@@ -430,6 +430,34 @@ static void qxl_ring_set_dirty(PCIQXLDevice *qxl)
qxl_set_dirty(&qxl->vga.vram, addr, end);
}
+static int verify_surface_cmd(PCIQXLDevice *qxl, QXLSurfaceCmd *cmd)
+{
+ uint32_t id = le32_to_cpu(cmd->surface_id);
+
+ if (id >= qxl->ssd.num_surfaces) {
+ qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE id %d >= %d", id,
+ qxl->ssd.num_surfaces);
+ return 1;
+ }
+ if (cmd->type == QXL_SURFACE_CMD_CREATE &&
+ (cmd->u.surface_create.stride & 0x03) != 0) {
+ qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE stride = %d %% 4 != 0\n",
+ cmd->u.surface_create.stride);
+ return 1;
+ }
+ if (cmd->type == QXL_SURFACE_CMD_CREATE) {
+ intptr_t surface_offset = (intptr_t)qxl_phys2virt(qxl,
+ cmd->u.surface_create.data,
+ MEMSLOT_GROUP_GUEST);
+ if (!surface_offset) {
+ qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE invalid data: %ld\n",
+ cmd->u.surface_create.data);
+ return 1;
+ }
+ }
+ return 0;
+}
+
/*
* keep track of some command state, for savevm/loadvm.
* called from spice server thread context only
@@ -446,27 +474,9 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext)
}
uint32_t id = le32_to_cpu(cmd->surface_id);
- if (id >= qxl->ssd.num_surfaces) {
- qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE id %d >= %d", id,
- qxl->ssd.num_surfaces);
+ if (!verify_surface_cmd(qxl, cmd)) {
return 1;
}
- if (cmd->type == QXL_SURFACE_CMD_CREATE &&
- (cmd->u.surface_create.stride & 0x03) != 0) {
- qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE stride = %d %% 4 != 0\n",
- cmd->u.surface_create.stride);
- return 1;
- }
- if (cmd->type == QXL_SURFACE_CMD_CREATE) {
- intptr_t surface_offset = (intptr_t)qxl_phys2virt(qxl,
- cmd->u.surface_create.data,
- MEMSLOT_GROUP_GUEST);
- if (!surface_offset) {
- qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE invalid data: %ld\n",
- cmd->u.surface_create.data);
- return 1;
- }
- }
qemu_mutex_lock(&qxl->track_lock);
if (cmd->type == QXL_SURFACE_CMD_CREATE) {
qxl->guest_surfaces.cmds[id] = ext->cmd.data;
Signed-off-by: Alon Levy <alevy@redhat.com> --- hw/qxl.c | 48 +++++++++++++++++++++++++++++------------------- 1 file changed, 29 insertions(+), 19 deletions(-)