Andrew Geissler | 7e0e3c0 | 2022-02-25 20:34:39 +0000 | [diff] [blame] | 1 | From 63aee871365f9c9e7fa9125672302a0fb250d34d Mon Sep 17 00:00:00 2001 |
| 2 | From: Gert Wollny <gert.wollny@collabora.com> |
| 3 | Date: Tue, 30 Nov 2021 09:16:24 +0100 |
| 4 | Subject: [PATCH 2/2] vrend: propperly check whether the shader image range is |
| 5 | correct |
| 6 | |
| 7 | Also add a test to check the integer underflow. |
| 8 | |
| 9 | Closes: #251 |
| 10 | Signed-off-by: Gert Wollny <gert.wollny@collabora.com> |
| 11 | Reviewed-by: Chia-I Wu <olvaffe@gmail.com> |
| 12 | |
| 13 | cherry-pick from anongit.freedesktop.org/virglrenderer |
| 14 | commit 2aed5d4... |
| 15 | |
| 16 | CVE: CVE-2022-0135 |
| 17 | Upstream-Status: Backport |
| 18 | Signed-off-by: Joe Slater <joe.slater@windriver.com> |
| 19 | |
| 20 | --- |
| 21 | src/vrend_decode.c | 3 +- |
| 22 | tests/test_fuzzer_formats.c | 57 +++++++++++++++++++++++++++++++++++++ |
| 23 | 2 files changed, 59 insertions(+), 1 deletion(-) |
| 24 | |
| 25 | diff --git a/src/vrend_decode.c b/src/vrend_decode.c |
| 26 | index 91f5f24..6771b10 100644 |
| 27 | --- a/src/vrend_decode.c |
| 28 | +++ b/src/vrend_decode.c |
| 29 | @@ -1249,8 +1249,9 @@ static int vrend_decode_set_shader_images(struct vrend_context *ctx, const uint3 |
| 30 | if (num_images < 1) { |
| 31 | return 0; |
| 32 | } |
| 33 | + |
| 34 | if (start_slot > PIPE_MAX_SHADER_IMAGES || |
| 35 | - start_slot > PIPE_MAX_SHADER_IMAGES - num_images) |
| 36 | + start_slot + num_images > PIPE_MAX_SHADER_IMAGES) |
| 37 | return EINVAL; |
| 38 | |
| 39 | for (uint32_t i = 0; i < num_images; i++) { |
| 40 | diff --git a/tests/test_fuzzer_formats.c b/tests/test_fuzzer_formats.c |
| 41 | index 154a2e5..e32caf0 100644 |
| 42 | --- a/tests/test_fuzzer_formats.c |
| 43 | +++ b/tests/test_fuzzer_formats.c |
| 44 | @@ -958,6 +958,61 @@ static void test_vrend_set_signle_abo_heap_overflow() { |
| 45 | virgl_renderer_submit_cmd((void *) cmd, ctx_id, 0xde); |
| 46 | } |
| 47 | |
| 48 | +static void test_vrend_set_shader_images_overflow() |
| 49 | +{ |
| 50 | + uint32_t num_shaders = PIPE_MAX_SHADER_IMAGES + 1; |
| 51 | + uint32_t size = num_shaders * VIRGL_SET_SHADER_IMAGE_ELEMENT_SIZE + 3; |
| 52 | + uint32_t cmd[size]; |
| 53 | + int i = 0; |
| 54 | + cmd[i++] = ((size - 1)<< 16) | 0 << 8 | VIRGL_CCMD_SET_SHADER_IMAGES; |
| 55 | + cmd[i++] = PIPE_SHADER_FRAGMENT; |
| 56 | + memset(&cmd[i], 0, size - i); |
| 57 | + |
| 58 | + virgl_renderer_submit_cmd((void *) cmd, ctx_id, size); |
| 59 | +} |
| 60 | + |
| 61 | +/* Test adapted from yaojun8558363@gmail.com: |
| 62 | + * https://gitlab.freedesktop.org/virgl/virglrenderer/-/issues/250 |
| 63 | +*/ |
| 64 | +static void test_vrend_3d_resource_overflow() { |
| 65 | + |
| 66 | + struct virgl_renderer_resource_create_args resource; |
| 67 | + resource.handle = 0x4c474572; |
| 68 | + resource.target = PIPE_TEXTURE_2D_ARRAY; |
| 69 | + resource.format = VIRGL_FORMAT_Z24X8_UNORM; |
| 70 | + resource.nr_samples = 2; |
| 71 | + resource.last_level = 0; |
| 72 | + resource.array_size = 3; |
| 73 | + resource.bind = VIRGL_BIND_SAMPLER_VIEW; |
| 74 | + resource.depth = 1; |
| 75 | + resource.width = 8; |
| 76 | + resource.height = 4; |
| 77 | + resource.flags = 0; |
| 78 | + |
| 79 | + virgl_renderer_resource_create(&resource, NULL, 0); |
| 80 | + virgl_renderer_ctx_attach_resource(ctx_id, resource.handle); |
| 81 | + |
| 82 | + uint32_t size = 0x400; |
| 83 | + uint32_t cmd[size]; |
| 84 | + int i = 0; |
| 85 | + cmd[i++] = (size - 1) << 16 | 0 << 8 | VIRGL_CCMD_RESOURCE_INLINE_WRITE; |
| 86 | + cmd[i++] = resource.handle; |
| 87 | + cmd[i++] = 0; // level |
| 88 | + cmd[i++] = 0; // usage |
| 89 | + cmd[i++] = 0; // stride |
| 90 | + cmd[i++] = 0; // layer_stride |
| 91 | + cmd[i++] = 0; // x |
| 92 | + cmd[i++] = 0; // y |
| 93 | + cmd[i++] = 0; // z |
| 94 | + cmd[i++] = 8; // w |
| 95 | + cmd[i++] = 4; // h |
| 96 | + cmd[i++] = 3; // d |
| 97 | + memset(&cmd[i], 0, size - i); |
| 98 | + |
| 99 | + virgl_renderer_submit_cmd((void *) cmd, ctx_id, size); |
| 100 | +} |
| 101 | + |
| 102 | + |
| 103 | int main() |
| 104 | { |
| 105 | initialize_environment(); |
| 106 | @@ -980,6 +1035,8 @@ int main() |
| 107 | test_cs_nullpointer_deference(); |
| 108 | test_vrend_set_signle_abo_heap_overflow(); |
| 109 | |
| 110 | + test_vrend_set_shader_images_overflow(); |
| 111 | + test_vrend_3d_resource_overflow(); |
| 112 | |
| 113 | virgl_renderer_context_destroy(ctx_id); |
| 114 | virgl_renderer_cleanup(&cookie); |
| 115 | -- |
| 116 | 2.25.1 |
| 117 | |