diff options
Diffstat (limited to 'meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch')
-rw-r--r-- | meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch | 117 |
1 files changed, 117 insertions, 0 deletions
diff --git a/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch b/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch new file mode 100644 index 0000000000..ae42dc8f6c --- /dev/null +++ b/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch | |||
@@ -0,0 +1,117 @@ | |||
1 | From 63aee871365f9c9e7fa9125672302a0fb250d34d Mon Sep 17 00:00:00 2001 | ||
2 | From: Gert Wollny <gert.wollny@collabora.com> | ||
3 | Date: Tue, 30 Nov 2021 09:16:24 +0100 | ||
4 | Subject: [PATCH 2/2] vrend: propperly check whether the shader image range is | ||
5 | correct | ||
6 | |||
7 | Also add a test to check the integer underflow. | ||
8 | |||
9 | Closes: #251 | ||
10 | Signed-off-by: Gert Wollny <gert.wollny@collabora.com> | ||
11 | Reviewed-by: Chia-I Wu <olvaffe@gmail.com> | ||
12 | |||
13 | cherry-pick from anongit.freedesktop.org/virglrenderer | ||
14 | commit 2aed5d4... | ||
15 | |||
16 | CVE: CVE-2022-0135 | ||
17 | Upstream-Status: Backport | ||
18 | Signed-off-by: Joe Slater <joe.slater@windriver.com> | ||
19 | |||
20 | --- | ||
21 | src/vrend_decode.c | 3 +- | ||
22 | tests/test_fuzzer_formats.c | 57 +++++++++++++++++++++++++++++++++++++ | ||
23 | 2 files changed, 59 insertions(+), 1 deletion(-) | ||
24 | |||
25 | diff --git a/src/vrend_decode.c b/src/vrend_decode.c | ||
26 | index 91f5f24..6771b10 100644 | ||
27 | --- a/src/vrend_decode.c | ||
28 | +++ b/src/vrend_decode.c | ||
29 | @@ -1249,8 +1249,9 @@ static int vrend_decode_set_shader_images(struct vrend_context *ctx, const uint3 | ||
30 | if (num_images < 1) { | ||
31 | return 0; | ||
32 | } | ||
33 | + | ||
34 | if (start_slot > PIPE_MAX_SHADER_IMAGES || | ||
35 | - start_slot > PIPE_MAX_SHADER_IMAGES - num_images) | ||
36 | + start_slot + num_images > PIPE_MAX_SHADER_IMAGES) | ||
37 | return EINVAL; | ||
38 | |||
39 | for (uint32_t i = 0; i < num_images; i++) { | ||
40 | diff --git a/tests/test_fuzzer_formats.c b/tests/test_fuzzer_formats.c | ||
41 | index 154a2e5..e32caf0 100644 | ||
42 | --- a/tests/test_fuzzer_formats.c | ||
43 | +++ b/tests/test_fuzzer_formats.c | ||
44 | @@ -958,6 +958,61 @@ static void test_vrend_set_signle_abo_heap_overflow() { | ||
45 | virgl_renderer_submit_cmd((void *) cmd, ctx_id, 0xde); | ||
46 | } | ||
47 | |||
48 | +static void test_vrend_set_shader_images_overflow() | ||
49 | +{ | ||
50 | + uint32_t num_shaders = PIPE_MAX_SHADER_IMAGES + 1; | ||
51 | + uint32_t size = num_shaders * VIRGL_SET_SHADER_IMAGE_ELEMENT_SIZE + 3; | ||
52 | + uint32_t cmd[size]; | ||
53 | + int i = 0; | ||
54 | + cmd[i++] = ((size - 1)<< 16) | 0 << 8 | VIRGL_CCMD_SET_SHADER_IMAGES; | ||
55 | + cmd[i++] = PIPE_SHADER_FRAGMENT; | ||
56 | + memset(&cmd[i], 0, size - i); | ||
57 | + | ||
58 | + virgl_renderer_submit_cmd((void *) cmd, ctx_id, size); | ||
59 | +} | ||
60 | + | ||
61 | +/* Test adapted from yaojun8558363@gmail.com: | ||
62 | + * https://gitlab.freedesktop.org/virgl/virglrenderer/-/issues/250 | ||
63 | +*/ | ||
64 | +static void test_vrend_3d_resource_overflow() { | ||
65 | + | ||
66 | + struct virgl_renderer_resource_create_args resource; | ||
67 | + resource.handle = 0x4c474572; | ||
68 | + resource.target = PIPE_TEXTURE_2D_ARRAY; | ||
69 | + resource.format = VIRGL_FORMAT_Z24X8_UNORM; | ||
70 | + resource.nr_samples = 2; | ||
71 | + resource.last_level = 0; | ||
72 | + resource.array_size = 3; | ||
73 | + resource.bind = VIRGL_BIND_SAMPLER_VIEW; | ||
74 | + resource.depth = 1; | ||
75 | + resource.width = 8; | ||
76 | + resource.height = 4; | ||
77 | + resource.flags = 0; | ||
78 | + | ||
79 | + virgl_renderer_resource_create(&resource, NULL, 0); | ||
80 | + virgl_renderer_ctx_attach_resource(ctx_id, resource.handle); | ||
81 | + | ||
82 | + uint32_t size = 0x400; | ||
83 | + uint32_t cmd[size]; | ||
84 | + int i = 0; | ||
85 | + cmd[i++] = (size - 1) << 16 | 0 << 8 | VIRGL_CCMD_RESOURCE_INLINE_WRITE; | ||
86 | + cmd[i++] = resource.handle; | ||
87 | + cmd[i++] = 0; // level | ||
88 | + cmd[i++] = 0; // usage | ||
89 | + cmd[i++] = 0; // stride | ||
90 | + cmd[i++] = 0; // layer_stride | ||
91 | + cmd[i++] = 0; // x | ||
92 | + cmd[i++] = 0; // y | ||
93 | + cmd[i++] = 0; // z | ||
94 | + cmd[i++] = 8; // w | ||
95 | + cmd[i++] = 4; // h | ||
96 | + cmd[i++] = 3; // d | ||
97 | + memset(&cmd[i], 0, size - i); | ||
98 | + | ||
99 | + virgl_renderer_submit_cmd((void *) cmd, ctx_id, size); | ||
100 | +} | ||
101 | + | ||
102 | + | ||
103 | int main() | ||
104 | { | ||
105 | initialize_environment(); | ||
106 | @@ -980,6 +1035,8 @@ int main() | ||
107 | test_cs_nullpointer_deference(); | ||
108 | test_vrend_set_signle_abo_heap_overflow(); | ||
109 | |||
110 | + test_vrend_set_shader_images_overflow(); | ||
111 | + test_vrend_3d_resource_overflow(); | ||
112 | |||
113 | virgl_renderer_context_destroy(ctx_id); | ||
114 | virgl_renderer_cleanup(&cookie); | ||
115 | -- | ||
116 | 2.25.1 | ||
117 | |||