1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
From 95e581fd181b213c2ed7cdc63f2abc03eaaa77ec Mon Sep 17 00:00:00 2001
From: Gert Wollny <gert.wollny@collabora.com>
Date: Tue, 30 Nov 2021 10:17:26 +0100
Subject: [PATCH] vrend: Add test to resource OOB write and fix it
v2: Also check that no depth != 1 has been send when none is due
Closes: #250
Signed-off-by: Gert Wollny <gert.wollny@collabora.com>
Reviewed-by: Chia-I Wu <olvaffe@gmail.com>
https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/95e581fd181b213c2ed7cdc63f2abc03eaaa77ec
Upstream-Status: Backport
CVE: CVE-2022-0135
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
---
src/vrend_renderer.c | 3 +++
tests/test_fuzzer_formats.c | 43 +++++++++++++++++++++++++++++++++++++
2 files changed, 46 insertions(+)
diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c
index 28f669727..357b81b20 100644
--- a/src/vrend_renderer.c
+++ b/src/vrend_renderer.c
@@ -7833,8 +7833,11 @@ static int vrend_renderer_transfer_write_iov(struct vrend_context *ctx,
info->box->height) * elsize;
if (res->target == GL_TEXTURE_3D ||
res->target == GL_TEXTURE_2D_ARRAY ||
+ res->target == GL_TEXTURE_2D_MULTISAMPLE_ARRAY ||
res->target == GL_TEXTURE_CUBE_MAP_ARRAY)
send_size *= info->box->depth;
+ else if (need_temp && info->box->depth != 1)
+ return EINVAL;
if (need_temp) {
data = malloc(send_size);
diff --git a/tests/test_fuzzer_formats.c b/tests/test_fuzzer_formats.c
index 59d6fb671..2de9a9a3f 100644
--- a/tests/test_fuzzer_formats.c
+++ b/tests/test_fuzzer_formats.c
@@ -957,6 +957,48 @@ static void test_vrend_set_signle_abo_heap_overflow() {
virgl_renderer_submit_cmd((void *) cmd, ctx_id, 0xde);
}
+/* Test adapted from yaojun8558363@gmail.com:
+ * https://gitlab.freedesktop.org/virgl/virglrenderer/-/issues/250
+*/
+static void test_vrend_3d_resource_overflow() {
+
+ struct virgl_renderer_resource_create_args resource;
+ resource.handle = 0x4c474572;
+ resource.target = PIPE_TEXTURE_2D_ARRAY;
+ resource.format = VIRGL_FORMAT_Z24X8_UNORM;
+ resource.nr_samples = 2;
+ resource.last_level = 0;
+ resource.array_size = 3;
+ resource.bind = VIRGL_BIND_SAMPLER_VIEW;
+ resource.depth = 1;
+ resource.width = 8;
+ resource.height = 4;
+ resource.flags = 0;
+
+ virgl_renderer_resource_create(&resource, NULL, 0);
+ virgl_renderer_ctx_attach_resource(ctx_id, resource.handle);
+
+ uint32_t size = 0x400;
+ uint32_t cmd[size];
+ int i = 0;
+ cmd[i++] = (size - 1) << 16 | 0 << 8 | VIRGL_CCMD_RESOURCE_INLINE_WRITE;
+ cmd[i++] = resource.handle;
+ cmd[i++] = 0; // level
+ cmd[i++] = 0; // usage
+ cmd[i++] = 0; // stride
+ cmd[i++] = 0; // layer_stride
+ cmd[i++] = 0; // x
+ cmd[i++] = 0; // y
+ cmd[i++] = 0; // z
+ cmd[i++] = 8; // w
+ cmd[i++] = 4; // h
+ cmd[i++] = 3; // d
+ memset(&cmd[i], 0, size - i);
+
+ virgl_renderer_submit_cmd((void *) cmd, ctx_id, size);
+}
+
+
int main()
{
initialize_environment();
@@ -979,6 +1021,7 @@ int main()
test_cs_nullpointer_deference();
test_vrend_set_signle_abo_heap_overflow();
+ test_vrend_3d_resource_overflow();
virgl_renderer_context_destroy(ctx_id);
virgl_renderer_cleanup(&cookie);
--
GitLab
|
