vrend: clear memory when allocating a host-backed memory resource (CVE-2022-0175)
This commit is contained in:
yezengruan
parent
bded1f5306
commit
7bfd520710
@ -0,0 +1,99 @@
|
|||||||
|
From 3abfed87921271435e95083ed79b5dd4d0a188a7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Gert Wollny <gert.wollny@collabora.com>
|
||||||
|
Date: Tue, 30 Nov 2021 09:29:42 +0100
|
||||||
|
Subject: [PATCH] vrend: clear memory when allocating a host-backed memory
|
||||||
|
resource
|
||||||
|
|
||||||
|
Closes: #249
|
||||||
|
Signed-off-by: Gert Wollny <gert.wollny@collabora.com>
|
||||||
|
Reviewed-by: Chia-I Wu <olvaffe@gmail.com>
|
||||||
|
---
|
||||||
|
src/vrend_renderer.c | 2 +-
|
||||||
|
tests/test_virgl_transfer.c | 51 +++++++++++++++++++++++++++++++++++++
|
||||||
|
2 files changed, 52 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c
|
||||||
|
index ad7a351..d84f785 100644
|
||||||
|
--- a/src/vrend_renderer.c
|
||||||
|
+++ b/src/vrend_renderer.c
|
||||||
|
@@ -6646,7 +6646,7 @@ int vrend_renderer_resource_create(struct vrend_renderer_resource_create_args *a
|
||||||
|
if (args->bind == VIRGL_BIND_CUSTOM) {
|
||||||
|
/* use iovec directly when attached */
|
||||||
|
gr->storage_bits |= VREND_STORAGE_HOST_SYSTEM_MEMORY;
|
||||||
|
- gr->ptr = malloc(args->width);
|
||||||
|
+ gr->ptr = calloc(1, args->width);
|
||||||
|
if (!gr->ptr) {
|
||||||
|
FREE(gr);
|
||||||
|
return ENOMEM;
|
||||||
|
diff --git a/tests/test_virgl_transfer.c b/tests/test_virgl_transfer.c
|
||||||
|
index 2c8669a..8f8e98a 100644
|
||||||
|
--- a/tests/test_virgl_transfer.c
|
||||||
|
+++ b/tests/test_virgl_transfer.c
|
||||||
|
@@ -952,6 +952,56 @@ START_TEST(virgl_test_transfer_near_res_bounds_with_stride_succeeds)
|
||||||
|
}
|
||||||
|
END_TEST
|
||||||
|
|
||||||
|
+START_TEST(test_vrend_host_backed_memory_no_data_leak)
|
||||||
|
+{
|
||||||
|
+ struct iovec iovs[1];
|
||||||
|
+ int niovs = 1;
|
||||||
|
+
|
||||||
|
+ struct virgl_context ctx = {0};
|
||||||
|
+
|
||||||
|
+ int ret = testvirgl_init_ctx_cmdbuf(&ctx);
|
||||||
|
+
|
||||||
|
+ struct virgl_renderer_resource_create_args res;
|
||||||
|
+ res.handle = 0x400;
|
||||||
|
+ res.target = PIPE_BUFFER;
|
||||||
|
+ res.format = VIRGL_FORMAT_R8_UNORM;
|
||||||
|
+ res.nr_samples = 0;
|
||||||
|
+ res.last_level = 0;
|
||||||
|
+ res.array_size = 1;
|
||||||
|
+ res.bind = VIRGL_BIND_CUSTOM;
|
||||||
|
+ res.depth = 1;
|
||||||
|
+ res.width = 32;
|
||||||
|
+ res.height = 1;
|
||||||
|
+ res.flags = 0;
|
||||||
|
+
|
||||||
|
+ uint32_t size = 32;
|
||||||
|
+ uint8_t* data = calloc(1, size);
|
||||||
|
+ memset(data, 1, 32);
|
||||||
|
+ iovs[0].iov_base = data;
|
||||||
|
+ iovs[0].iov_len = size;
|
||||||
|
+
|
||||||
|
+ struct pipe_box box = {0,0,0, size, 1,1};
|
||||||
|
+
|
||||||
|
+ virgl_renderer_resource_create(&res, NULL, 0);
|
||||||
|
+ virgl_renderer_ctx_attach_resource(ctx.ctx_id, res.handle);
|
||||||
|
+
|
||||||
|
+ ret = virgl_renderer_transfer_read_iov(res.handle, ctx.ctx_id, 0, 0, 0,
