xref: /OK3568_Linux_fs/yocto/poky/meta/recipes-graphics/virglrenderer/virglrenderer/cve-2022-0135.patch (revision 4882a59341e53eb6f0b4789bf948001014eff981)
1From 63aee871365f9c9e7fa9125672302a0fb250d34d Mon Sep 17 00:00:00 2001
2From: Gert Wollny <gert.wollny@collabora.com>
3Date: Tue, 30 Nov 2021 09:16:24 +0100
4Subject: [PATCH 2/2] vrend: propperly check whether the shader image range is
5 correct
6
7Also add a test to check the integer underflow.
8
9Closes: #251
10Signed-off-by: Gert Wollny <gert.wollny@collabora.com>
11Reviewed-by: Chia-I Wu <olvaffe@gmail.com>
12
13cherry-pick from anongit.freedesktop.org/virglrenderer
14commit 2aed5d4...
15
16CVE: CVE-2022-0135
17Upstream-Status: Backport
18Signed-off-by: Joe Slater <joe.slater@windriver.com>
19
20---
21 src/vrend_decode.c          |  3 +-
22 tests/test_fuzzer_formats.c | 57 +++++++++++++++++++++++++++++++++++++
23 2 files changed, 59 insertions(+), 1 deletion(-)
24
25diff --git a/src/vrend_decode.c b/src/vrend_decode.c
26index 91f5f24..6771b10 100644
27--- a/src/vrend_decode.c
28+++ b/src/vrend_decode.c
29@@ -1249,8 +1249,9 @@ static int vrend_decode_set_shader_images(struct vrend_context *ctx, const uint3
30    if (num_images < 1) {
31       return 0;
32    }
33+
34    if (start_slot > PIPE_MAX_SHADER_IMAGES ||
35-       start_slot > PIPE_MAX_SHADER_IMAGES - num_images)
36+       start_slot + num_images > PIPE_MAX_SHADER_IMAGES)
37       return EINVAL;
38
39    for (uint32_t i = 0; i < num_images; i++) {
40diff --git a/tests/test_fuzzer_formats.c b/tests/test_fuzzer_formats.c
41index 154a2e5..e32caf0 100644
42--- a/tests/test_fuzzer_formats.c
43+++ b/tests/test_fuzzer_formats.c
44@@ -958,6 +958,61 @@ static void test_vrend_set_signle_abo_heap_overflow() {
45     virgl_renderer_submit_cmd((void *) cmd, ctx_id, 0xde);
46 }
47
48+static void test_vrend_set_shader_images_overflow()
49+{
50+    uint32_t num_shaders = PIPE_MAX_SHADER_IMAGES + 1;
51+    uint32_t size = num_shaders * VIRGL_SET_SHADER_IMAGE_ELEMENT_SIZE + 3;
52+    uint32_t cmd[size];
53+    int i = 0;
54+    cmd[i++] = ((size - 1)<< 16) | 0 << 8 | VIRGL_CCMD_SET_SHADER_IMAGES;
55+    cmd[i++] = PIPE_SHADER_FRAGMENT;
56+    memset(&cmd[i], 0, size - i);
57+
58+    virgl_renderer_submit_cmd((void *) cmd, ctx_id, size);
59+}
60+
61+/* Test adapted from yaojun8558363@gmail.com:
62+ * https://gitlab.freedesktop.org/virgl/virglrenderer/-/issues/250
63+*/
64+static void test_vrend_3d_resource_overflow() {
65+
66+    struct virgl_renderer_resource_create_args resource;
67+    resource.handle = 0x4c474572;
68+    resource.target = PIPE_TEXTURE_2D_ARRAY;
69+    resource.format = VIRGL_FORMAT_Z24X8_UNORM;
70+    resource.nr_samples = 2;
71+    resource.last_level = 0;
72+    resource.array_size = 3;
73+    resource.bind = VIRGL_BIND_SAMPLER_VIEW;
74+    resource.depth = 1;
75+    resource.width = 8;
76+    resource.height = 4;
77+    resource.flags = 0;
78+
79+    virgl_renderer_resource_create(&resource, NULL, 0);
80+    virgl_renderer_ctx_attach_resource(ctx_id, resource.handle);
81+
82+    uint32_t size = 0x400;
83+    uint32_t cmd[size];
84+    int i = 0;
85+    cmd[i++] = (size - 1) << 16 | 0 << 8 | VIRGL_CCMD_RESOURCE_INLINE_WRITE;
86+    cmd[i++] = resource.handle;
87+    cmd[i++] = 0; // level
88+    cmd[i++] = 0; // usage
89+    cmd[i++] = 0; // stride
90+    cmd[i++] = 0; // layer_stride
91+    cmd[i++] = 0; // x
92+    cmd[i++] = 0; // y
93+    cmd[i++] = 0; // z
94+    cmd[i++] = 8; // w
95+    cmd[i++] = 4; // h
96+    cmd[i++] = 3; // d
97+    memset(&cmd[i], 0, size - i);
98+
99+    virgl_renderer_submit_cmd((void *) cmd, ctx_id, size);
100+}
101+
102+
103 int main()
104 {
105    initialize_environment();
106@@ -980,6 +1035,8 @@ int main()
107    test_cs_nullpointer_deference();
108    test_vrend_set_signle_abo_heap_overflow();
109
110+   test_vrend_set_shader_images_overflow();
111+   test_vrend_3d_resource_overflow();
112
113    virgl_renderer_context_destroy(ctx_id);
114    virgl_renderer_cleanup(&cookie);
115--
1162.25.1
117
118