File xsa463-06.patch of Package xen.36362

Overview Repositories Revisions Requests Users Attributes Meta

File xsa463-06.patch of Package xen.36362

From: Jan Beulich <jbeulich@suse.com>
Subject: x86/HVM: drop stdvga's "sr[]" struct member

No consumers are left, hence the producer and the array itself can also
go away. The static sr_mask[] is then orphaned and hence needs dropping,
too.

This is part of XSA-463 / CVE-2024-45818

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
(cherry picked from commit 7aba44bdd78aedb97703811948c3b69ccff85032)

--- a/xen/arch/x86/hvm/stdvga.c
+++ b/xen/arch/x86/hvm/stdvga.c
@@ -38,18 +38,6 @@
 #define VGA_MEM_BASE 0xa0000
 #define VGA_MEM_SIZE 0x20000
 
-/* force some bits to zero */
-static const uint8_t sr_mask[8] = {
-    (uint8_t)~0xfc,
-    (uint8_t)~0xc2,
-    (uint8_t)~0xf0,
-    (uint8_t)~0xc0,
-    (uint8_t)~0xf1,
-    (uint8_t)~0xff,
-    (uint8_t)~0xff,
-    (uint8_t)~0x00,
-};
-
 static int stdvga_outb(uint64_t addr, uint8_t val)
 {
     struct hvm_hw_stdvga *s = &current->domain->arch.hvm.stdvga;
@@ -61,12 +49,6 @@ static int stdvga_outb(uint64_t addr, ui
         s->sr_index = val;
         break;
 
-    case 0x3c5:                 /* sequencer data register */
-        rc = (s->sr_index < sizeof(s->sr));
-        if ( rc )
-            s->sr[s->sr_index] = val & sr_mask[s->sr_index] ;
-        break;
-
     case 0x3ce:                 /* graphics address register */
         s->gr_index = val;
         break;
--- a/xen/include/asm-x86/hvm/io.h
+++ b/xen/include/asm-x86/hvm/io.h
@@ -139,7 +139,6 @@ struct vpci_arch_msix_entry {
 
 struct hvm_hw_stdvga {
     uint8_t sr_index;
-    uint8_t sr[8];
     uint8_t gr_index;
     struct page_info *vram_page[64];  /* shadow of 0xa0000-0xaffff */
     spinlock_t lock;

Places

File xsa463-06.patch of Package xen.36362

Places