[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] 5e7bcd: display/bochs: fix pcie support
From: |
Gerd Hoffmann |
Subject: |
[Qemu-commits] [qemu/qemu] 5e7bcd: display/bochs: fix pcie support |
Date: |
Mon, 12 Aug 2019 09:35:01 -0700 |
Branch: refs/heads/master
Home: https://github.com/qemu/qemu
Commit: 5e7bcdcfe69ce0fad66012b2cfb2035003c37eef
https://github.com/qemu/qemu/commit/5e7bcdcfe69ce0fad66012b2cfb2035003c37eef
Author: Gerd Hoffmann <address@hidden>
Date: 2019-08-12 (Mon, 12 Aug 2019)
Changed paths:
M hw/display/bochs-display.c
Log Message:
-----------
display/bochs: fix pcie support
Set QEMU_PCI_CAP_EXPRESS unconditionally in init(), then clear it in
realize() in case the device is not connected to a PCIe bus.
This makes sure the pci config space allocation is big enough, so
accessing the PCIe extended config space doesn't overflow the pci
config space buffer.
PCI(e) config space is guest writable. Writes are limited by
write mask (which probably is also filled with random stuff),
so the guest can only flip enabled bits. But I suspect it
still might be exploitable, so rather serious because it might
be a host escape for the guest. On the other hand the device
is probably not yet in widespread use.
(For a QEMU version without this commit, a mitigation for the
bug is available: use "-device bochs-display" as a conventional pci
device only.)
Cc: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden
Reviewed-by: Alex Williamson <address@hidden>
Reviewed-by: Paolo Bonzini <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-commits] [qemu/qemu] 5e7bcd: display/bochs: fix pcie support,
Gerd Hoffmann <=