summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSona Sarmadi <sona.sarmadi@enea.com>2017-03-03 12:51:42 +0100
committerRichard Purdie <richard.purdie@linuxfoundation.org>2017-03-08 11:13:47 +0000
commit8bf7ade372b46b8a872661a7904fbaa30fa262a2 (patch)
tree64a156e15fca66e6b53adc21f3fe1ea3db8a5103
parentf5f4a08baeb4864984fcb9a837a3a8c51274df2b (diff)
downloadopenembedded-core-8bf7ade372b46b8a872661a7904fbaa30fa262a2.tar.gz
openembedded-core-8bf7ade372b46b8a872661a7904fbaa30fa262a2.tar.bz2
openembedded-core-8bf7ade372b46b8a872661a7904fbaa30fa262a2.zip
qemu: display: CVE-2016-9912
virtio-gpu: memory leakage when destroying gpu resource Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9912 Reference to upstream patch: http://git.qemu-project.org/?p=qemu.git;a=patch;h=b8e23926c568f2e963af39028b71c472e3023793 Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch45
-rw-r--r--meta/recipes-devtools/qemu/qemu_2.8.0.bb1
2 files changed, 46 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch
new file mode 100644
index 0000000000..c009ffd96a
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch
@@ -0,0 +1,45 @@
+From b8e23926c568f2e963af39028b71c472e3023793 Mon Sep 17 00:00:00 2001
+From: Li Qiang <liq3ea@gmail.com>
+Date: Mon, 28 Nov 2016 21:29:25 -0500
+Subject: [PATCH] virtio-gpu: call cleanup mapping function in resource destroy
+
+If the guest destroy the resource before detach banking, the 'iov'
+and 'addrs' field in resource is not freed thus leading memory
+leak issue. This patch avoid this.
+
+CVE: CVE-2016-9912
+Upstream-Status: Backport
+
+Signed-off-by: Li Qiang <liq3ea@gmail.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-id: 1480386565-10077-1-git-send-email-liq3ea@gmail.com
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ hw/display/virtio-gpu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
+index ed2b6d3..6a26258 100644
+--- a/hw/display/virtio-gpu.c
++++ b/hw/display/virtio-gpu.c
+@@ -28,6 +28,8 @@
+ static struct virtio_gpu_simple_resource*
+ virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id);
+
++static void virtio_gpu_cleanup_mapping(struct virtio_gpu_simple_resource *res);
++
+ #ifdef CONFIG_VIRGL
+ #include <virglrenderer.h>
+ #define VIRGL(_g, _virgl, _simple, ...) \
+@@ -364,6 +366,7 @@ static void virtio_gpu_resource_destroy(VirtIOGPU *g,
+ struct virtio_gpu_simple_resource *res)
+ {
+ pixman_image_unref(res->image);
++ virtio_gpu_cleanup_mapping(res);
+ QTAILQ_REMOVE(&g->reslist, res, next);
+ g->hostmem -= res->hostmem;
+ g_free(res);
+--
+1.9.1
+
diff --git a/meta/recipes-devtools/qemu/qemu_2.8.0.bb b/meta/recipes-devtools/qemu/qemu_2.8.0.bb
index b8799d5cc2..19d7e8f658 100644
--- a/meta/recipes-devtools/qemu/qemu_2.8.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.8.0.bb
@@ -29,6 +29,7 @@ SRC_URI += " \
file://0003-Introduce-condition-in-TPM-backend-for-notification.patch \
file://0004-Add-support-for-VM-suspend-resume-for-TPM-TIS.patch \
file://CVE-2016-9908.patch \
+ file://CVE-2016-9912.patch \
"
SRC_URI_append_class-native = " \