summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMarkus Volk <f_l_k@t-online.de>2022-09-21 18:39:22 +0200
committerRichard Purdie <richard.purdie@linuxfoundation.org>2022-09-22 21:39:21 +0100
commit6f96993e8018b8d70473b44878b4f749b9063530 (patch)
treeeb415bead99f7c8199ed290c435b4dc7f9c3b829
parentdfdf55a43973e5b7329e50bd09a93c80434ce636 (diff)
downloadpoky-6f96993e8018b8d70473b44878b4f749b9063530.tar.gz
virglrenderer: upgrade 0.9.1 -> 0.10.3
(From OE-Core rev: 6e277bc261fec36bd264246e2b5fbccd6570b520) Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-graphics/virglrenderer/virglrenderer/0001-meson.build-use-python3-directly-for-python.patch11
-rw-r--r--meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch117
-rw-r--r--meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0175.patch107
-rw-r--r--meta/recipes-graphics/virglrenderer/virglrenderer_0.10.3.bb33
-rw-r--r--meta/recipes-graphics/virglrenderer/virglrenderer_0.9.1.bb25
5 files changed, 39 insertions, 254 deletions
diff --git a/meta/recipes-graphics/virglrenderer/virglrenderer/0001-meson.build-use-python3-directly-for-python.patch b/meta/recipes-graphics/virglrenderer/virglrenderer/0001-meson.build-use-python3-directly-for-python.patch
index 0fd1d511d6..8230ba588b 100644
--- a/meta/recipes-graphics/virglrenderer/virglrenderer/0001-meson.build-use-python3-directly-for-python.patch
+++ b/meta/recipes-graphics/virglrenderer/virglrenderer/0001-meson.build-use-python3-directly-for-python.patch
@@ -1,4 +1,4 @@
1From 63788c63ed39a3ce9994f4315d8997e1a9300d4d Mon Sep 17 00:00:00 2001 1From c853c9e5c44f1b23a15a7ba629ee02f7d8ec23a0 Mon Sep 17 00:00:00 2001
2From: Alexander Kanavin <alex.kanavin@gmail.com> 2From: Alexander Kanavin <alex.kanavin@gmail.com>
3Date: Mon, 6 Jan 2020 12:44:42 +0100 3Date: Mon, 6 Jan 2020 12:44:42 +0100
4Subject: [PATCH] meson.build: use 'python3' directly for python 4Subject: [PATCH] meson.build: use 'python3' directly for python
@@ -8,17 +8,18 @@ its configuration).
8 8
9Upstream-Status: Inappropriate [oe-core specific] 9Upstream-Status: Inappropriate [oe-core specific]
10Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> 10Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
11
11--- 12---
12 meson.build | 2 +- 13 meson.build | 2 +-
13 1 file changed, 1 insertion(+), 1 deletion(-) 14 1 file changed, 1 insertion(+), 1 deletion(-)
14 15
15diff --git a/meson.build b/meson.build 16diff --git a/meson.build b/meson.build
16index 682d7c8..19d2eae 100644 17index 13d95bb..b241eb2 100644
17--- a/meson.build 18--- a/meson.build
18+++ b/meson.build 19+++ b/meson.build
19@@ -60,7 +60,7 @@ foreach w : warnings 20@@ -64,7 +64,7 @@ flags = [
20 endif 21
21 endforeach 22 add_project_arguments(cc.get_supported_arguments(flags), language : 'c')
22 23
23-prog_python = import('python').find_installation('python3') 24-prog_python = import('python').find_installation('python3')
24+prog_python = 'python3' 25+prog_python = 'python3'
diff --git a/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch b/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch
deleted file mode 100644
index ae42dc8f6c..0000000000
--- a/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch
+++ /dev/null
@@ -1,117 +0,0 @@
1From 63aee871365f9c9e7fa9125672302a0fb250d34d Mon Sep 17 00:00:00 2001
2From: Gert Wollny <gert.wollny@collabora.com>
3Date: Tue, 30 Nov 2021 09:16:24 +0100
4Subject: [PATCH 2/2] vrend: propperly check whether the shader image range is
5 correct
6
7Also add a test to check the integer underflow.
8
9Closes: #251
10Signed-off-by: Gert Wollny <gert.wollny@collabora.com>
11Reviewed-by: Chia-I Wu <olvaffe@gmail.com>
12
13cherry-pick from anongit.freedesktop.org/virglrenderer
14commit 2aed5d4...
