diff mbox series

drm/vmwgfx: Fix possible null pointer derefence with invalid contexts

Message ID 20240110200305.94086-1-zack.rusin@broadcom.com (mailing list archive)
State New, archived
Headers show
Series drm/vmwgfx: Fix possible null pointer derefence with invalid contexts | expand

Commit Message

Zack Rusin Jan. 10, 2024, 8:03 p.m. UTC 
vmw_context_cotable can return either an error or a null pointer and its
usage sometimes went unchecked. Subsequent code would then try to access
either a null pointer or an error value.

The invalid dereferences were only possible with malformed userspace
apps which never properly initialized the rendering contexts.

Check the results of vmw_context_cotable to fix the invalid derefs.

Thanks:
ziming zhang(@ezrak1e) from Ant Group Light-Year Security Lab
who was the first person to discover it.
Niels De Graef who reported it and helped to track down the poc.

Fixes: 9c079b8ce8bf ("drm/vmwgfx: Adapt execbuf to the new validation api")
Cc: <stable@vger.kernel.org> # v4.20+
Reported-by: Niels De Graef  <ndegraef@redhat.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Cc: Martin Krastev <martin.krastev@broadcom.com>
Cc: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Cc: Ian Forbes <ian.forbes@broadcom.com>
Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list@broadcom.com>
Cc: dri-devel@lists.freedesktop.org
---
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

Comments

Maaz Mombasawala Jan. 10, 2024, 8:51 p.m. UTC | #1 
On 1/10/24 12:03, Zack Rusin wrote:
> vmw_context_cotable can return either an error or a null pointer and its
> usage sometimes went unchecked. Subsequent code would then try to access
> either a null pointer or an error value.
> 
> The invalid dereferences were only possible with malformed userspace
> apps which never properly initialized the rendering contexts.
> 
> Check the results of vmw_context_cotable to fix the invalid derefs.
> 
> Thanks:
> ziming zhang(@ezrak1e) from Ant Group Light-Year Security Lab
> who was the first person to discover it.
> Niels De Graef who reported it and helped to track down the poc.
> 
> Fixes: 9c079b8ce8bf ("drm/vmwgfx: Adapt execbuf to the new validation api")
> Cc: <stable@vger.kernel.org> # v4.20+
> Reported-by: Niels De Graef  <ndegraef@redhat.com>
> Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
> Cc: Martin Krastev <martin.krastev@broadcom.com>
> Cc: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
> Cc: Ian Forbes <ian.forbes@broadcom.com>
> Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list@broadcom.com>
> Cc: dri-devel@lists.freedesktop.org
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
> index 272141b6164c..4f09959d27ba 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
> @@ -447,7 +447,7 @@ static int vmw_resource_context_res_add(struct vmw_private *dev_priv,
>  	    vmw_res_type(ctx) == vmw_res_dx_context) {
>  		for (i = 0; i < cotable_max; ++i) {
>  			res = vmw_context_cotable(ctx, i);
> -			if (IS_ERR(res))
> +			if (IS_ERR_OR_NULL(res))
>  				continue;
>  
>  			ret = vmw_execbuf_res_val_add(sw_context, res,
> @@ -1266,6 +1266,8 @@ static int vmw_cmd_dx_define_query(struct vmw_private *dev_priv,
>  		return -EINVAL;
>  
>  	cotable_res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXQUERY);
> +	if (IS_ERR_OR_NULL(cotable_res))
> +		return cotable_res ? PTR_ERR(cotable_res) : -EINVAL;
>  	ret = vmw_cotable_notify(cotable_res, cmd->body.queryId);
>  
>  	return ret;
> @@ -2484,6 +2486,8 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv,
>  		return ret;
>  
>  	res = vmw_context_cotable(ctx_node->ctx, vmw_view_cotables[view_type]);
> +	if (IS_ERR_OR_NULL(res))
> +		return res ? PTR_ERR(res) : -EINVAL;
>  	ret = vmw_cotable_notify(res, cmd->defined_id);
>  	if (unlikely(ret != 0))
>  		return ret;
> @@ -2569,8 +2573,8 @@ static int vmw_cmd_dx_so_define(struct vmw_private *dev_priv,
>  
>  	so_type = vmw_so_cmd_to_type(header->id);
>  	res = vmw_context_cotable(ctx_node->ctx, vmw_so_cotables[so_type]);
> -	if (IS_ERR(res))
> -		return PTR_ERR(res);
> +	if (IS_ERR_OR_NULL(res))
> +		return res ? PTR_ERR(res) : -EINVAL;
>  	cmd = container_of(header, typeof(*cmd), header);
>  	ret = vmw_cotable_notify(res, cmd->defined_id);
>  
> @@ -2689,6 +2693,8 @@ static int vmw_cmd_dx_define_shader(struct vmw_private *dev_priv,
>  		return -EINVAL;
>  
>  	res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXSHADER);
> +	if (IS_ERR_OR_NULL(res))
> +		return res ? PTR_ERR(res) : -EINVAL;
>  	ret = vmw_cotable_notify(res, cmd->body.shaderId);
>  	if (ret)
>  		return ret;
> @@ -3010,6 +3016,8 @@ static int vmw_cmd_dx_define_streamoutput(struct vmw_private *dev_priv,
>  	}
>  
>  	res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_STREAMOUTPUT);
> +	if (IS_ERR_OR_NULL(res))
> +		return res ? PTR_ERR(res) : -EINVAL;
>  	ret = vmw_cotable_notify(res, cmd->body.soid);
>  	if (ret)
>  		return ret;

