diff options
author | Markus Volk <f_l_k@t-online.de> | 2022-09-21 18:39:22 +0200 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-09-22 21:39:21 +0100 |
commit | 6f96993e8018b8d70473b44878b4f749b9063530 (patch) | |
tree | eb415bead99f7c8199ed290c435b4dc7f9c3b829 | |
parent | dfdf55a43973e5b7329e50bd09a93c80434ce636 (diff) | |
download | poky-6f96993e8018b8d70473b44878b4f749b9063530.tar.gz |
virglrenderer: upgrade 0.9.1 -> 0.10.3
(From OE-Core rev: 6e277bc261fec36bd264246e2b5fbccd6570b520)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
5 files changed, 39 insertions, 254 deletions
diff --git a/meta/recipes-graphics/virglrenderer/virglrenderer/0001-meson.build-use-python3-directly-for-python.patch b/meta/recipes-graphics/virglrenderer/virglrenderer/0001-meson.build-use-python3-directly-for-python.patch index 0fd1d511d6..8230ba588b 100644 --- a/meta/recipes-graphics/virglrenderer/virglrenderer/0001-meson.build-use-python3-directly-for-python.patch +++ b/meta/recipes-graphics/virglrenderer/virglrenderer/0001-meson.build-use-python3-directly-for-python.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 63788c63ed39a3ce9994f4315d8997e1a9300d4d Mon Sep 17 00:00:00 2001 | 1 | From c853c9e5c44f1b23a15a7ba629ee02f7d8ec23a0 Mon Sep 17 00:00:00 2001 |
2 | From: Alexander Kanavin <alex.kanavin@gmail.com> | 2 | From: Alexander Kanavin <alex.kanavin@gmail.com> |
3 | Date: Mon, 6 Jan 2020 12:44:42 +0100 | 3 | Date: Mon, 6 Jan 2020 12:44:42 +0100 |
4 | Subject: [PATCH] meson.build: use 'python3' directly for python | 4 | Subject: [PATCH] meson.build: use 'python3' directly for python |
@@ -8,17 +8,18 @@ its configuration). | |||
8 | 8 | ||
9 | Upstream-Status: Inappropriate [oe-core specific] | 9 | Upstream-Status: Inappropriate [oe-core specific] |
10 | Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> | 10 | Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> |
11 | |||
11 | --- | 12 | --- |
12 | meson.build | 2 +- | 13 | meson.build | 2 +- |
13 | 1 file changed, 1 insertion(+), 1 deletion(-) | 14 | 1 file changed, 1 insertion(+), 1 deletion(-) |
14 | 15 | ||
15 | diff --git a/meson.build b/meson.build | 16 | diff --git a/meson.build b/meson.build |
16 | index 682d7c8..19d2eae 100644 | 17 | index 13d95bb..b241eb2 100644 |
17 | --- a/meson.build | 18 | --- a/meson.build |
18 | +++ b/meson.build | 19 | +++ b/meson.build |
19 | @@ -60,7 +60,7 @@ foreach w : warnings | 20 | @@ -64,7 +64,7 @@ flags = [ |
20 | endif | 21 | |
21 | endforeach | 22 | add_project_arguments(cc.get_supported_arguments(flags), language : 'c') |
22 | 23 | ||
23 | -prog_python = import('python').find_installation('python3') | 24 | -prog_python = import('python').find_installation('python3') |
24 | +prog_python = 'python3' | 25 | +prog_python = 'python3' |
diff --git a/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch b/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch deleted file mode 100644 index ae42dc8f6c..0000000000 --- a/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch +++ /dev/null | |||
@@ -1,117 +0,0 @@ | |||
1 | From 63aee871365f9c9e7fa9125672302a0fb250d34d Mon Sep 17 00:00:00 2001 | ||