15
16CVE: CVE-2022-0135
17Upstream-Status: Backport
18Signed-off-by: Joe Slater <joe.slater@windriver.com>
19
20---
21 src/vrend_decode.c | 3 +-
22 tests/test_fuzzer_formats.c | 57 +++++++++++++++++++++++++++++++++++++
23 2 files changed, 59 insertions(+), 1 deletion(-)
24
25diff --git a/src/vrend_decode.c b/src/vrend_decode.c
26index 91f5f24..6771b10 100644
27--- a/src/vrend_decode.c
28+++ b/src/vrend_decode.c
29@@ -1249,8 +1249,9 @@ static int vrend_decode_set_shader_images(struct vrend_context *ctx, const uint3
30 if (num_images < 1) {
31 return 0;
32 }
33+
34 if (start_slot > PIPE_MAX_SHADER_IMAGES ||
35- start_slot > PIPE_MAX_SHADER_IMAGES - num_images)
36+ start_slot + num_images > PIPE_MAX_SHADER_IMAGES)
37 return EINVAL;
38
39 for (uint32_t i = 0; i < num_images; i++) {
40diff --git a/tests/test_fuzzer_formats.c b/tests/test_fuzzer_formats.c
41index 154a2e5..e32caf0 100644
42--- a/tests/test_fuzzer_formats.c
43+++ b/tests/test_fuzzer_formats.c
44@@ -958,6 +958,61 @@ static void test_vrend_set_signle_abo_heap_overflow() {
45 virgl_renderer_submit_cmd((void *) cmd, ctx_id, 0xde);
46 }
47
48+static void test_vrend_set_shader_images_overflow()
49+{
50+ uint32_t num_shaders = PIPE_MAX_SHADER_IMAGES + 1;
51+ uint32_t size = num_shaders * VIRGL_SET_SHADER_IMAGE_ELEMENT_SIZE + 3;
52+ uint32_t cmd[size];
53+ int i = 0;
54+ cmd[i++] = ((size - 1)<< 16) | 0 << 8 | VIRGL_CCMD_SET_SHADER_IMAGES;
55+ cmd[i++] = PIPE_SHADER_FRAGMENT;
56+ memset(&cmd[i], 0, size - i);
57+
58+ virgl_renderer_submit_cmd((void *) cmd, ctx_id, size);
59+}
60+
61+/* Test adapted from yaojun8558363@gmail.com:
62+ * https://gitlab.freedesktop.org/virgl/virglrenderer/-/issues/250
63+*/
64+static void test_vrend_3d_resource_overflow() {
65+
66+ struct virgl_renderer_resource_create_args resource;
67+ resource.handle = 0x4c474572;
68+ resource.target = PIPE_TEXTURE_2D_ARRAY;
69+ resource.format = VIRGL_FORMAT_Z24X8_UNORM;
70+ resource.nr_samples = 2;
71+ resource.last_level = 0;
72+ resource.array_size = 3;
73+ resource.bind = VIRGL_BIND_SAMPLER_VIEW;
74+ resource.depth = 1;
75+ resource.width = 8;
76+ resource.height = 4;
77+ resource.flags = 0;
78+
79+ virgl_renderer_resource_create(&resource, NULL, 0);
80+ virgl_renderer_ctx_attach_resource(ctx_id, resource.handle);
81+
82+ uint32_t size = 0x400;
83+ uint32_t cmd[size];
84+ int i = 0;
85+ cmd[i++] = (size - 1) << 16 | 0 << 8 | VIRGL_CCMD_RESOURCE_INLINE_WRITE;
86+ cmd[i++] = resource.handle;
87+ cmd[i++] = 0; // level
88+ cmd[i++] = 0; // usage
89+ cmd[i++] = 0; // stride
90+ cmd[i++] = 0; // layer_stride
91+ cmd[i++] = 0; // x
92+ cmd[i++] = 0; // y
93+ cmd[i++] = 0; // z
94+ cmd[i++] = 8; // w
95+ cmd[i++] = 4; // h
96+ cmd[i++] = 3; // d
97+ memset(&cmd[i], 0, size - i);
98+
99+ virgl_renderer_submit_cmd((void *) cmd, ctx_id, size);
100+}
101+
102+
103 int main()
104 {
105 initialize_environment();
106@@ -980,6 +1035,8 @@ int main()
107 test_cs_nullpointer_deference();
108 test_vrend_set_signle_abo_heap_overflow();
109
110+ test_vrend_set_shader_images_overflow();
111+ test_vrend_3d_resource_overflow();
112
113 virgl_renderer_context_destroy(ctx_id);
114 virgl_renderer_cleanup(&cookie);
115--
1162.25.1
117
diff --git a/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0175.patch b/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0175.patch
deleted file mode 100644
index 7fbab75091..0000000000
--- a/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0175.patch
+++ /dev/null
@@ -1,107 +0,0 @@
1From 5ca7aca001092c557f0b6fc1ba3db7dcdab860b7 Mon Sep 17 00:00:00 2001
2From: Gert Wollny <gert.wollny@collabora.com>
3Date: Tue, 30 Nov 2021 09:29:42 +0100
4Subject: [PATCH 1/2] vrend: clear memory when allocating a host-backed memory
5 resource
6
7Closes: #249
8Signed-off-by: Gert Wollny <gert.wollny@collabora.com>
9Reviewed-by: Chia-I Wu <olvaffe@gmail.com>
10
11cherry-pick from anongit.freedesktop.org/virglrenderer
12commit b05bb61...
