| commit | 7e486f7577764a07aa35588e119903c80a5c30a2 | |
| author | Gerd Hoffmann <kraxel@redhat.com> | |
| Mon, 30 May 2016 07:09:20 +0000 (30 09:09 +0200) | ||
| committer | Gerd Hoffmann <kraxel@redhat.com> | |
| Mon, 6 Jun 2016 07:04:24 +0000 (6 09:04 +0200) | ||
| tree | f7e294f10087d43fdc2bf94fb15ada823a483ed1 | treesnapshot (tar.gz zip) |
| parent | c2e3c54d3960bc53bfa3a5ce7ea7a050b9be267e | commitdiff |
vmsvga: shadow fifo registers
The fifo is normal ram. So kvm vcpu threads and qemu iothread can
access the fifo in parallel without syncronization. Which in turn
implies we can't use the fifo pointers in-place because the guest
can try changing them underneath us. So add shadows for them, to
make sure the guest can't modify them after we've applied sanity
checks.
Fixes: CVE-2016-4454
Cc: qemu-stable@nongnu.org
Cc: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1464592161-18348-4-git-send-email-kraxel@redhat.com
The fifo is normal ram. So kvm vcpu threads and qemu iothread can
access the fifo in parallel without syncronization. Which in turn
implies we can't use the fifo pointers in-place because the guest
can try changing them underneath us. So add shadows for them, to
make sure the guest can't modify them after we've applied sanity
checks.
Fixes: CVE-2016-4454
Cc: qemu-stable@nongnu.org
Cc: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1464592161-18348-4-git-send-email-kraxel@redhat.com
| hw/display/vmware_vga.c | diffblobblamehistory |