Files
Mark Johnston 00ec12d48c bhyve: Fix handling of framebuffer resizing
The rfb code maintains an array of CRCs for 32x32 tiles in the
framebuffer.  This array is sized statically based on the rfb code's
notion of the maximum framebuffer size, which changed in commit
fb51ddb20d without updating the rfb code.

Morever, writes to the framebuffer BAR can modify the recorded height
and width of the framebuffer.  These values were not validated against
the maximum at all, unlike the parameters set via bhyve config.

Fix these problems:
- Define the maximum width and height in a shared header file so that
  they do not get out of sync again.
- In pci_fbuf_render(), don't resize the console if the new dimensions
  are too large.
- Add a mutex to synchronize framebuffer BAR I/O with the rfb thread.

Approved by:	so
Security:	FreeBSD-SA-26:72.bhyve
Security:	CVE-2026-101311
Fixes:		fb51ddb20d ("bhyve: increase fbuf display resolution limit")
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D60680
2026-10-13 23:16:51 +00:00
..
…
2025-12-18 17:51:14 -05:00
2025-02-26 20:14:37 -05:00
2025-10-16 14:08:40 +07:00
2024-11-25 16:33:46 -05:00
2025-12-18 17:49:14 -05:00
2025-10-16 14:08:40 +07:00
2024-11-04 12:16:22 -04:00
2025-09-11 11:09:59 -04:00
2025-02-19 21:34:42 -05:00
2025-11-24 07:00:23 +01:00
2026-01-15 19:49:00 +00:00
2024-12-27 10:40:05 -05:00
2025-04-06 18:04:12 +00:00
2024-12-27 10:40:05 -05:00
2024-01-31 09:16:23 -05:00
2024-08-01 10:55:29 -04:00
2025-10-16 14:08:40 +07:00
2025-10-16 14:08:40 +07:00
…
2024-11-12 08:40:05 -05:00
…
2025-11-19 11:19:07 +00:00
2025-07-19 02:03:53 +01:00
…
2025-07-19 02:03:53 +01:00
2024-05-14 08:58:40 +02:00
…
2025-10-16 14:08:40 +07:00
2025-05-22 20:24:28 +02:00
…
2025-08-22 22:44:42 +01:00
2024-10-07 15:32:06 -03:00
2024-08-10 12:21:51 +02:00
2025-07-04 14:20:02 -04:00
2025-12-16 22:22:12 +07:00
…
…
…
…
…
…
2025-05-12 16:08:34 +02:00