From 05ece98f965997649b8d922d224240459bcc1403 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dennis=20W=C3=B6lfing?= Date: Mon, 7 Jun 2021 13:53:03 +0200 Subject: [PATCH 1/3] vga: Allow writing VBE_DISPI_ID5 to ID register MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The highest VBE_DISPI_INDEX_ID version supported by QEMU is VBE_DISPI_ID5. But currently QEMU only allows writing values up to VBE_DISPI_ID4 to the VBE_DISPI_INDEX_ID register. As a result of this when a lower version is written to this register and later VBE_DISPI_ID5 is written back, reads from the register will continue to report the lower version. Indeed SeaBIOS is doing that during VGA initialization which causes guests to always read VBE_DISPI_ID0 instead of the correct version. Signed-off-by: Dennis Wölfing Message-Id: <20210607115303.228659-1-denniswoelfing@gmx.de> Signed-off-by: Gerd Hoffmann --- hw/display/vga.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/display/vga.c b/hw/display/vga.c index 28a90e30d0..9d1f66af40 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -752,7 +752,8 @@ void vbe_ioport_write_data(void *opaque, uint32_t addr, uint32_t val) val == VBE_DISPI_ID1 || val == VBE_DISPI_ID2 || val == VBE_DISPI_ID3 || - val == VBE_DISPI_ID4) { + val == VBE_DISPI_ID4 || + val == VBE_DISPI_ID5) { s->vbe_regs[s->vbe_index] = val; } break; From 25b2ef2e8ee23109b0c3ce9ea71330bf8a7d12bd Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Fri, 4 Jun 2021 12:37:14 +0200 Subject: [PATCH 2/3] vhost-user-gpu: reorder free calls. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Free in correct order to avoid use-after-free. Resolves: CID 1453812 Signed-off-by: Gerd Hoffmann Reviewed-by: Marc-André Lureau Reviewed-by: Li Qiang Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20210604103714.1237414-1-kraxel@redhat.com> --- contrib/vhost-user-gpu/vhost-user-gpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/vhost-user-gpu/vhost-user-gpu.c b/contrib/vhost-user-gpu/vhost-user-gpu.c index 6dc6a44f4e..611360e6b4 100644 --- a/contrib/vhost-user-gpu/vhost-user-gpu.c +++ b/contrib/vhost-user-gpu/vhost-user-gpu.c @@ -350,8 +350,8 @@ vg_resource_create_2d(VuGpu *g, if (!res->image) { g_critical("%s: resource creation failed %d %d %d", __func__, c2d.resource_id, c2d.width, c2d.height); - g_free(res); vugbm_buffer_destroy(&res->buffer); + g_free(res); cmd->error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY; return; } From 4fa7b4cc500e1fbd8c11e65548b7713db81e75ff Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Fri, 4 Jun 2021 09:50:29 +0200 Subject: [PATCH 3/3] virtio-gpu: move scanout_id sanity check Checking scanout_id in virtio_gpu_do_set_scanout() is too late, for the "resource_id == 0" case (aka disable scanout) the scanout_id is used unchecked. Move the check into the callers to fix that. Fixes: e64d4b6a9bc3 ("virtio-gpu: Refactor virtio_gpu_set_scanout") Fixes: 32db3c63ae11 ("virtio-gpu: Add virtio_gpu_set_scanout_blob") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/383 Reported-by: Alexander Bulekov Signed-off-by: Gerd Hoffmann Reviewed-by: Vivek Kasireddy Reviewed-by: Li Qiang Message-Id: <20210604075029.1201478-1-kraxel@redhat.com> --- hw/display/virtio-gpu.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 4d549377cb..e183f4ecda 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -610,12 +610,6 @@ static void virtio_gpu_do_set_scanout(VirtIOGPU *g, struct virtio_gpu_scanout *scanout; uint8_t *data; - if (scanout_id >= g->parent_obj.conf.max_outputs) { - qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d", - __func__, scanout_id); - *error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID; - return; - } scanout = &g->parent_obj.scanout[scanout_id]; if (r->x > fb->width || @@ -694,6 +688,13 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g, trace_virtio_gpu_cmd_set_scanout(ss.scanout_id, ss.resource_id, ss.r.width, ss.r.height, ss.r.x, ss.r.y); + if (ss.scanout_id >= g->parent_obj.conf.max_outputs) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d", + __func__, ss.scanout_id); + cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID; + return; + } + if (ss.resource_id == 0) { virtio_gpu_disable_scanout(g, ss.scanout_id); return; @@ -730,6 +731,13 @@ static void virtio_gpu_set_scanout_blob(VirtIOGPU *g, ss.r.width, ss.r.height, ss.r.x, ss.r.y); + if (ss.scanout_id >= g->parent_obj.conf.max_outputs) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d", + __func__, ss.scanout_id); + cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID; + return; + } + if (ss.resource_id == 0) { virtio_gpu_disable_scanout(g, ss.scanout_id); return;