[Qemu-devel] [PATCH v2] cirrus_vga: adding sanity check for vram size

[Qemu-devel] [PATCH v2] cirrus_vga: adding sanity check for vram size

[arei.gonglei]

From: Gonglei <arei.gonglei@huawei.com>

when configure a invalid vram size for cirrus card, such as less
2 MB, which will crash qemu. Follow the real hardware, the cirrus
card has 4 MB video memory. Also for backward compatibility, accept
8 MB and 16 MB vram size.

Signed-off-by: Gonglei <arei.gonglei@huawei.com>
---
v2: fix checkpatch fails.
  "WARNING: suspect code indent for conditional statements (5, 9)"
  maybe not a real warning.

 hw/display/cirrus_vga.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index d1afc76..399a2ef 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2959,6 +2959,14 @@ static int pci_cirrus_vga_initfn(PCIDevice *dev)
      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
      int16_t device_id = pc->device_id;
 
+     /* follow real hardware, cirrus card emulated has 4 MB video memory.
+       Also accept 8 MB/16 MB for backward compatibility. */
+     if (s->vga.vram_size_mb != 4 || s->vga.vram_size_mb != 8 ||
+         s->vga.vram_size_mb != 16) {
+         error_report("Invalid cirrus_vga ram size '%u'\n",
+                      s->vga.vram_size_mb);
+         return -1;
+     }
      /* setup VGA */
      vga_common_init(&s->vga, OBJECT(dev), true);
      cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),
-- 
1.7.12.4

Re: [Qemu-devel] [PATCH v2] cirrus_vga: adding sanity check for vram size

[Michael Tokarev]

09.05.2014 15:04, arei.gonglei@huawei.com wrote:
> From: Gonglei <arei.gonglei@huawei.com>
> 
> when configure a invalid vram size for cirrus card, such as less
> 2 MB, which will crash qemu. Follow the real hardware, the cirrus
> card has 4 MB video memory. Also for backward compatibility, accept
> 8 MB and 16 MB vram size.
> 
> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
> ---
> v2: fix checkpatch fails.
>   "WARNING: suspect code indent for conditional statements (5, 9)"
>   maybe not a real warning.
> 
>  hw/display/cirrus_vga.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
> index d1afc76..399a2ef 100644
> --- a/hw/display/cirrus_vga.c
> +++ b/hw/display/cirrus_vga.c
> @@ -2959,6 +2959,14 @@ static int pci_cirrus_vga_initfn(PCIDevice *dev)
>       PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
>       int16_t device_id = pc->device_id;
>  
> +     /* follow real hardware, cirrus card emulated has 4 MB video memory.
> +       Also accept 8 MB/16 MB for backward compatibility. */
> +     if (s->vga.vram_size_mb != 4 || s->vga.vram_size_mb != 8 ||
> +         s->vga.vram_size_mb != 16) {

This condition will always be true, because a number can't be equal
to 3 _different_ numbers at the same time.

Thanks,

/mjt

Re: [Qemu-devel] [PATCH v2] cirrus_vga: adding sanity check for vram size

[Gonglei (Arei)]

Hi,

> > diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
> > index d1afc76..399a2ef 100644
> > --- a/hw/display/cirrus_vga.c
> > +++ b/hw/display/cirrus_vga.c
> > @@ -2959,6 +2959,14 @@ static int pci_cirrus_vga_initfn(PCIDevice *dev)
> >       PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
> >       int16_t device_id = pc->device_id;
> >
> > +     /* follow real hardware, cirrus card emulated has 4 MB video
> memory.
> > +       Also accept 8 MB/16 MB for backward compatibility. */
> > +     if (s->vga.vram_size_mb != 4 || s->vga.vram_size_mb != 8 ||
> > +         s->vga.vram_size_mb != 16) {
> 
> This condition will always be true, because a number can't be equal
> to 3 _different_ numbers at the same time.
> 
Yep, good catch. Thanks.

Best regards,
-Gonglei

Re: [Qemu-devel] [PATCH v2] cirrus_vga: adding sanity check for vram size

[Andreas Färber]

Am 09.05.2014 13:04, schrieb arei.gonglei@huawei.com:
> From: Gonglei <arei.gonglei@huawei.com>
> 
> when configure a invalid vram size for cirrus card, such as less
> 2 MB, which will crash qemu. Follow the real hardware, the cirrus
> card has 4 MB video memory. Also for backward compatibility, accept
> 8 MB and 16 MB vram size.
> 
> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
> ---
> v2: fix checkpatch fails.
>   "WARNING: suspect code indent for conditional statements (5, 9)"
>   maybe not a real warning.
> 
>  hw/display/cirrus_vga.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
> index d1afc76..399a2ef 100644
> --- a/hw/display/cirrus_vga.c
> +++ b/hw/display/cirrus_vga.c
> @@ -2959,6 +2959,14 @@ static int pci_cirrus_vga_initfn(PCIDevice *dev)
>       PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
>       int16_t device_id = pc->device_id;
>  
> +     /* follow real hardware, cirrus card emulated has 4 MB video memory.
> +       Also accept 8 MB/16 MB for backward compatibility. */
> +     if (s->vga.vram_size_mb != 4 || s->vga.vram_size_mb != 8 ||
> +         s->vga.vram_size_mb != 16) {

Apart from the logic bug mjt already pointed out, I note that this check
is in the PCI initfn. Should the same restriction also apply for the ISA
version of the device?

> +         error_report("Invalid cirrus_vga ram size '%u'\n",
> +                      s->vga.vram_size_mb);

Thanks for using our new error_report(). It does not require a trailing
\n though.

Regards,
Andreas

> +         return -1;
> +     }
>       /* setup VGA */
>       vga_common_init(&s->vga, OBJECT(dev), true);
>       cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH v2] cirrus_vga: adding sanity check for vram size

[Gonglei (Arei)]

Hi,

> > diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
> > index d1afc76..399a2ef 100644
> > --- a/hw/display/cirrus_vga.c
> > +++ b/hw/display/cirrus_vga.c
> > @@ -2959,6 +2959,14 @@ static int pci_cirrus_vga_initfn(PCIDevice *dev)
> >       PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
> >       int16_t device_id = pc->device_id;
> >
> > +     /* follow real hardware, cirrus card emulated has 4 MB video
> memory.
> > +       Also accept 8 MB/16 MB for backward compatibility. */
> > +     if (s->vga.vram_size_mb != 4 || s->vga.vram_size_mb != 8 ||
> > +         s->vga.vram_size_mb != 16) {
> 
> Apart from the logic bug mjt already pointed out, I note that this check
> is in the PCI initfn. Should the same restriction also apply for the ISA
> version of the device?
> 
Yes, I have noted this issue in v1. In other mail, you gave me some advices,
thanks a lot, Andreas. I will post v3.

> > +         error_report("Invalid cirrus_vga ram size '%u'\n",
> > +                      s->vga.vram_size_mb);
> 
> Thanks for using our new error_report(). It does not require a trailing
> \n though.
> 
Got it. Thanks.

Best regards,
-Gonglei