From 8bf7ade372b46b8a872661a7904fbaa30fa262a2 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Fri, 3 Mar 2017 12:51:42 +0100 Subject: qemu: display: CVE-2016-9912 virtio-gpu: memory leakage when destroying gpu resource Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9912 Reference to upstream patch: http://git.qemu-project.org/?p=qemu.git;a=patch;h=b8e23926c568f2e963af39028b71c472e3023793 Signed-off-by: Sona Sarmadi Signed-off-by: Ross Burton --- .../recipes-devtools/qemu/qemu/CVE-2016-9912.patch | 45 ++++++++++++++++++++++ meta/recipes-devtools/qemu/qemu_2.8.0.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch new file mode 100644 index 0000000000..c009ffd96a --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch @@ -0,0 +1,45 @@ +From b8e23926c568f2e963af39028b71c472e3023793 Mon Sep 17 00:00:00 2001 +From: Li Qiang +Date: Mon, 28 Nov 2016 21:29:25 -0500 +Subject: [PATCH] virtio-gpu: call cleanup mapping function in resource destroy + +If the guest destroy the resource before detach banking, the 'iov' +and 'addrs' field in resource is not freed thus leading memory +leak issue. This patch avoid this. + +CVE: CVE-2016-9912 +Upstream-Status: Backport + +Signed-off-by: Li Qiang +Reviewed-by: Marc-André Lureau +Message-id: 1480386565-10077-1-git-send-email-liq3ea@gmail.com +Signed-off-by: Gerd Hoffmann +Signed-off-by: Sona Sarmadi +--- + hw/display/virtio-gpu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c +index ed2b6d3..6a26258 100644 +--- a/hw/display/virtio-gpu.c ++++ b/hw/display/virtio-gpu.c +@@ -28,6 +28,8 @@ + static struct virtio_gpu_simple_resource* + virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id); + ++static void virtio_gpu_cleanup_mapping(struct virtio_gpu_simple_resource *res); ++ + #ifdef CONFIG_VIRGL + #include + #define VIRGL(_g, _virgl, _simple, ...) \ +@@ -364,6 +366,7 @@ static void virtio_gpu_resource_destroy(VirtIOGPU *g, + struct virtio_gpu_simple_resource *res) + { + pixman_image_unref(res->image); ++ virtio_gpu_cleanup_mapping(res); + QTAILQ_REMOVE(&g->reslist, res, next); + g->hostmem -= res->hostmem; + g_free(res); +-- +1.9.1 + diff --git a/meta/recipes-devtools/qemu/qemu_2.8.0.bb b/meta/recipes-devtools/qemu/qemu_2.8.0.bb index b8799d5cc2..19d7e8f658 100644 --- a/meta/recipes-devtools/qemu/qemu_2.8.0.bb +++ b/meta/recipes-devtools/qemu/qemu_2.8.0.bb @@ -29,6 +29,7 @@ SRC_URI += " \ file://0003-Introduce-condition-in-TPM-backend-for-notification.patch \ file://0004-Add-support-for-VM-suspend-resume-for-TPM-TIS.patch \ file://CVE-2016-9908.patch \ + file://CVE-2016-9912.patch \ " SRC_URI_append_class-native = " \ -- cgit v1.2.3