2 | From: Gert Wollny <gert.wollny@collabora.com> | ||
3 | Date: Tue, 30 Nov 2021 09:16:24 +0100 | ||
4 | Subject: [PATCH 2/2] vrend: propperly check whether the shader image range is | ||
5 | correct | ||
6 | |||
7 | Also add a test to check the integer underflow. | ||
8 | |||
9 | Closes: #251 | ||
10 | Signed-off-by: Gert Wollny <gert.wollny@collabora.com> | ||
11 | Reviewed-by: Chia-I Wu <olvaffe@gmail.com> | ||
12 | |||
13 | cherry-pick from anongit.freedesktop.org/virglrenderer | ||
14 | commit 2aed5d4... | ||
15 | |||
16 | CVE: CVE-2022-0135 | ||
17 | Upstream-Status: Backport | ||
18 | Signed-off-by: Joe Slater <joe.slater@windriver.com> | ||
19 | |||
20 | --- | ||
21 | src/vrend_decode.c | 3 +- | ||
22 | tests/test_fuzzer_formats.c | 57 +++++++++++++++++++++++++++++++++++++ | ||
23 | 2 files changed, 59 insertions(+), 1 deletion(-) | ||
24 | |||
25 | diff --git a/src/vrend_decode.c b/src/vrend_decode.c | ||
26 | index 91f5f24..6771b10 100644 | ||
27 | --- a/src/vrend_decode.c | ||
28 | +++ b/src/vrend_decode.c | ||
29 | @@ -1249,8 +1249,9 @@ static int vrend_decode_set_shader_images(struct vrend_context *ctx, const uint3 | ||
30 | if (num_images < 1) { | ||
31 | return 0; | ||
32 | } | ||
33 | + | ||
34 | if (start_slot > PIPE_MAX_SHADER_IMAGES || | ||
35 | - start_slot > PIPE_MAX_SHADER_IMAGES - num_images) | ||
36 | + start_slot + num_images > PIPE_MAX_SHADER_IMAGES) | ||
37 | return EINVAL; | ||
38 | |||
39 | for (uint32_t i = 0; i < num_images; i++) { | ||
40 | diff --git a/tests/test_fuzzer_formats.c b/tests/test_fuzzer_formats.c | ||
41 | index 154a2e5..e32caf0 100644 | ||
42 | --- a/tests/test_fuzzer_formats.c | ||
43 | +++ b/tests/test_fuzzer_formats.c | ||
44 | @@ -958,6 +958,61 @@ static void test_vrend_set_signle_abo_heap_overflow() { | ||
45 | virgl_renderer_submit_cmd((void *) cmd, ctx_id, 0xde); | ||
46 | } | ||
47 | |||
48 | +static void test_vrend_set_shader_images_overflow() | ||
49 | +{ | ||
50 | + uint32_t num_shaders = PIPE_MAX_SHADER_IMAGES + 1; | ||
51 | + uint32_t size = num_shaders * VIRGL_SET_SHADER_IMAGE_ELEMENT_SIZE + 3; | ||
52 | + uint32_t cmd[size]; | ||
53 | + int i = 0; | ||
54 | + cmd[i++] = ((size - 1)<< 16) | 0 << 8 | VIRGL_CCMD_SET_SHADER_IMAGES; | ||
55 | + cmd[i++] = PIPE_SHADER_FRAGMENT; | ||
56 | + memset(&cmd[i], 0, size - i); | ||
57 | + | ||
58 | + virgl_renderer_submit_cmd((void *) cmd, ctx_id, size); | ||
59 | +} | ||
60 | + | ||
61 | +/* Test adapted from yaojun8558363@gmail.com: | ||
62 | + * https://gitlab.freedesktop.org/virgl/virglrenderer/-/issues/250 | ||
63 | +*/ | ||
64 | +static void test_vrend_3d_resource_overflow() { | ||
65 | + | ||
66 | + struct virgl_renderer_resource_create_args resource; | ||
67 | + resource.handle = 0x4c474572; | ||
68 | + resource.target = PIPE_TEXTURE_2D_ARRAY; | ||
69 | + resource.format = VIRGL_FORMAT_Z24X8_UNORM; | ||
70 | + resource.nr_samples = 2; | ||
71 | + resource.last_level = 0; | ||
72 | + resource.array_size = 3; | ||
73 | + resource.bind = VIRGL_BIND_SAMPLER_VIEW; | ||
74 | + resource.depth = 1; | ||
75 | + resource.width = 8; | ||
76 | + resource.height = 4; | ||
