1From 63aee871365f9c9e7fa9125672302a0fb250d34d Mon Sep 17 00:00:00 2001 2From: Gert Wollny <gert.wollny@collabora.com> 3Date: Tue, 30 Nov 2021 09:16:24 +0100 4Subject: [PATCH 2/2] vrend: propperly check whether the shader image range is 5 correct 6 7Also add a test to check the integer underflow. 8 9Closes: #251 10Signed-off-by: Gert Wollny <gert.wollny@collabora.com> 11Reviewed-by: Chia-I Wu <olvaffe@gmail.com> 12 13cherry-pick from anongit.freedesktop.org/virglrenderer 14commit 2aed5d4... 15 16CVE: CVE-2022-0135 17Upstream-Status: Backport 18Signed-off-by: Joe Slater <joe.slater@windriver.com> 19 20--- 21 src/vrend_decode.c | 3 +- 22 tests/test_fuzzer_formats.c | 57 +++++++++++++++++++++++++++++++++++++ 23 2 files changed, 59 insertions(+), 1 deletion(-) 24 25diff --git a/src/vrend_decode.c b/src/vrend_decode.c 26index 91f5f24..6771b10 100644 27--- a/src/vrend_decode.c 28+++ b/src/vrend_decode.c 29@@ -1249,8 +1249,9 @@ static int vrend_decode_set_shader_images(struct vrend_context *ctx, const uint3 30 if (num_images < 1) { 31 return 0; 32 } 33+ 34 if (start_slot > PIPE_MAX_SHADER_IMAGES || 35- start_slot > PIPE_MAX_SHADER_IMAGES - num_images) 36+ start_slot + num_images > PIPE_MAX_SHADER_IMAGES) 37 return EINVAL; 38 39 for (uint32_t i = 0; i < num_images; i++) { 40diff --git a/tests/test_fuzzer_formats.c b/tests/test_fuzzer_formats.c 41index 154a2e5..e32caf0 100644 42--- a/tests/test_fuzzer_formats.c 43+++ b/tests/test_fuzzer_formats.c 44@@ -958,6 +958,61 @@ static void test_vrend_set_signle_abo_heap_overflow() { 45 virgl_renderer_submit_cmd((void *) cmd, ctx_id, 0xde); 46 } 47 48+static void test_vrend_set_shader_images_overflow() 49+{ 50+ uint32_t num_shaders = PIPE_MAX_SHADER_IMAGES + 1; 51+ uint32_t size = num_shaders * VIRGL_SET_SHADER_IMAGE_ELEMENT_SIZE + 3; 52+ uint32_t cmd[size]; 53+ int i = 0; 54+ cmd[i++] = ((size - 1)<< 16) | 0 << 8 | VIRGL_CCMD_SET_SHADER_IMAGES; 55+ cmd[i++] = PIPE_SHADER_FRAGMENT; 56+ memset(&cmd[i], 0, size - i); 57+ 58+ virgl_renderer_submit_cmd((void *) cmd, ctx_id, size); 59+} 60+ 61+/* Test adapted from yaojun8558363@gmail.com: 62+ * https://gitlab.freedesktop.org/virgl/virglrenderer/-/issues/250 63+*/ 64+static void test_vrend_3d_resource_overflow() { 65+ 66+ struct virgl_renderer_resource_create_args resource; 67+ resource.handle = 0x4c474572; 68+ resource.target = PIPE_TEXTURE_2D_ARRAY; 69+ resource.format = VIRGL_FORMAT_Z24X8_UNORM; 70+ resource.nr_samples = 2; 71+ resource.last_level = 0; 72+ resource.array_size = 3; 73+ resource.bind = VIRGL_BIND_SAMPLER_VIEW; 74+ resource.depth = 1; 75+ resource.width = 8; 76+ resource.height = 4; 77+ resource.flags = 0; 78+ 79+ virgl_renderer_resource_create(&resource, NULL, 0); 80+ virgl_renderer_ctx_attach_resource(ctx_id, resource.handle); 81+ 82+ uint32_t size = 0x400; 83+ uint32_t cmd[size]; 84+ int i = 0; 85+ cmd[i++] = (size - 1) << 16 | 0 << 8 | VIRGL_CCMD_RESOURCE_INLINE_WRITE; 86+ cmd[i++] = resource.handle; 87+ cmd[i++] = 0; // level 88+ cmd[i++] = 0; // usage 89+ cmd[i++] = 0; // stride 90+ cmd[i++] = 0; // layer_stride 91+ cmd[i++] = 0; // x 92+ cmd[i++] = 0; // y 93+ cmd[i++] = 0; // z 94+ cmd[i++] = 8; // w 95+ cmd[i++] = 4; // h 96+ cmd[i++] = 3; // d 97+ memset(&cmd[i], 0, size - i); 98+ 99+ virgl_renderer_submit_cmd((void *) cmd, ctx_id, size); 100+} 101+ 102+ 103 int main() 104 { 105 initialize_environment(); 106@@ -980,6 +1035,8 @@ int main() 107 test_cs_nullpointer_deference(); 108 test_vrend_set_signle_abo_heap_overflow(); 109 110+ test_vrend_set_shader_images_overflow(); 111+ test_vrend_3d_resource_overflow(); 112 113 virgl_renderer_context_destroy(ctx_id); 114 virgl_renderer_cleanup(&cookie); 115-- 1162.25.1 117 118