f25d5b2eaa
- hw/scsi/lsi53c895a: add missing decrement of reentrancy counter - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) - net: Update MemReentrancyGuard for NIC - net: Provide MemReentrancyGuard * to qemu_new_nic() - memory: prevent dma-reentracy issues - softmmu/physmem: Introduce MemTxAttrs::memory field and MEMTX_ACCESS_ERROR - Fixed the early version of CVE-2022-4144 patch is not fully adapted Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com>
39 lines
1.5 KiB
Diff
39 lines
1.5 KiB
Diff
From 9f0d315132b6a28035acc238094990a893b0c682 Mon Sep 17 00:00:00 2001
|
|
From: liuhaipeng 00050065 <liuhaipeng@xfusion.com>
|
|
Date: Mon, 15 Jan 2024 10:51:27 +0800
|
|
Subject: [PATCH] Fixed the early version of CVE-2022-4144 patch is not fully
|
|
adapted
|
|
|
|
The https://gitee.com/openeuler/qemu/pulls/394 patch is used to fix CVE-2022-4144.
|
|
The QEMU version is as follows: 6. 2. The patch is installed normally.
|
|
When the patch is deployed to version 4.1.0, the OpenEuler patch is not fully adapted.
|
|
|
|
The qxl_phys2virt function prototype is defined in the hw/display/qxl.c
|
|
file.
|
|
|
|
void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id,
|
|
size_t size);
|
|
|
|
Signed-off-by: liuhaipeng 00050065 <liuhaipeng@xfusion.com>
|
|
---
|
|
hw/display/qxl.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
|
|
index 5a923d30de..f40ebf1402 100644
|
|
--- a/hw/display/qxl.c
|
|
+++ b/hw/display/qxl.c
|
|
@@ -674,7 +674,8 @@ static int interface_get_command(QXLInstance *sin, struct QXLCommandExt *ext)
|
|
*
|
|
* https://cgit.freedesktop.org/spice/win32/qxl-wddm-dod/commit/?id=f6e099db39e7d0787f294d5fd0dce328b5210faa
|
|
*/
|
|
- void *msg = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id);
|
|
+ void *msg = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id,
|
|
+ sizeof(void));
|
|
if (msg != NULL && (
|
|
msg < (void *)qxl->vga.vram_ptr ||
|
|
msg > ((void *)qxl->vga.vram_ptr + qxl->vga.vram_size))) {
|
|
--
|
|
2.27.0
|
|
|