diff options
Diffstat (limited to 'meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0175.patch')
-rw-r--r-- | meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0175.patch | 112 |
1 files changed, 112 insertions, 0 deletions
diff --git a/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0175.patch b/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0175.patch new file mode 100644 index 0000000000..8bbb9eb579 --- /dev/null +++ b/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0175.patch | |||
@@ -0,0 +1,112 @@ | |||
1 | From 5ca7aca001092c557f0b6fc1ba3db7dcdab860b7 Mon Sep 17 00:00:00 2001 | ||
2 | From: Gert Wollny <gert.wollny@collabora.com> | ||
3 | Date: Tue, 30 Nov 2021 09:29:42 +0100 | ||
4 | Subject: [PATCH 1/2] vrend: clear memory when allocating a host-backed memory | ||
5 | resource | ||
6 | |||
7 | Closes: #249 | ||
8 | Signed-off-by: Gert Wollny <gert.wollny@collabora.com> | ||
9 | Reviewed-by: Chia-I Wu <olvaffe@gmail.com> | ||
10 | |||
11 | cherry-pick from anongit.freedesktop.org/virglrenderer | ||
12 | commit b05bb61... | ||
13 | |||
14 | CVE: CVE-2022-0175 | ||
15 | Upstream-Status: Backport | ||
16 | Signed-off-by: Joe Slater <joe.slater@windriver.com> | ||
17 | |||
18 | Patch to vrend_renderer.c modified to apply to version used by hardknott. | ||
19 | Patch to test_virgl_transfer.c unchanged. | ||
20 | |||
21 | Signed-off-by: Joe Slater <joe.slater@windriver.com> | ||
22 | |||
23 | --- | ||
24 | src/vrend_renderer.c | 2 +- | ||
25 | tests/test_virgl_transfer.c | 51 +++++++++++++++++++++++++++++++++++++ | ||
26 | 2 files changed, 52 insertions(+), 1 deletion(-) | ||
27 | |||
28 | diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c | ||
29 | index ad7a351..d84f785 100644 | ||
30 | --- a/src/vrend_renderer.c | ||
31 | +++ b/src/vrend_renderer.c | ||
32 | @@ -6646,7 +6646,7 @@ int vrend_renderer_resource_create(struct vrend_renderer_resource_create_args *a | ||
33 | if (args->bind == VIRGL_BIND_CUSTOM) { | ||
34 | /* use iovec directly when attached */ | ||
35 | gr->storage_bits |= VREND_STORAGE_HOST_SYSTEM_MEMORY; | ||
36 | - gr->ptr = malloc(args->width); | ||
37 | + gr->ptr = calloc(1, args->width); | ||
38 | if (!gr->ptr) { | ||
39 | FREE(gr); | ||
40 | return ENOMEM; | ||
41 | diff --git a/tests/test_virgl_transfer.c b/tests/test_virgl_transfer.c | ||
42 | index 2c8669a..8f8e98a 100644 | ||
43 | --- a/tests/test_virgl_transfer.c | ||
44 | +++ b/tests/test_virgl_transfer.c | ||
45 | @@ -952,6 +952,56 @@ START_TEST(virgl_test_transfer_near_res_bounds_with_stride_succeeds) | ||
46 | } | ||
47 | END_TEST | ||
48 | |||
49 | +START_TEST(test_vrend_host_backed_memory_no_data_leak) | ||
50 | +{ | ||
51 | + struct iovec iovs[1]; | ||
52 | + int niovs = 1; | ||
53 | + | ||
54 | + struct virgl_context ctx = {0}; | ||
55 | + | ||
56 | + int ret = testvirgl_init_ctx_cmdbuf(&ctx); | ||
57 | + | ||
58 | + struct virgl_renderer_resource_create_args res; | ||
59 | + res.handle = 0x400; | ||
60 | + res.target = PIPE_BUFFER; | ||
61 | + res.format = VIRGL_FORMAT_R8_UNORM; | ||
62 | + res.nr_samples = 0; | ||
63 | + res.last_level = 0; | ||
64 | + res.array_size = 1; | ||
65 | + res.bind = VIRGL_BIND_CUSTOM; | ||
66 | + res.depth = 1; | ||
67 | + res.width = 32; | ||
68 | + res.height = 1; | ||
69 | + res.flags = 0; | ||
70 | + | ||
71 | + uint32_t size = 32; | ||
72 | + uint8_t* data = calloc(1, size); | ||
73 | + memset(data, 1, 32); | ||
74 | + iovs[0].iov_base = data; | ||
75 | + iovs[0].iov_len = size; | ||
76 | + | ||
77 | + struct pipe_box box = {0,0,0, size, 1,1}; | ||
78 | + | ||
79 | + virgl_renderer_resource_create(&res, NULL, 0); | ||
80 | + virgl_renderer_ctx_attach_resource(ctx.ctx_id, res.handle); | ||
81 | + | ||
82 | + ret = virgl_renderer_transfer_read_iov(res.handle, ctx.ctx_id, 0, 0, 0, | ||
83 | + (struct virgl_box *)&box, 0, iovs, niovs); | ||
84 | + | ||
85 | + ck_assert_int_eq(ret, 0); | ||
86 | + | ||
87 | + for (int i = 0; i < 32; ++i) | ||
88 | + ck_assert_int_eq(data[i], 0); | ||
89 | + | ||
90 | + virgl_renderer_ctx_detach_resource(1, res.handle); | ||
91 | + | ||
92 | + virgl_renderer_resource_unref(res.handle); | ||
93 | + free(data); | ||
94 | + | ||
95 | +} | ||
96 | +END_TEST | ||
97 | + | ||
98 | + | ||
99 | static Suite *virgl_init_suite(void) | ||
100 | { | ||
101 | Suite *s; | ||
102 | @@ -981,6 +1031,7 @@ static Suite *virgl_init_suite(void) | ||
103 | tcase_add_test(tc_core, virgl_test_transfer_buffer_bad_strides); | ||
104 | tcase_add_test(tc_core, virgl_test_transfer_2d_array_bad_layer_stride); | ||
105 | tcase_add_test(tc_core, virgl_test_transfer_2d_bad_level); | ||
106 | + tcase_add_test(tc_core, test_vrend_host_backed_memory_no_data_leak); | ||
107 | |||
108 | tcase_add_loop_test(tc_core, virgl_test_transfer_res_read_valid, 0, PIPE_MAX_TEXTURE_TYPES); | ||
109 | tcase_add_loop_test(tc_core, virgl_test_transfer_res_write_valid, 0, PIPE_MAX_TEXTURE_TYPES); | ||
110 | -- | ||
111 | 2.31.1 | ||
112 | |||