diff options
author | Gerd Hoffmann <kraxel@redhat.com> | 2021-06-04 09:50:29 +0200 |
---|---|---|
committer | Gerd Hoffmann <kraxel@redhat.com> | 2021-06-15 07:16:56 +0200 |
commit | 4fa7b4cc500e1fbd8c11e65548b7713db81e75ff (patch) | |
tree | 09dc73db2cf2931c6831e544f66cfe50954da41b /hw/display/virtio-gpu.c | |
parent | 25b2ef2e8ee23109b0c3ce9ea71330bf8a7d12bd (diff) |
virtio-gpu: move scanout_id sanity check
Checking scanout_id in virtio_gpu_do_set_scanout() is too late, for the
"resource_id == 0" case (aka disable scanout) the scanout_id is used
unchecked. Move the check into the callers to fix that.
Fixes: e64d4b6a9bc3 ("virtio-gpu: Refactor virtio_gpu_set_scanout")
Fixes: 32db3c63ae11 ("virtio-gpu: Add virtio_gpu_set_scanout_blob")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/383
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Message-Id: <20210604075029.1201478-1-kraxel@redhat.com>
Diffstat (limited to 'hw/display/virtio-gpu.c')
-rw-r--r-- | hw/display/virtio-gpu.c | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 4d549377cb..e183f4ecda 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -610,12 +610,6 @@ static void virtio_gpu_do_set_scanout(VirtIOGPU *g, struct virtio_gpu_scanout *scanout; uint8_t *data; - if (scanout_id >= g->parent_obj.conf.max_outputs) { - qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d", - __func__, scanout_id); - *error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID; - return; - } scanout = &g->parent_obj.scanout[scanout_id]; if (r->x > fb->width || @@ -694,6 +688,13 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g, trace_virtio_gpu_cmd_set_scanout(ss.scanout_id, ss.resource_id, ss.r.width, ss.r.height, ss.r.x, ss.r.y); + if (ss.scanout_id >= g->parent_obj.conf.max_outputs) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d", + __func__, ss.scanout_id); + cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID; + return; + } + if (ss.resource_id == 0) { virtio_gpu_disable_scanout(g, ss.scanout_id); return; @@ -730,6 +731,13 @@ static void virtio_gpu_set_scanout_blob(VirtIOGPU *g, ss.r.width, ss.r.height, ss.r.x, ss.r.y); + if (ss.scanout_id >= g->parent_obj.conf.max_outputs) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: illegal scanout id specified %d", + __func__, ss.scanout_id); + cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_SCANOUT_ID; + return; + } + if (ss.resource_id == 0) { virtio_gpu_disable_scanout(g, ss.scanout_id); return; |