77 | + resource.flags = 0; | ||
78 | + | ||
79 | + virgl_renderer_resource_create(&resource, NULL, 0); | ||
80 | + virgl_renderer_ctx_attach_resource(ctx_id, resource.handle); | ||
81 | + | ||
82 | + uint32_t size = 0x400; | ||
83 | + uint32_t cmd[size]; | ||
84 | + int i = 0; | ||
85 | + cmd[i++] = (size - 1) << 16 | 0 << 8 | VIRGL_CCMD_RESOURCE_INLINE_WRITE; | ||
86 | + cmd[i++] = resource.handle; | ||
87 | + cmd[i++] = 0; // level | ||
88 | + cmd[i++] = 0; // usage | ||
89 | + cmd[i++] = 0; // stride | ||
90 | + cmd[i++] = 0; // layer_stride | ||
91 | + cmd[i++] = 0; // x | ||
92 | + cmd[i++] = 0; // y | ||
93 | + cmd[i++] = 0; // z | ||
94 | + cmd[i++] = 8; // w | ||
95 | + cmd[i++] = 4; // h | ||
96 | + cmd[i++] = 3; // d | ||
97 | + memset(&cmd[i], 0, size - i); | ||
98 | + | ||
99 | + virgl_renderer_submit_cmd((void *) cmd, ctx_id, size); | ||
100 | +} | ||
101 | + | ||
102 | + | ||
103 | int main() | ||
104 | { | ||
105 | initialize_environment(); | ||
106 | @@ -980,6 +1035,8 @@ int main() | ||
107 | test_cs_nullpointer_deference(); | ||
108 | test_vrend_set_signle_abo_heap_overflow(); | ||
109 | |||
110 | + test_vrend_set_shader_images_overflow(); | ||
111 | + test_vrend_3d_resource_overflow(); | ||
112 | |||
113 | virgl_renderer_context_destroy(ctx_id); | ||
114 | virgl_renderer_cleanup(&cookie); | ||
115 | -- | ||
116 | 2.25.1 | ||
117 | |||
diff --git a/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0175.patch b/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0175.patch deleted file mode 100644 index 7fbab75091..0000000000 --- a/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0175.patch +++ /dev/null | |||
@@ -1,107 +0,0 @@ | |||
1 | From 5ca7aca001092c557f0b6fc1ba3db7dcdab860b7 Mon Sep 17 00:00:00 2001 | ||
2 | From: Gert Wollny <gert.wollny@collabora.com> | ||
3 | Date: Tue, 30 Nov 2021 09:29:42 +0100 | ||
4 | Subject: [PATCH 1/2] vrend: clear memory when allocating a host-backed memory | ||
5 | resource | ||
6 | |||
7 | Closes: #249 | ||
8 | Signed-off-by: Gert Wollny <gert.wollny@collabora.com> | ||
9 | Reviewed-by: Chia-I Wu <olvaffe@gmail.com> | ||
10 | |||
11 | cherry-pick from anongit.freedesktop.org/virglrenderer | ||
12 | commit b05bb61... | ||
13 | |||
14 | CVE: CVE-2022-0175 | ||
15 | Upstream-Status: Backport | ||
16 | Signed-off-by: Joe Slater <joe.slater@windriver.com> | ||
17 | |||
18 | --- | ||
19 | src/vrend_renderer.c | 2 +- | ||
20 | tests/test_virgl_transfer.c | 51 +++++++++++++++++++++++++++++++++++++ | ||
21 | 2 files changed, 52 insertions(+), 1 deletion(-) | ||
22 | |||
23 | diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c | ||
24 | index b8b2a36..2650cf2 100644 | ||
25 | --- a/src/vrend_renderer.c | ||
26 | +++ b/src/vrend_renderer.c | ||
27 | @@ -6788,7 +6788,7 @@ vrend_resource_alloc_buffer(struct vrend_resource *gr, uint32_t flags) | ||
28 | if (bind == VIRGL_BIND_CUSTOM) { | ||
29 | /* use iovec directly when attached */ | ||
30 | gr->storage_bits |= VREND_STORAGE_HOST_SYSTEM_MEMORY; | ||
31 | - gr->ptr = malloc(size); | ||
32 | + gr->ptr = calloc(1, size); | ||
33 | if (!gr->ptr) | ||
34 | return -ENOMEM; | ||
