diff options
Diffstat (limited to 'app-emulation/qemu/files/qemu-2.5.0-rng-stack-corrupt-1.patch')
| -rw-r--r-- | app-emulation/qemu/files/qemu-2.5.0-rng-stack-corrupt-1.patch | 135 |
1 files changed, 135 insertions, 0 deletions
diff --git a/app-emulation/qemu/files/qemu-2.5.0-rng-stack-corrupt-1.patch b/app-emulation/qemu/files/qemu-2.5.0-rng-stack-corrupt-1.patch new file mode 100644 index 000000000000..44ba8a7d7f4d --- /dev/null +++ b/app-emulation/qemu/files/qemu-2.5.0-rng-stack-corrupt-1.patch @@ -0,0 +1,135 @@ +From 74074e8a7c60592cf1cc6469dbc2550d24aeded3 Mon Sep 17 00:00:00 2001 +From: Ladi Prosek <lprosek@redhat.com> +Date: Thu, 3 Mar 2016 09:37:16 +0100 +Subject: [PATCH] rng: move request queue from RngEgd to RngBackend + +The 'requests' field now lives in the RngBackend parent class. +There are no functional changes in this commit. + +Signed-off-by: Ladi Prosek <lprosek@redhat.com> +Reviewed-by: Amit Shah <amit.shah@redhat.com> +Message-Id: <1456994238-9585-3-git-send-email-lprosek@redhat.com> +Signed-off-by: Amit Shah <amit.shah@redhat.com> +--- + backends/rng-egd.c | 28 +++++++++------------------- + include/sysemu/rng.h | 11 +++++++++++ + 2 files changed, 20 insertions(+), 19 deletions(-) + +diff --git a/backends/rng-egd.c b/backends/rng-egd.c +index 0b2976a..b061362 100644 +--- a/backends/rng-egd.c ++++ b/backends/rng-egd.c +@@ -25,19 +25,8 @@ typedef struct RngEgd + + CharDriverState *chr; + char *chr_name; +- +- GSList *requests; + } RngEgd; + +-typedef struct RngRequest +-{ +- EntropyReceiveFunc *receive_entropy; +- uint8_t *data; +- void *opaque; +- size_t offset; +- size_t size; +-} RngRequest; +- + static void rng_egd_request_entropy(RngBackend *b, size_t size, + EntropyReceiveFunc *receive_entropy, + void *opaque) +@@ -66,7 +55,7 @@ static void rng_egd_request_entropy(RngBackend *b, size_t size, + size -= len; + } + +- s->requests = g_slist_append(s->requests, req); ++ s->parent.requests = g_slist_append(s->parent.requests, req); + } + + static void rng_egd_free_request(RngRequest *req) +@@ -81,7 +70,7 @@ static int rng_egd_chr_can_read(void *opaque) + GSList *i; + int size = 0; + +- for (i = s->requests; i; i = i->next) { ++ for (i = s->parent.requests; i; i = i->next) { + RngRequest *req = i->data; + size += req->size - req->offset; + } +@@ -94,8 +83,8 @@ static void rng_egd_chr_read(void *opaque, const uint8_t *buf, int size) + RngEgd *s = RNG_EGD(opaque); + size_t buf_offset = 0; + +- while (size > 0 && s->requests) { +- RngRequest *req = s->requests->data; ++ while (size > 0 && s->parent.requests) { ++ RngRequest *req = s->parent.requests->data; + int len = MIN(size, req->size - req->offset); + + memcpy(req->data + req->offset, buf + buf_offset, len); +@@ -104,7 +93,8 @@ static void rng_egd_chr_read(void *opaque, const uint8_t *buf, int size) + size -= len; + + if (req->offset == req->size) { +- s->requests = g_slist_remove_link(s->requests, s->requests); ++ s->parent.requests = g_slist_remove_link(s->parent.requests, ++ s->parent.requests); + + req->receive_entropy(req->opaque, req->data, req->size); + +@@ -117,12 +107,12 @@ static void rng_egd_free_requests(RngEgd *s) + { + GSList *i; + +- for (i = s->requests; i; i = i->next) { ++ for (i = s->parent.requests; i; i = i->next) { + rng_egd_free_request(i->data); + } + +- g_slist_free(s->requests); +- s->requests = NULL; ++ g_slist_free(s->parent.requests); ++ s->parent.requests = NULL; + } + + static void rng_egd_opened(RngBackend *b, Error **errp) +diff --git a/include/sysemu/rng.h b/include/sysemu/rng.h +index 87b3ebe..c744d82 100644 +--- a/include/sysemu/rng.h ++++ b/include/sysemu/rng.h +@@ -24,6 +24,7 @@ + #define RNG_BACKEND_CLASS(klass) \ + OBJECT_CLASS_CHECK(RngBackendClass, (klass), TYPE_RNG_BACKEND) + ++typedef struct RngRequest RngRequest; + typedef struct RngBackendClass RngBackendClass; + typedef struct RngBackend RngBackend; + +@@ -31,6 +32,15 @@ typedef void (EntropyReceiveFunc)(void *opaque, + const void *data, + size_t size); + ++struct RngRequest ++{ ++ EntropyReceiveFunc *receive_entropy; ++ uint8_t *data; ++ void *opaque; ++ size_t offset; ++ size_t size; ++}; ++ + struct RngBackendClass + { + ObjectClass parent_class; +@@ -47,6 +57,7 @@ struct RngBackend + + /*< protected >*/ + bool opened; ++ GSList *requests; + }; + + /** +-- +2.7.4 + |