vmsvga: shadow fifo registers
authorGerd Hoffmann <kraxel@redhat.com>
Mon, 30 May 2016 07:09:20 +0000 (09:09 +0200)
committerGerd Hoffmann <kraxel@redhat.com>
Mon, 6 Jun 2016 07:04:24 +0000 (09:04 +0200)
commit7e486f7577764a07aa35588e119903c80a5c30a2
treef7e294f10087d43fdc2bf94fb15ada823a483ed1
parentc2e3c54d3960bc53bfa3a5ce7ea7a050b9be267e
vmsvga: shadow fifo registers

The fifo is normal ram.  So kvm vcpu threads and qemu iothread can
access the fifo in parallel without syncronization.  Which in turn
implies we can't use the fifo pointers in-place because the guest
can try changing them underneath us.  So add shadows for them, to
make sure the guest can't modify them after we've applied sanity
checks.

Fixes: CVE-2016-4454
Cc: qemu-stable@nongnu.org
Cc: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1464592161-18348-4-git-send-email-kraxel@redhat.com
hw/display/vmware_vga.c