70b09a5bad
Update to v2.8.0, including integration of SLE qemu package so we are "Factory First" again for SLE qemu. Includes some spec file tweaks/cleanups as well. A number of post v2.8.0 security fixes are also included. OBS-URL: https://build.opensuse.org/request/show/461715 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=329
45 lines
1.7 KiB
Diff
45 lines
1.7 KiB
Diff
From 7b6b039ba580ddafdb3a0377f3c39c8d5e57bbc6 Mon Sep 17 00:00:00 2001
|
|
From: Li Qiang <liq3ea@gmail.com>
|
|
Date: Mon, 28 Nov 2016 21:29:25 -0500
|
|
Subject: [PATCH] virtio-gpu: call cleanup mapping function in resource destroy
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
If the guest destroy the resource before detach banking, the 'iov'
|
|
and 'addrs' field in resource is not freed thus leading memory
|
|
leak issue. This patch avoid this.
|
|
|
|
Signed-off-by: Li Qiang <liq3ea@gmail.com>
|
|
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
Message-id: 1480386565-10077-1-git-send-email-liq3ea@gmail.com
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
(cherry picked from commit b8e23926c568f2e963af39028b71c472e3023793)
|
|
BR: CVE-2016-9912 BSC#1014112]
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
---
|
|
hw/display/virtio-gpu.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
|
|
index 5f32e1aae9..3eafe495ef 100644
|
|
--- a/hw/display/virtio-gpu.c
|
|
+++ b/hw/display/virtio-gpu.c
|
|
@@ -28,6 +28,8 @@
|
|
static struct virtio_gpu_simple_resource*
|
|
virtio_gpu_find_resource(VirtIOGPU *g, uint32_t resource_id);
|
|
|
|
+static void virtio_gpu_cleanup_mapping(struct virtio_gpu_simple_resource *res);
|
|
+
|
|
#ifdef CONFIG_VIRGL
|
|
#include <virglrenderer.h>
|
|
#define VIRGL(_g, _virgl, _simple, ...) \
|
|
@@ -359,6 +361,7 @@ static void virtio_gpu_resource_destroy(VirtIOGPU *g,
|
|
struct virtio_gpu_simple_resource *res)
|
|
{
|
|
pixman_image_unref(res->image);
|
|
+ virtio_gpu_cleanup_mapping(res);
|
|
QTAILQ_REMOVE(&g->reslist, res, next);
|
|
g_free(res);
|
|
}
|