5f4a08baeb4864984fcb9a837a3a8c51274df2b (diff) | |
| download | openembedded-core-contrib-8bf7ade372b46b8a872661a7904fbaa30fa262a2.tar.gz | |
qemu: display: CVE-2016-9912
virtio-gpu: memory leakage when destroying gpu resource
Reference:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9912
Reference to upstream patch:
http://git.qemu-project.org/?p=qemu.git;a=patch;h=b8e23926c568f2e963af39028b71c472e3023793
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
| -rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch | 45 | ||||
| -rw-r--r-- | meta/recipes-devtools/qemu/qemu_2.8.0.bb | 1 |
2 files changed, 46 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch new file mode 100644 index 0000000000..c009ffd96a --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch @@ -0,0 +1,45 @@ +From b8e23926c568f2e963af39028b71c472e3023793 Mon Sep 17 00:00:00 2001 +From: Li Qiang <liq3ea@gmail.com> +Date: Mon, 28 Nov 2016 21:29:25 -0500 +Subject: [PATCH] virtio-gpu: call cleanup mapping function in resource destroy + +If the guest destroy the resource before detach banking, the 'iov' +and 'addrs' field in resource is not freed thus leading memory +leak issue. This patch avoid this. + +CVE: CVE-2016-9912 +Upstream-Status: Backport + +Signed-off-by: Li Qiang <liq3ea@gmail.com> +Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> +Message-id: 1480386565-10077-1-git-send-email-liq3ea@gmail.com +Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> +Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> +--- + hw/display/virtio-gpu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c +index ed2b6d3..6a26258 100644 +--- a/hw/display/virtio-gpu.c ++++ b/hw/display/virtio-gpu.c +@@ -28,6 +28,8 @@ + static struct virtio_gpu_simple_resource* + virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id); + ++static void virtio_gpu_cleanup_mapping(struct virtio_gpu_simple_resource *res); ++ + #ifdef CONFIG_VIRGL + #include <virglrenderer.h> + #define VIRGL(_g, _virgl, _simple, ...) \ +@@ -364,6 +366,7 @@ static void virtio_gpu_resource_destroy(VirtIOGPU *g, + struct virtio_gpu_simple_resource *res) + { + pixman_image_unref(res->image); ++ virtio_gpu_cleanup_mapping(res); + QTAILQ_REMOVE(&g->reslist, res, next); + g->hostmem -= res->hostmem; + g_free(res); +-- +1.9.1 + diff --git a/meta/recipes-devtools/qemu/qemu_2.8.0.bb b/meta/recipes-devtools/qemu/qemu_2.8.0.bb index b8799d5cc2..19d7e8f658 100644 --- a/meta/recipes-devtools/qemu/qemu_2.8.0.bb +++ b/meta/recipes-devtools/qemu/qemu_2.8.0.bb @@ -29,6 +29,7 @@ SRC_URI += " \ file://0003-Introduce-condition-in-TPM-backend-for-notification.patch \ file://0004-Add-support-for-VM-suspend-resume-for-TPM-TIS.patch \ file://CVE-2016-9908.patch \ + file://CVE-2016-9912.patch \ " SRC_URI_append_class-native = " \ |