[PULL 0/2] Vga 20200605 patches

[PULL 0/2] Vga 20200605 patches

[Gerd Hoffmann]

The following changes since commit 66234fee9c2d37bfbc523aa8d0ae5300a14cc10e:

  Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20200603' into staging (2020-06-04 11:38:48 +0100)

are available in the Git repository at:

  git://git.kraxel.org/qemu tags/vga-20200605-pull-request

for you to fetch changes up to ae3887e6f08c0031b669d4613987ee51df8f1769:

  hw/display/cirrus_vga: Fix code mis-indentation (2020-06-05 09:17:23 +0200)

----------------------------------------------------------------
vga: ati security fix, cirrus cleanup.

----------------------------------------------------------------

Philippe Mathieu-Daudé (1):
  hw/display/cirrus_vga: Fix code mis-indentation

Prasad J Pandit (1):
  ati-vga: check mm_index before recursive call (CVE-2020-13800)

 hw/display/ati.c        | 10 ++++++++--
 hw/display/cirrus_vga.c |  6 +++---
 2 files changed, 11 insertions(+), 5 deletions(-)

-- 
2.18.4

[PULL 1/2] ati-vga: check mm_index before recursive call (CVE-2020-13800)

[Gerd Hoffmann]

From: Prasad J Pandit <pjp@fedoraproject.org>

While accessing VGA registers via ati_mm_read/write routines,
a guest may set 's->regs.mm_index' such that it leads to infinite
recursion. Check mm_index value to avoid such recursion. Log an
error message for wrong values.

Reported-by: Ren Ding <rding@gatech.edu>
Reported-by: Hanqing Zhao <hanqing@gatech.edu>
Reported-by: Yi Ren <c4tren@gmail.com>
Message-id: 20200604090830.33885-1-ppandit@redhat.com
Suggested-by: BALATON Zoltan <balaton@eik.bme.hu>
Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/ati.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/display/ati.c b/hw/display/ati.c
index 065f197678e4..67604e68deb1 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -285,8 +285,11 @@ static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size)
             if (idx <= s->vga.vram_size - size) {
                 val = ldn_le_p(s->vga.vram_ptr + idx, size);
             }
-        } else {
+        } else if (s->regs.mm_index > MM_DATA + 3) {
             val = ati_mm_read(s, s->regs.mm_index + addr - MM_DATA, size);
+        } else {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                "ati_mm_read: mm_index too small: %u\n", s->regs.mm_index);
         }
         break;
     case BIOS_0_SCRATCH ... BUS_CNTL - 1:
@@ -520,8 +523,11 @@ static void ati_mm_write(void *opaque, hwaddr addr,
             if (idx <= s->vga.vram_size - size) {
                 stn_le_p(s->vga.vram_ptr + idx, size, data);
             }
-        } else {
+        } else if (s->regs.mm_index > MM_DATA + 3) {
             ati_mm_write(s, s->regs.mm_index + addr - MM_DATA, data, size);
+        } else {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                "ati_mm_write: mm_index too small: %u\n", s->regs.mm_index);
         }
         break;
     case BIOS_0_SCRATCH ... BUS_CNTL - 1:
-- 
2.18.4

[PULL 2/2] hw/display/cirrus_vga: Fix code mis-indentation

[Gerd Hoffmann]

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

While replacing fprintf() by qemu_log_mask() in commit
2b55f4d3504, we incorrectly used a 'tab = 4 spaces'
alignment, leading to misindented new code. Fix now.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200529165436.23573-1-f4bug@amsat.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/cirrus_vga.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index 92c197cdde1d..212d6f5e6145 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -1032,9 +1032,9 @@ static void cirrus_bitblt_start(CirrusVGAState * s)
         } else {
 	    if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
 		if (s->cirrus_blt_pixelwidth > 2) {
-            qemu_log_mask(LOG_GUEST_ERROR,
-                          "cirrus: src transparent without colorexpand "
-                          "must be 8bpp or 16bpp\n");
+                    qemu_log_mask(LOG_GUEST_ERROR,
+                                  "cirrus: src transparent without colorexpand "
+                                  "must be 8bpp or 16bpp\n");
 		    goto bitblt_ignore;
 		}
 		if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {
-- 
2.18.4

Re: [PULL 0/2] Vga 20200605 patches

[Peter Maydell]

On Fri, 5 Jun 2020 at 12:28, Gerd Hoffmann <kraxel@redhat.com> wrote:
>
> The following changes since commit 66234fee9c2d37bfbc523aa8d0ae5300a14cc10e:
>
>   Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20200603' into staging (2020-06-04 11:38:48 +0100)
>
> are available in the Git repository at:
>
>   git://git.kraxel.org/qemu tags/vga-20200605-pull-request
>
> for you to fetch changes up to ae3887e6f08c0031b669d4613987ee51df8f1769:
>
>   hw/display/cirrus_vga: Fix code mis-indentation (2020-06-05 09:17:23 +0200)
>
> ----------------------------------------------------------------
> vga: ati security fix, cirrus cleanup.
>


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/5.1
for any user-visible changes.

-- PMM