commit 53db932604dfa7bb9241d132e0173894cf54261c
author Peter Maydell <peter.maydell@linaro.org> Mon May 09 13:42:25 2016 +0100
committer Peter Maydell <peter.maydell@linaro.org> Mon May 09 13:42:25 2016 +0100
tree e1c9e10a7d4db068afb8d39707f66a40340f050c
parent 975eb6a547f809608ccb08c221552f666611af25
parent fd3c136b3e1482cd0ec7285d6bc2a3e6a62c38d7

Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20160509-1' into staging

vga security fixes (CVE-2016-3710, CVE-2016-3712)

# gpg: Signature made Mon 09 May 2016 13:39:30 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-vga-20160509-1:
  vga: make sure vga register setup for vbe stays intact (CVE-2016-3712).
  vga: update vga register setup on vbe changes
  vga: factor out vga register setup
  vga: add vbe_enabled() helper
  vga: fix banked access bounds checking (CVE-2016-3710)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

VERSION

diff --git a/VERSION b/VERSION
index 127ee42..7ff039e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.5.93
+2.5.94

hw/acpi/core.c

diff --git a/hw/acpi/core.c b/hw/acpi/core.c
index 7925a1a..6a2f452 100644
--- a/hw/acpi/core.c
+++ b/hw/acpi/core.c
@@ -536,7 +536,6 @@
     ar->tmr.timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, acpi_pm_tmr_timer, ar);
     memory_region_init_io(&ar->tmr.io, memory_region_owner(parent),
                           &acpi_pm_tmr_ops, ar, "acpi-tmr", 4);
-    memory_region_clear_global_locking(&ar->tmr.io);
     memory_region_add_subregion(parent, 8, &ar->tmr.io);
 }