From 8ec1415935ff4214ef9b47448ff7ac52cfa8b77e Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Mon, 13 Jul 2020 14:45:20 +0200 Subject: vfio: fix use-after-free in display Calling ramfb_display_update() might replace the DisplaySurface with the boot display, which in turn will free the currently active DisplaySurface. So clear our DisplaySurface pinter (dpy->region.surface pointer) to (a) avoid use-after-free and (b) force replacing the boot display with the real display when switching back. Signed-off-by: Gerd Hoffmann Reviewed-by: Alex Williamson Acked-by: Alex Williamson Message-id: 20200713124520.23266-1-kraxel@redhat.com --- hw/vfio/display.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/vfio/display.c b/hw/vfio/display.c index a57a226..3420541 100644 --- a/hw/vfio/display.c +++ b/hw/vfio/display.c @@ -405,6 +405,7 @@ static void vfio_display_region_update(void *opaque) if (!plane.drm_format || !plane.size) { if (dpy->ramfb) { ramfb_display_update(dpy->con, dpy->ramfb); + dpy->region.surface = NULL; } return; } -- cgit v1.1 From 4084e35068772cf4f81bbae5174019f277c61084 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Mon, 13 Jul 2020 08:27:12 +0200 Subject: usb: fix storage regression Fix the contition to figure whenever we need to wait for more data or not. Simply check the mode, if we are not in DATAIN state any more we are done already and don't need to go ASYNC. Fixes: 7ad3d51ebb8a ("usb: add short-packet handling to usb-storage driver") Reported-by: Sai Pavan Boddu Tested-by: Paul Zimmerman Signed-off-by: Gerd Hoffmann Message-id: 20200713062712.1476-1-kraxel@redhat.com --- hw/usb/dev-storage.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c index 2ed6a8d..405a4cc 100644 --- a/hw/usb/dev-storage.c +++ b/hw/usb/dev-storage.c @@ -546,8 +546,7 @@ static void usb_msd_handle_data(USBDevice *dev, USBPacket *p) } } } - if (p->actual_length < p->iov.size && (p->short_not_ok || - s->scsi_len >= p->ep->max_packet_size)) { + if (p->actual_length < p->iov.size && s->mode == USB_MSDM_DATAIN) { DPRINTF("Deferring packet %p [wait data-in]\n", p); s->packet = p; p->status = USB_RET_ASYNC; -- cgit v1.1