|
Bernhard M. Wiedemann |
399b1f |
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
|
|
Bernhard M. Wiedemann |
399b1f |
Date: Mon, 28 Nov 2022 21:27:37 +0100
|
|
Bernhard M. Wiedemann |
399b1f |
Subject: hw/display/qxl: Have qxl_log_command Return early if no log_cmd
|
|
Bernhard M. Wiedemann |
399b1f |
handler
|
|
Bernhard M. Wiedemann |
399b1f |
MIME-Version: 1.0
|
|
Bernhard M. Wiedemann |
399b1f |
Content-Type: text/plain; charset=UTF-8
|
|
Bernhard M. Wiedemann |
399b1f |
Content-Transfer-Encoding: 8bit
|
|
Bernhard M. Wiedemann |
399b1f |
|
|
Bernhard M. Wiedemann |
399b1f |
Only 3 command types are logged: no need to call qxl_phys2virt()
|
|
Bernhard M. Wiedemann |
399b1f |
for the other types. Using different cases will help to pass
|
|
Bernhard M. Wiedemann |
399b1f |
different structure sizes to qxl_phys2virt() in a pair of commits.
|
|
Bernhard M. Wiedemann |
399b1f |
|
|
Bernhard M. Wiedemann |
399b1f |
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
Bernhard M. Wiedemann |
399b1f |
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
|
Bernhard M. Wiedemann |
399b1f |
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Bernhard M. Wiedemann |
399b1f |
Message-Id: <20221128202741.4945-2-philmd@linaro.org>
|
|
Bernhard M. Wiedemann |
399b1f |
(cherry picked from commit 61c34fc194b776ecadc39fb26b061331107e5599)
|
|
Bernhard M. Wiedemann |
399b1f |
Resolves: bsc#1205808
|
|
Bernhard M. Wiedemann |
399b1f |
Fixes: CVE-2022-4144
|
|
Bernhard M. Wiedemann |
399b1f |
Signed-off-by: Dario Faggioli <dfaggioli@suse.com>
|
|
Bernhard M. Wiedemann |
399b1f |
---
|
|
Bernhard M. Wiedemann |
399b1f |
hw/display/qxl-logger.c | 11 +++++++++++
|
|
Bernhard M. Wiedemann |
399b1f |
1 file changed, 11 insertions(+)
|
|
Bernhard M. Wiedemann |
399b1f |
|
|
Bernhard M. Wiedemann |
399b1f |
diff --git a/hw/display/qxl-logger.c b/hw/display/qxl-logger.c
|
|
Bernhard M. Wiedemann |
399b1f |
index 68bfa47568025b292cf2f39e65a8..1bcf803db6dabe558aaf1a0df0cd 100644
|
|
Bernhard M. Wiedemann |
399b1f |
--- a/hw/display/qxl-logger.c
|
|
Bernhard M. Wiedemann |
399b1f |
+++ b/hw/display/qxl-logger.c
|
|
Bernhard M. Wiedemann |
399b1f |
@@ -247,6 +247,16 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext)
|
|
Bernhard M. Wiedemann |
399b1f |
qxl_name(qxl_type, ext->cmd.type),
|
|
Bernhard M. Wiedemann |
399b1f |
compat ? "(compat)" : "");
|
|
Bernhard M. Wiedemann |
399b1f |
|
|
Bernhard M. Wiedemann |
399b1f |
+ switch (ext->cmd.type) {
|
|
Bernhard M. Wiedemann |
399b1f |
+ case QXL_CMD_DRAW:
|
|
Bernhard M. Wiedemann |
399b1f |
+ break;
|
|
Bernhard M. Wiedemann |
399b1f |
+ case QXL_CMD_SURFACE:
|
|
Bernhard M. Wiedemann |
399b1f |
+ break;
|
|
Bernhard M. Wiedemann |
399b1f |
+ case QXL_CMD_CURSOR:
|
|
Bernhard M. Wiedemann |
399b1f |
+ break;
|
|
Bernhard M. Wiedemann |
399b1f |
+ default:
|
|
Bernhard M. Wiedemann |
399b1f |
+ goto out;
|
|
Bernhard M. Wiedemann |
399b1f |
+ }
|
|
Bernhard M. Wiedemann |
399b1f |
data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id);
|
|
Bernhard M. Wiedemann |
399b1f |
if (!data) {
|
|
Bernhard M. Wiedemann |
399b1f |
return 1;
|
|
Bernhard M. Wiedemann |
399b1f |
@@ -269,6 +279,7 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext)
|
|
Bernhard M. Wiedemann |
399b1f |
qxl_log_cmd_cursor(qxl, data, ext->group_id);
|
|
Bernhard M. Wiedemann |
399b1f |
break;
|
|
Bernhard M. Wiedemann |
399b1f |
}
|
|
Bernhard M. Wiedemann |
399b1f |
+out:
|
|
Bernhard M. Wiedemann |
399b1f |
fprintf(stderr, "\n");
|
|
Bernhard M. Wiedemann |
399b1f |
return 0;
|
|
Bernhard M. Wiedemann |
399b1f |
}
|