virtio-gpu: memory leakage when destroying gpu resource Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9912
Reference to upstream patch: http://git.qemu-project.org/?p=qemu.git;a=patch;h=b8e23926c568f2e963af39028b71c472e3023793 Signed-off-by: Sona Sarmadi <sona.sarm...@enea.com> --- .../recipes-devtools/qemu/qemu/CVE-2016-9912.patch | 45 ++++++++++++++++++++++ meta/recipes-devtools/qemu/qemu_2.8.0.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch new file mode 100644 index 0000000..c009ffd --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2016-9912.patch @@ -0,0 +1,45 @@ +From b8e23926c568f2e963af39028b71c472e3023793 Mon Sep 17 00:00:00 2001 +From: Li Qiang <liq...@gmail.com> +Date: Mon, 28 Nov 2016 21:29:25 -0500 +Subject: [PATCH] virtio-gpu: call cleanup mapping function in resource destroy + +If the guest destroy the resource before detach banking, the 'iov' +and 'addrs' field in resource is not freed thus leading memory +leak issue. This patch avoid this. + +CVE: CVE-2016-9912 +Upstream-Status: Backport + +Signed-off-by: Li Qiang <liq...@gmail.com> +Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com> +Message-id: 1480386565-10077-1-git-send-email-liq...@gmail.com +Signed-off-by: Gerd Hoffmann <kra...@redhat.com> +Signed-off-by: Sona Sarmadi <sona.sarm...@enea.com> +--- + hw/display/virtio-gpu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c +index ed2b6d3..6a26258 100644 +--- a/hw/display/virtio-gpu.c ++++ b/hw/display/virtio-gpu.c +@@ -28,6 +28,8 @@ + static struct virtio_gpu_simple_resource* + virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id); + ++static void virtio_gpu_cleanup_mapping(struct virtio_gpu_simple_resource *res); ++ + #ifdef CONFIG_VIRGL + #include <virglrenderer.h> + #define VIRGL(_g, _virgl, _simple, ...) \ +@@ -364,6 +366,7 @@ static void virtio_gpu_resource_destroy(VirtIOGPU *g, + struct virtio_gpu_simple_resource *res) + { + pixman_image_unref(res->image); ++ virtio_gpu_cleanup_mapping(res); + QTAILQ_REMOVE(&g->reslist, res, next); + g->hostmem -= res->hostmem; + g_free(res); +-- +1.9.1 + diff --git a/meta/recipes-devtools/qemu/qemu_2.8.0.bb b/meta/recipes-devtools/qemu/qemu_2.8.0.bb index 75928c6..d0f9fab 100644 --- a/meta/recipes-devtools/qemu/qemu_2.8.0.bb +++ b/meta/recipes-devtools/qemu/qemu_2.8.0.bb @@ -18,6 +18,7 @@ SRC_URI += " \ file://0003-Introduce-condition-in-TPM-backend-for-notification.patch \ file://0004-Add-support-for-VM-suspend-resume-for-TPM-TIS.patch \ file://CVE-2016-9908.patch \ + file://CVE-2016-9912.patch \ " SRC_URI =+ "http://wiki.qemu-project.org/download/${BP}.tar.bz2" -- 2.7.4 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core