13
14CVE: CVE-2022-0175
15Upstream-Status: Backport
16Signed-off-by: Joe Slater <joe.slater@windriver.com>
17
18---
19 src/vrend_renderer.c | 2 +-
20 tests/test_virgl_transfer.c | 51 +++++++++++++++++++++++++++++++++++++
21 2 files changed, 52 insertions(+), 1 deletion(-)
22
23diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c
24index b8b2a36..2650cf2 100644
25--- a/src/vrend_renderer.c
26+++ b/src/vrend_renderer.c
27@@ -6788,7 +6788,7 @@ vrend_resource_alloc_buffer(struct vrend_resource *gr, uint32_t flags)
28 if (bind == VIRGL_BIND_CUSTOM) {
29 /* use iovec directly when attached */
30 gr->storage_bits |= VREND_STORAGE_HOST_SYSTEM_MEMORY;
31- gr->ptr = malloc(size);
32+ gr->ptr = calloc(1, size);
33 if (!gr->ptr)
34 return -ENOMEM;
35 } else if (bind == VIRGL_BIND_STAGING) {
36diff --git a/tests/test_virgl_transfer.c b/tests/test_virgl_transfer.c
37index bf7f438..3c53c3d 100644
38--- a/tests/test_virgl_transfer.c
39+++ b/tests/test_virgl_transfer.c
40@@ -952,6 +952,56 @@ START_TEST(virgl_test_transfer_near_res_bounds_with_stride_succeeds)
41 }
42 END_TEST
43
44+START_TEST(test_vrend_host_backed_memory_no_data_leak)
45+{
46+ struct iovec iovs[1];
47+ int niovs = 1;
48+
49+ struct virgl_context ctx = {0};
50+
51+ int ret = testvirgl_init_ctx_cmdbuf(&ctx);
52+
53+ struct virgl_renderer_resource_create_args res;
54+ res.handle = 0x400;
55+ res.target = PIPE_BUFFER;
56+ res.format = VIRGL_FORMAT_R8_UNORM;
57+ res.nr_samples = 0;
58+ res.last_level = 0;
59+ res.array_size = 1;
60+ res.bind = VIRGL_BIND_CUSTOM;
61+ res.depth = 1;
62+ res.width = 32;
63+ res.height = 1;
64+ res.flags = 0;
65+
66+ uint32_t size = 32;
67+ uint8_t* data = calloc(1, size);
68+ memset(data, 1, 32);
69+ iovs[0].iov_base = data;
70+ iovs[0].iov_len = size;
71+
72+ struct pipe_box box = {0,0,0, size, 1,1};
73+
74+ virgl_renderer_resource_create(&res, NULL, 0);
75+ virgl_renderer_ctx_attach_resource(ctx.ctx_id, res.handle);
76+
77+ ret = virgl_renderer_transfer_read_iov(res.handle, ctx.ctx_id, 0, 0, 0,
78+ (struct virgl_box *)&box, 0, iovs, niovs);
79+
80+ ck_assert_int_eq(ret, 0);
81+
82+ for (int i = 0; i < 32; ++i)
83+ ck_assert_int_eq(data[i], 0);
84+
85+ virgl_renderer_ctx_detach_resource(1, res.handle);
86+
87+ virgl_renderer_resource_unref(res.handle);
88+ free(data);
89+
90+}
91+END_TEST
92+
93+
94 static Suite *virgl_init_suite(void)
95 {
96 Suite *s;
97@@ -981,6 +1031,7 @@ static Suite *virgl_init_suite(void)
98 tcase_add_test(tc_core, virgl_test_transfer_buffer_bad_strides);
99 tcase_add_test(tc_core, virgl_test_transfer_2d_array_bad_layer_stride);
100 tcase_add_test(tc_core, virgl_test_transfer_2d_bad_level);
101+ tcase_add_test(tc_core, test_vrend_host_backed_memory_no_data_leak);
102
103 tcase_add_loop_test(tc_core, virgl_test_transfer_res_read_valid, 0, PIPE_MAX_TEXTURE_TYPES);
104 tcase_add_loop_test(tc_core, virgl_test_transfer_res_write_valid, 0, PIPE_MAX_TEXTURE_TYPES);
105--
1062.25.1
107
diff --git a/meta/recipes-graphics/virglrenderer/virglrenderer_0.10.3.bb b/meta/recipes-graphics/virglrenderer/virglrenderer_0.10.3.bb
new file mode 100644
index 0000000000..567c62b570
--- /dev/null
+++ b/meta/recipes-graphics/virglrenderer/virglrenderer_0.10.3.bb
@@ -0,0 +1,33 @@
1SUMMARY = "VirGL virtual OpenGL renderer"
2DESCRIPTION = "Virgil is a research project to investigate the possibility of \
3creating a virtual 3D GPU for use inside qemu virtual machines, that allows \
4the guest operating system to use the capabilities of the host GPU to \
5accelerate 3D rendering."
