Skip to content
Permalink
Browse files

vga: handle cirrus vbe mode wraparounds.

Commit "3d90c62548 vga: stop passing pointers to vga_draw_line*
functions" is incomplete.  It doesn't handle the case that the vga
rendering code tries to create a shared surface, i.e. a pixman image
backed by vga video memory.  That can not work in case the guest display
wraps from end of video memory to the start.  So force shadowing in that
case.  Also adjust the snapshot region calculation.

Can trigger with cirrus only, when programming vbe modes using the bochs
api (stdvga, also qxl and virtio-vga in vga compat mode) wrap arounds
can't happen.

Fixes: CVE-2017-13672
Fixes: 3d90c62
Cc: P J P <ppandit@redhat.com>
Reported-by: David Buchanan <d@vidbuchanan.co.uk>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010141323.14049-3-kraxel@redhat.com
  • Loading branch information...
kraxel committed Oct 10, 2017
1 parent 362f811 commit 28f77de26a4f9995458ddeb9d34bb06c0193bdc9
Showing with 21 additions and 7 deletions.
  1. +21 −7 hw/display/vga.c
@@ -1465,13 +1465,13 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
DisplaySurface *surface = qemu_console_surface(s->con); DisplaySurface *surface = qemu_console_surface(s->con);
int y1, y, update, linesize, y_start, double_scan, mask, depth; int y1, y, update, linesize, y_start, double_scan, mask, depth;
int width, height, shift_control, bwidth, bits; int width, height, shift_control, bwidth, bits;
ram_addr_t page0, page1; ram_addr_t page0, page1, region_start, region_end;
DirtyBitmapSnapshot *snap = NULL; DirtyBitmapSnapshot *snap = NULL;
int disp_width, multi_scan, multi_run; int disp_width, multi_scan, multi_run;
uint8_t *d; uint8_t *d;
uint32_t v, addr1, addr; uint32_t v, addr1, addr;
vga_draw_line_func *vga_draw_line = NULL; vga_draw_line_func *vga_draw_line = NULL;
bool share_surface; bool share_surface, force_shadow = false;
pixman_format_code_t format; pixman_format_code_t format;
#ifdef HOST_WORDS_BIGENDIAN #ifdef HOST_WORDS_BIGENDIAN
bool byteswap = !s->big_endian_fb; bool byteswap = !s->big_endian_fb;
@@ -1484,6 +1484,15 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
s->get_resolution(s, &width, &height); s->get_resolution(s, &width, &height);
disp_width = width; disp_width = width;


region_start = (s->start_addr * 4);
region_end = region_start + s->line_offset * height;
if (region_end > s->vbe_size) {
/* wraps around (can happen with cirrus vbe modes) */
region_start = 0;
region_end = s->vbe_size;
force_shadow = true;
}

shift_control = (s->gr[VGA_GFX_MODE] >> 5) & 3; shift_control = (s->gr[VGA_GFX_MODE] >> 5) & 3;
double_scan = (s->cr[VGA_CRTC_MAX_SCAN] >> 7); double_scan = (s->cr[VGA_CRTC_MAX_SCAN] >> 7);
if (shift_control != 1) { if (shift_control != 1) {
@@ -1523,7 +1532,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
format = qemu_default_pixman_format(depth, !byteswap); format = qemu_default_pixman_format(depth, !byteswap);
if (format) { if (format) {
share_surface = dpy_gfx_check_format(s->con, format) share_surface = dpy_gfx_check_format(s->con, format)
&& !s->force_shadow; && !s->force_shadow && !force_shadow;
} else { } else {
share_surface = false; share_surface = false;
} }
@@ -1627,8 +1636,6 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
y1 = 0; y1 = 0;


if (!full_update) { if (!full_update) {
ram_addr_t region_start = addr1;
ram_addr_t region_end = addr1 + s->line_offset * height;
vga_sync_dirty_bitmap(s); vga_sync_dirty_bitmap(s);
if (s->line_compare < height) { if (s->line_compare < height) {
/* split screen mode */ /* split screen mode */
@@ -1651,10 +1658,17 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
addr = (addr & ~0x8000) | ((y1 & 2) << 14); addr = (addr & ~0x8000) | ((y1 & 2) << 14);
} }
update = full_update; update = full_update;
page0 = addr; page0 = addr & s->vbe_size_mask;
page1 = addr + bwidth - 1; page1 = (addr + bwidth - 1) & s->vbe_size_mask;
if (full_update) { if (full_update) {
update = 1; update = 1;
} else if (page1 < page0) {
/* scanline wraps from end of video memory to the start */
assert(force_shadow);
update = memory_region_snapshot_get_dirty(&s->vram, snap,
page0, 0);
update |= memory_region_snapshot_get_dirty(&s->vram, snap,
page1, 0);
} else { } else {
update = memory_region_snapshot_get_dirty(&s->vram, snap, update = memory_region_snapshot_get_dirty(&s->vram, snap,
page0, page1 - page0); page0, page1 - page0);

0 comments on commit 28f77de

Please sign in to comment.
You can’t perform that action at this time.