35 | } else if (bind == VIRGL_BIND_STAGING) { | ||
36 | diff --git a/tests/test_virgl_transfer.c b/tests/test_virgl_transfer.c | ||
37 | index bf7f438..3c53c3d 100644 | ||
38 | --- a/tests/test_virgl_transfer.c | ||
39 | +++ b/tests/test_virgl_transfer.c | ||
40 | @@ -952,6 +952,56 @@ START_TEST(virgl_test_transfer_near_res_bounds_with_stride_succeeds) | ||
41 | } | ||
42 | END_TEST | ||
43 | |||
44 | +START_TEST(test_vrend_host_backed_memory_no_data_leak) | ||
45 | +{ | ||
46 | + struct iovec iovs[1]; | ||
47 | + int niovs = 1; | ||
48 | + | ||
49 | + struct virgl_context ctx = {0}; | ||
50 | + | ||
51 | + int ret = testvirgl_init_ctx_cmdbuf(&ctx); | ||
52 | + | ||
53 | + struct virgl_renderer_resource_create_args res; | ||
54 | + res.handle = 0x400; | ||
55 | + res.target = PIPE_BUFFER; | ||
56 | + res.format = VIRGL_FORMAT_R8_UNORM; | ||
57 | + res.nr_samples = 0; | ||
58 | + res.last_level = 0; | ||
59 | + res.array_size = 1; | ||
60 | + res.bind = VIRGL_BIND_CUSTOM; | ||
61 | + res.depth = 1; | ||
62 | + res.width = 32; | ||
63 | + res.height = 1; | ||
64 | + res.flags = 0; | ||
65 | + | ||
66 | + uint32_t size = 32; | ||
67 | + uint8_t* data = calloc(1, size); | ||
68 | + memset(data, 1, 32); | ||
69 | + iovs[0].iov_base = data; | ||
70 | + iovs[0].iov_len = size; | ||
71 | + | ||
72 | + struct pipe_box box = {0,0,0, size, 1,1}; | ||
73 | + | ||
74 | + virgl_renderer_resource_create(&res, NULL, 0); | ||
75 | + virgl_renderer_ctx_attach_resource(ctx.ctx_id, res.handle); | ||
76 | + | ||
77 | + ret = virgl_renderer_transfer_read_iov(res.handle, ctx.ctx_id, 0, 0, 0, | ||
78 | + (struct virgl_box *)&box, 0, iovs, niovs); | ||
79 | + | ||
80 | + ck_assert_int_eq(ret, 0); | ||
81 | + | ||
82 | + for (int i = 0; i < 32; ++i) | ||
83 | + ck_assert_int_eq(data[i], 0); | ||
84 | + | ||
85 | + virgl_renderer_ctx_detach_resource(1, res.handle); | ||
86 | + | ||
87 | + virgl_renderer_resource_unref(res.handle); | ||
88 | + free(data); | ||
89 | + | ||
90 | +} | ||
91 | +END_TEST | ||
92 | + | ||
93 | + | ||
94 | static Suite *virgl_init_suite(void) | ||
95 | { | ||
96 | Suite *s; | ||
97 | @@ -981,6 +1031,7 @@ static Suite *virgl_init_suite(void) | ||
98 | tcase_add_test(tc_core, virgl_test_transfer_buffer_bad_strides); | ||
99 | tcase_add_test(tc_core, virgl_test_transfer_2d_array_bad_layer_stride); | ||
100 | tcase_add_test(tc_core, virgl_test_transfer_2d_bad_level); | ||
101 | + tcase_add_test(tc_core, test_vrend_host_backed_memory_no_data_leak); | ||
102 | |||
103 | tcase_add_loop_test(tc_core, virgl_test_transfer_res_read_valid, 0, PIPE_MAX_TEXTURE_TYPES); | ||
104 | tcase_add_loop_test(tc_core, virgl_test_transfer_res_write_valid, 0, PIPE_MAX_TEXTURE_TYPES); | ||
105 | -- | ||
106 | 2.25.1 | ||
107 | |||
diff --git a/meta/recipes-graphics/virglrenderer/virglrenderer_0.10.3.bb b/meta/recipes-graphics/virglrenderer/virglrenderer_0.10.3.bb new file mode 100644 index 0000000000..567c62b570 --- /dev/null +++ b/meta/recipes-graphics/virglrenderer/virglrenderer_0.10.3.bb | |||
@@ -0,0 +1,33 @@ | |||
1 | SUMMARY = "VirGL virtual OpenGL renderer" | ||
