Commit 44b5c1eb authored by Gerd Hoffmann's avatar Gerd Hoffmann
Browse files

qxl: map rom r/o 



Map qxl rom read-only into the guest, so the guest can't tamper with the
content.  qxl has a shadow copy of the rom to deal with that, but the
shadow doesn't cover the mode list.  A privilidged user in the guest can
manipulate the mode list and that to trick qemu into oob reads, leading
to a DoS via segfault if that read access happens to hit unmapped memory.

Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200225055920.17261-2-kraxel@redhat.com
parent cd8fef8d

hw/display/qxl.c

+1 −1
Original line number Diff line number Diff line
@@ -2136,7 +2136,7 @@ static void qxl_realize_common(PCIQXLDevice *qxl, Error **errp) 
    pci_set_byte(&config[PCI_INTERRUPT_PIN], 1);



    qxl->rom_size = qxl_rom_size();

    memory_region_init_ram(&qxl->rom_bar, OBJECT(qxl), "qxl.vrom",

    memory_region_init_rom(&qxl->rom_bar, OBJECT(qxl), "qxl.vrom",

                           qxl->rom_size, &error_fatal);

    init_qxl_rom(qxl);

    init_qxl_ram(qxl);