Gerd Hoffmann <kra...@redhat.com> 于2020年8月21日周五 下午4:27写道： > > Code simply asserts that there is no wraparound instead of handling > it properly. The assert() can be triggered by the guest (must be > privilidged inside the guest though). Fix it. > > Buglink: https://bugs.launchpad.net/qemu/+bug/1880189 > Cc: Li Qiang <liq...@163.com> > Reported-by: Alexander Bulekov <alx...@bu.edu> > Signed-off-by: Gerd Hoffmann <kra...@redhat.com> > --- > hw/display/cirrus_vga.c | 11 ++++++++--- > 1 file changed, 8 insertions(+), 3 deletions(-) > > diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c > index 212d6f5e6145..b91b64347473 100644 > --- a/hw/display/cirrus_vga.c > +++ b/hw/display/cirrus_vga.c > @@ -640,10 +640,15 @@ static void cirrus_invalidate_region(CirrusVGAState * > s, int off_begin, > } > > for (y = 0; y < lines; y++) { > - off_cur = off_begin; > + off_cur = off_begin & s->cirrus_addr_mask; > off_cur_end = ((off_cur + bytesperline - 1) & s->cirrus_addr_mask) + > 1; > - assert(off_cur_end >= off_cur); > - memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - > off_cur); > + if (off_cur_end >= off_cur) { > + memory_region_set_dirty(&s->vga.vram, off_cur, off_cur_end - > off_cur); > + } else { > + /* wraparound */ > + memory_region_set_dirty(&s->vga.vram, off_cur, > s->cirrus_addr_mask - off_cur);
Should here be 's->cirrus_addr_mask + 1 - off_cur' > + memory_region_set_dirty(&s->vga.vram, 0, off_cur_end); And here be 'off_cur_end -1' Thanks, Li Qiang > + } > off_begin += off_pitch; > } > } > -- > 2.27.0 > >