6HOMEPAGE = "https://virgil3d.github.io/"
7
8LICENSE = "MIT"
9LIC_FILES_CHKSUM = "file://COPYING;md5=c81c08eeefd9418fca8f88309a76db10"
10
11DEPENDS = "libdrm libepoxy virtual/egl virtual/libgbm"
12SRCREV = "0922041ec6730122e0fec11404e6859e2efc4bc0"
13SRC_URI = "git://gitlab.freedesktop.org/virgl/virglrenderer.git;branch=master \
14 file://0001-meson.build-use-python3-directly-for-python.patch \
15 "
16
17S = "${WORKDIR}/git"
18
19inherit meson pkgconfig features_check
20
21PACKAGECONFIG ?= "${@bb.utils.contains('DISTRO_FEATURES', 'vulkan', 'venus-experimental', '', d)}"
22
23PACKAGECONFIG[venus-experimental] = "-Dvenus-experimental=true,-Dvenus-experimental=false,vulkan-loader vulkan-headers"
24PACKAGECONFIG[va] = "-Dvideo=true,-Dvideo=false,libva"
25PACKAGECONFIG[render-server] = "-Drender-server=true,-Drender-server=false"
26PACKAGECONFIG[drm-msm-experimental] = "-Ddrm-msm-experimental=true,-Ddrm-msm-experimental=false"
27PACKAGECONFIG[minigbm_allocation] = "-Dminigbm_allocation=true,-Dminigbm_allocation=false"
28PACKAGECONFIG[venus-validate] = "-Dvenus-validate=true,-Dvenus-validate=false"
29PACKAGECONFIG[tests] = "-Dtests=true,-Dtests=false,libcheck"
30
31BBCLASSEXTEND = "native nativesdk"
32
33REQUIRED_DISTRO_FEATURES = "opengl"
diff --git a/meta/recipes-graphics/virglrenderer/virglrenderer_0.9.1.bb b/meta/recipes-graphics/virglrenderer/virglrenderer_0.9.1.bb
deleted file mode 100644
index ad3688e300..0000000000
--- a/meta/recipes-graphics/virglrenderer/virglrenderer_0.9.1.bb
+++ /dev/null
@@ -1,25 +0,0 @@
1SUMMARY = "VirGL virtual OpenGL renderer"
2DESCRIPTION = "Virgil is a research project to investigate the possibility of \
3creating a virtual 3D GPU for use inside qemu virtual machines, that allows \
4the guest operating system to use the capabilities of the host GPU to \
5accelerate 3D rendering."
6HOMEPAGE = "https://virgil3d.github.io/"
7
8LICENSE = "MIT"
9LIC_FILES_CHKSUM = "file://COPYING;md5=c81c08eeefd9418fca8f88309a76db10"
10
11DEPENDS = "libdrm virtual/egl virtual/libgbm libepoxy"
12SRCREV = "363915595e05fb252e70d6514be2f0c0b5ca312b"
13SRC_URI = "git://anongit.freedesktop.org/git/virglrenderer;branch=branch-0.9.1 \
14 file://0001-meson.build-use-python3-directly-for-python.patch \
15 file://cve-2022-0135.patch \
16 file://cve-2022-0175.patch \
17 "
18
19S = "${WORKDIR}/git"
20
21inherit meson pkgconfig features_check
22
23BBCLASSEXTEND = "native nativesdk"
24
25REQUIRED_DISTRO_FEATURES = "opengl"