From: "Philippe Mathieu-Daudé" <philmd@linaro.org>
To: "Marc-André Lureau" <marcandre.lureau@redhat.com>, qemu-devel@nongnu.org
Cc: "Alexander Bulekov" <alxndr@bu.edu>,
"Peter Maydell" <peter.maydell@linaro.org>,
"Gerd Hoffmann" <kraxel@redhat.com>,
"Mauro Matteo Cascella" <mcascell@redhat.com>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Philippe Mathieu-Daudé" <philmd@linaro.org>
Subject: [PATCH-for-8.0 5/5] hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion
Date: Mon, 28 Nov 2022 14:48:32 +0100 [thread overview]
Message-ID: <20221128134832.84867-6-philmd@linaro.org> (raw)
In-Reply-To: <20221128134832.84867-1-philmd@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
hw/display/qxl.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index afa157d327..8468513f41 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -1384,6 +1384,7 @@ static int qxl_add_memslot(PCIQXLDevice *d, uint32_t slot_id, uint64_t delta,
qxl_set_guest_bug(d, "%s: pci_region = %d", __func__, pci_region);
return 1;
}
+ assert(guest_end - pci_start <= memory_region_size(mr));
virt_start = (intptr_t)memory_region_get_ram_ptr(mr);
memslot.slot_id = slot_id;
--
2.38.1
next prev parent reply other threads:[~2022-11-28 13:51 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-28 13:48 [RFC PATCH-for-7.2 0/5] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt() Philippe Mathieu-Daudé
2022-11-28 13:48 ` [PATCH-for-7.2 1/5] hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler Philippe Mathieu-Daudé
2022-11-28 13:48 ` [PATCH-for-7.2 2/5] hw/display/qxl: Document qxl_phys2virt() Philippe Mathieu-Daudé
2022-11-28 13:48 ` [RFC PATCH-for-7.2 3/5] hw/display/qxl: Pass requested buffer size to qxl_phys2virt() Philippe Mathieu-Daudé
2022-11-28 13:53 ` Marc-André Lureau
2022-11-28 15:08 ` Gerd Hoffmann
2022-11-28 15:41 ` Philippe Mathieu-Daudé
2022-11-28 15:49 ` Gerd Hoffmann
2022-11-28 16:18 ` Philippe Mathieu-Daudé
2022-11-28 16:29 ` Philippe Mathieu-Daudé
2022-11-28 16:52 ` Philippe Mathieu-Daudé
2022-11-28 13:48 ` [RFC PATCH-for-7.2 4/5] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144) Philippe Mathieu-Daudé
2022-11-28 15:16 ` Stefan Hajnoczi
2022-11-28 15:25 ` Philippe Mathieu-Daudé
2022-11-28 15:32 ` Stefan Hajnoczi
2022-11-28 15:46 ` Philippe Mathieu-Daudé
2022-11-28 15:48 ` Stefan Hajnoczi
2022-11-28 13:48 ` Philippe Mathieu-Daudé [this message]
2022-11-28 13:51 ` [RFC PATCH-for-7.2 v2 0/5] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt() Philippe Mathieu-Daudé
2022-11-28 15:19 ` [RFC PATCH-for-7.2 " Stefan Hajnoczi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221128134832.84867-6-philmd@linaro.org \
--to=philmd@linaro.org \
--cc=alxndr@bu.edu \
--cc=kraxel@redhat.com \
--cc=marcandre.lureau@redhat.com \
--cc=mcascell@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).