70b09a5bad
Update to v2.8.0, including integration of SLE qemu package so we are "Factory First" again for SLE qemu. Includes some spec file tweaks/cleanups as well. A number of post v2.8.0 security fixes are also included. OBS-URL: https://build.opensuse.org/request/show/461715 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=329
49 lines
1.8 KiB
Diff
49 lines
1.8 KiB
Diff
From cb184e87cf205d6570e5cd34e85dd9a8a72a0afc Mon Sep 17 00:00:00 2001
|
|
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
Date: Mon, 23 Jan 2017 11:26:50 +0100
|
|
Subject: [PATCH] virtio-gpu: fix resource leak in virgl_cmd_resource_unref
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
When the guest sends VIRTIO_GPU_CMD_RESOURCE_UNREF without detaching the
|
|
backing storage beforehand (VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING)
|
|
we'll leak memory.
|
|
|
|
This patch fixes it for 3d mode, simliar to the 2d mode fix in commit
|
|
"b8e2392 virtio-gpu: call cleanup mapping function in resource destroy".
|
|
|
|
Reported-by: 李强 <liqiang6-s@360.cn>
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
Message-id: 1485167210-4757-1-git-send-email-kraxel@redhat.com
|
|
(cherry picked from commit 5e8e3c4c75c199aa1017db816fca02be2a9f8798)
|
|
[BR: CVE-2017-5857 BSC#1023073]
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
---
|
|
hw/display/virtio-gpu-3d.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/hw/display/virtio-gpu-3d.c b/hw/display/virtio-gpu-3d.c
|
|
index f96a0c2e59..ecb09d17a1 100644
|
|
--- a/hw/display/virtio-gpu-3d.c
|
|
+++ b/hw/display/virtio-gpu-3d.c
|
|
@@ -77,10 +77,18 @@ static void virgl_cmd_resource_unref(VirtIOGPU *g,
|
|
struct virtio_gpu_ctrl_command *cmd)
|
|
{
|
|
struct virtio_gpu_resource_unref unref;
|
|
+ struct iovec *res_iovs = NULL;
|
|
+ int num_iovs = 0;
|
|
|
|
VIRTIO_GPU_FILL_CMD(unref);
|
|
trace_virtio_gpu_cmd_res_unref(unref.resource_id);
|
|
|
|
+ virgl_renderer_resource_detach_iov(unref.resource_id,
|
|
+ &res_iovs,
|
|
+ &num_iovs);
|
|
+ if (res_iovs != NULL && num_iovs != 0) {
|
|
+ virtio_gpu_cleanup_mapping_iov(res_iovs, num_iovs);
|
|
+ }
|
|
virgl_renderer_resource_unref(unref.resource_id);
|
|
}
|
|
|