From 8ec1415935ff4214ef9b47448ff7ac52cfa8b77e Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Mon, 13 Jul 2020 14:45:20 +0200 Subject: [PATCH 1/2] vfio: fix use-after-free in display Calling ramfb_display_update() might replace the DisplaySurface with the boot display, which in turn will free the currently active DisplaySurface. So clear our DisplaySurface pinter (dpy->region.surface pointer) to (a) avoid use-after-free and (b) force replacing the boot display with the real display when switching back. Signed-off-by: Gerd Hoffmann Reviewed-by: Alex Williamson Acked-by: Alex Williamson Message-id: 20200713124520.23266-1-kraxel@redhat.com --- hw/vfio/display.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/vfio/display.c b/hw/vfio/display.c index a57a22674d..342054193b 100644 --- a/hw/vfio/display.c +++ b/hw/vfio/display.c @@ -405,6 +405,7 @@ static void vfio_display_region_update(void *opaque) if (!plane.drm_format || !plane.size) { if (dpy->ramfb) { ramfb_display_update(dpy->con, dpy->ramfb); + dpy->region.surface = NULL; } return; } From 4084e35068772cf4f81bbae5174019f277c61084 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Mon, 13 Jul 2020 08:27:12 +0200 Subject: [PATCH 2/2] usb: fix storage regression Fix the contition to figure whenever we need to wait for more data or not. Simply check the mode, if we are not in DATAIN state any more we are done already and don't need to go ASYNC. Fixes: 7ad3d51ebb8a ("usb: add short-packet handling to usb-storage driver") Reported-by: Sai Pavan Boddu Tested-by: Paul Zimmerman Signed-off-by: Gerd Hoffmann Message-id: 20200713062712.1476-1-kraxel@redhat.com --- hw/usb/dev-storage.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c index 2ed6a8df24..405a4ccfe7 100644 --- a/hw/usb/dev-storage.c +++ b/hw/usb/dev-storage.c @@ -546,8 +546,7 @@ static void usb_msd_handle_data(USBDevice *dev, USBPacket *p) } } } - if (p->actual_length < p->iov.size && (p->short_not_ok || - s->scsi_len >= p->ep->max_packet_size)) { + if (p->actual_length < p->iov.size && s->mode == USB_MSDM_DATAIN) { DPRINTF("Deferring packet %p [wait data-in]\n", p); s->packet = p; p->status = USB_RET_ASYNC;