debian/patches/extra/CVE-2016-10155-watchdog-6300esb-add-exit-function.patch

   1 From a8341ea109259c17ad18b02597e5e03e99db60ae Mon Sep 17 00:00:00 2001
   2 From: Li Qiang <liqiang6-s@360.cn>
   3 Date: Mon, 28 Nov 2016 17:49:04 -0800
   4 Subject: [PATCH 1/8] watchdog: 6300esb: add exit function
   5
   6 When the Intel 6300ESB watchdog is hot unplug. The timer allocated
   7 in realize isn't freed thus leaking memory leak. This patch avoid
   8 this through adding the exit function.
   9
  10 Signed-off-by: Li Qiang <liqiang6-s@360.cn>
  11 Message-Id: <583cde9c.3223ed0a.7f0c2.886e@mx.google.com>
  12 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  13 ---
  14
  15 Notes:
  16     CVE-2016-10155
  17
  18  hw/watchdog/wdt_i6300esb.c | 9 +++++++++
  19  1 file changed, 9 insertions(+)
  20
  21 diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
  22 index a83d951..49b3cd1 100644
  23 --- a/hw/watchdog/wdt_i6300esb.c
  24 +++ b/hw/watchdog/wdt_i6300esb.c
  25 @@ -428,6 +428,14 @@ static void i6300esb_realize(PCIDevice *dev, Error **errp)
  26      /* qemu_register_coalesced_mmio (addr, 0x10); ? */
  27  }
  28
  29 +static void i6300esb_exit(PCIDevice *dev)
  30 +{
  31 +    I6300State *d = WATCHDOG_I6300ESB_DEVICE(dev);
  32 +
  33 +    timer_del(d->timer);
  34 +    timer_free(d->timer);
  35 +}
  36 +
  37  static WatchdogTimerModel model = {
  38      .wdt_name = "i6300esb",
  39      .wdt_description = "Intel 6300ESB",
  40 @@ -441,6 +449,7 @@ static void i6300esb_class_init(ObjectClass *klass, void *data)
  41      k->config_read = i6300esb_config_read;
  42      k->config_write = i6300esb_config_write;
  43      k->realize = i6300esb_realize;
  44 +    k->exit = i6300esb_exit;
  45      k->vendor_id = PCI_VENDOR_ID_INTEL;
  46      k->device_id = PCI_DEVICE_ID_INTEL_ESB_9;
  47      k->class_id = PCI_CLASS_SYSTEM_OTHER;
  48 --
  49 2.1.4
  50