|
||||||
|
+ (struct virgl_box *)&box, 0, iovs, niovs);
|
||||||
|
+
|
||||||
|
+ ck_assert_int_eq(ret, 0);
|
||||||
|
+
|
||||||
|
+ for (int i = 0; i < 32; ++i)
|
||||||
|
+ ck_assert_int_eq(data[i], 0);
|
||||||
|
+
|
||||||
|
+ virgl_renderer_ctx_detach_resource(1, res.handle);
|
||||||
|
+
|
||||||
|
+ virgl_renderer_resource_unref(res.handle);
|
||||||
|
+ free(data);
|
||||||
|
+
|
||||||
|
+}
|
||||||
|
+END_TEST
|
||||||
|
+
|
||||||
|
+
|
||||||
|
static Suite *virgl_init_suite(void)
|
||||||
|
{
|
||||||
|
Suite *s;
|
||||||
|
@@ -981,6 +1031,7 @@ static Suite *virgl_init_suite(void)
|
||||||
|
tcase_add_test(tc_core, virgl_test_transfer_buffer_bad_strides);
|
||||||
|
tcase_add_test(tc_core, virgl_test_transfer_2d_array_bad_layer_stride);
|
||||||
|
tcase_add_test(tc_core, virgl_test_transfer_2d_bad_level);
|
||||||
|
+ tcase_add_test(tc_core, test_vrend_host_backed_memory_no_data_leak);
|
||||||
|
|
||||||
|
tcase_add_loop_test(tc_core, virgl_test_transfer_res_read_valid, 0, PIPE_MAX_TEXTURE_TYPES);
|
||||||
|
tcase_add_loop_test(tc_core, virgl_test_transfer_res_write_valid, 0, PIPE_MAX_TEXTURE_TYPES);
|
||||||
|
--
|
||||||
|
2.27.0
|
||||||
|
|
||||||
@ -1,12 +1,14 @@
|
|||||||
Name: virglrenderer
|
Name: virglrenderer
|
||||||
Version: 0.8.2
|
Version: 0.8.2
|
||||||
Release: 1
|
Release: 2
|
||||||
Summary: VirGL virtual OpenGL renderer
|
Summary: VirGL virtual OpenGL renderer
|
||||||
License: MIT
|
License: MIT
|
||||||
URL: https://virgil3d.github.io
|
URL: https://virgil3d.github.io
|
||||||
|
|
||||||
Source0: https://gitlab.freedesktop.org/virgl/%{name}/-/archive/%{name}-%{version}/%{name}-%{name}-%{version}.tar.gz
|
Source0: https://gitlab.freedesktop.org/virgl/%{name}/-/archive/%{name}-%{version}/%{name}-%{name}-%{version}.tar.gz
|
||||||
|
|
||||||
|
Patch00: 0000-vrend-clear-memory-when-allocating-a-host-backed-mem.patch
|
||||||
|
|
||||||
BuildRequires: meson
|
BuildRequires: meson
|
||||||
BuildRequires: python3
|
BuildRequires: python3
|
||||||
BuildRequires: libepoxy-devel
|
BuildRequires: libepoxy-devel
|
||||||
@ -32,6 +34,7 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
|
|||||||
|
|
||||||
%prep
|
%prep
|
||||||
%setup -q -n %{name}-%{name}-%{version}
|
%setup -q -n %{name}-%{name}-%{version}
|
||||||
|
%autopatch -p1
|
||||||
|
|
||||||
%build
|
%build
|
||||||
%meson
|
%meson
|
||||||
@ -55,6 +58,9 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
|
|||||||
%{_libdir}/pkgconfig/*.pc
|
%{_libdir}/pkgconfig/*.pc
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jul 06 2022 yezengruan <yezengruan@huawei.com> - 0.8.2-2
|
||||||
|
- vrend: clear memory when allocating a host-backed memory resource (CVE-2022-0175)
|
||||||
|
|
||||||
* Fri Jul 24 2020 shixuantong <shixuantong@huawei.com> - 0.8.2-1
|
* Fri Jul 24 2020 shixuantong <shixuantong@huawei.com> - 0.8.2-1
|
||||||
- update to 0.8.2-1
|
- update to 0.8.2-1
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user