2 | DESCRIPTION = "Virgil is a research project to investigate the possibility of \ | ||
3 | creating a virtual 3D GPU for use inside qemu virtual machines, that allows \ | ||
4 | the guest operating system to use the capabilities of the host GPU to \ | ||
5 | accelerate 3D rendering." | ||
6 | HOMEPAGE = "https://virgil3d.github.io/" | ||
7 | |||
8 | LICENSE = "MIT" | ||
9 | LIC_FILES_CHKSUM = "file://COPYING;md5=c81c08eeefd9418fca8f88309a76db10" | ||
10 | |||
11 | DEPENDS = "libdrm libepoxy virtual/egl virtual/libgbm" | ||
12 | SRCREV = "0922041ec6730122e0fec11404e6859e2efc4bc0" | ||
13 | SRC_URI = "git://gitlab.freedesktop.org/virgl/virglrenderer.git;branch=master \ | ||
14 | file://0001-meson.build-use-python3-directly-for-python.patch \ | ||
15 | " | ||
16 | |||
17 | S = "${WORKDIR}/git" | ||
18 | |||
19 | inherit meson pkgconfig features_check | ||
20 | |||
21 | PACKAGECONFIG ?= "${@bb.utils.contains('DISTRO_FEATURES', 'vulkan', 'venus-experimental', '', d)}" | ||
22 | |||
23 | PACKAGECONFIG[venus-experimental] = "-Dvenus-experimental=true,-Dvenus-experimental=false,vulkan-loader vulkan-headers" | ||
24 | PACKAGECONFIG[va] = "-Dvideo=true,-Dvideo=false,libva" | ||
25 | PACKAGECONFIG[render-server] = "-Drender-server=true,-Drender-server=false" | ||
26 | PACKAGECONFIG[drm-msm-experimental] = "-Ddrm-msm-experimental=true,-Ddrm-msm-experimental=false" | ||
27 | PACKAGECONFIG[minigbm_allocation] = "-Dminigbm_allocation=true,-Dminigbm_allocation=false" | ||
28 | PACKAGECONFIG[venus-validate] = "-Dvenus-validate=true,-Dvenus-validate=false" | ||
29 | PACKAGECONFIG[tests] = "-Dtests=true,-Dtests=false,libcheck" | ||
30 | |||
31 | BBCLASSEXTEND = "native nativesdk" | ||
32 | |||
33 | REQUIRED_DISTRO_FEATURES = "opengl" | ||
diff --git a/meta/recipes-graphics/virglrenderer/virglrenderer_0.9.1.bb b/meta/recipes-graphics/virglrenderer/virglrenderer_0.9.1.bb deleted file mode 100644 index ad3688e300..0000000000 --- a/meta/recipes-graphics/virglrenderer/virglrenderer_0.9.1.bb +++ /dev/null | |||
@@ -1,25 +0,0 @@ | |||
1 | SUMMARY = "VirGL virtual OpenGL renderer" | ||
2 | DESCRIPTION = "Virgil is a research project to investigate the possibility of \ | ||
3 | creating a virtual 3D GPU for use inside qemu virtual machines, that allows \ | ||
4 | the guest operating system to use the capabilities of the host GPU to \ | ||
5 | accelerate 3D rendering." | ||
6 | HOMEPAGE = "https://virgil3d.github.io/" | ||
7 | |||
8 | LICENSE = "MIT" | ||
9 | LIC_FILES_CHKSUM = "file://COPYING;md5=c81c08eeefd9418fca8f88309a76db10" | ||
10 | |||
11 | DEPENDS = "libdrm virtual/egl virtual/libgbm libepoxy" | ||
12 | SRCREV = "363915595e05fb252e70d6514be2f0c0b5ca312b" | ||
13 | SRC_URI = "git://anongit.freedesktop.org/git/virglrenderer;branch=branch-0.9.1 \ | ||
14 | file://0001-meson.build-use-python3-directly-for-python.patch \ | ||
15 | file://cve-2022-0135.patch \ | ||
16 | file://cve-2022-0175.patch \ | ||
17 | " | ||
18 | |||
19 | S = "${WORKDIR}/git" | ||
20 | |||
21 | inherit meson pkgconfig features_check | ||
22 | |||
23 | BBCLASSEXTEND = "native nativesdk" | ||
24 | |||
25 | REQUIRED_DISTRO_FEATURES = "opengl" | ||