LGTM!

Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>

Thanks,

Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Martin Krastev Jan. 11, 2024, 8:41 a.m. UTC | #2 
On Wed, Jan 10, 2024 at 10:03 PM Zack Rusin <zack.rusin@broadcom.com> wrote:
>
> vmw_context_cotable can return either an error or a null pointer and its
> usage sometimes went unchecked. Subsequent code would then try to access
> either a null pointer or an error value.
>
> The invalid dereferences were only possible with malformed userspace
> apps which never properly initialized the rendering contexts.
>
> Check the results of vmw_context_cotable to fix the invalid derefs.
>
> Thanks:
> ziming zhang(@ezrak1e) from Ant Group Light-Year Security Lab
> who was the first person to discover it.
> Niels De Graef who reported it and helped to track down the poc.
>
> Fixes: 9c079b8ce8bf ("drm/vmwgfx: Adapt execbuf to the new validation api")
> Cc: <stable@vger.kernel.org> # v4.20+
> Reported-by: Niels De Graef  <ndegraef@redhat.com>
> Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
> Cc: Martin Krastev <martin.krastev@broadcom.com>
> Cc: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
> Cc: Ian Forbes <ian.forbes@broadcom.com>
> Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list@broadcom.com>
> Cc: dri-devel@lists.freedesktop.org
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
> index 272141b6164c..4f09959d27ba 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
> @@ -447,7 +447,7 @@ static int vmw_resource_context_res_add(struct vmw_private *dev_priv,
>             vmw_res_type(ctx) == vmw_res_dx_context) {
>                 for (i = 0; i < cotable_max; ++i) {
>                         res = vmw_context_cotable(ctx, i);
> -                       if (IS_ERR(res))
> +                       if (IS_ERR_OR_NULL(res))
>                                 continue;
>
>                         ret = vmw_execbuf_res_val_add(sw_context, res,
> @@ -1266,6 +1266,8 @@ static int vmw_cmd_dx_define_query(struct vmw_private *dev_priv,
>                 return -EINVAL;
>
>         cotable_res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXQUERY);
> +       if (IS_ERR_OR_NULL(cotable_res))
> +               return cotable_res ? PTR_ERR(cotable_res) : -EINVAL;
>         ret = vmw_cotable_notify(cotable_res, cmd->body.queryId);
>
>         return ret;
> @@ -2484,6 +2486,8 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv,
>                 return ret;
>
>         res = vmw_context_cotable(ctx_node->ctx, vmw_view_cotables[view_type]);
> +       if (IS_ERR_OR_NULL(res))
> +               return res ? PTR_ERR(res) : -EINVAL;
>         ret = vmw_cotable_notify(res, cmd->defined_id);
>         if (unlikely(ret != 0))
>                 return ret;
> @@ -2569,8 +2573,8 @@ static int vmw_cmd_dx_so_define(struct vmw_private *dev_priv,
>
>         so_type = vmw_so_cmd_to_type(header->id);
>         res = vmw_context_cotable(ctx_node->ctx, vmw_so_cotables[so_type]);
> -       if (IS_ERR(res))
> -               return PTR_ERR(res);
> +       if (IS_ERR_OR_NULL(res))
> +               return res ? PTR_ERR(res) : -EINVAL;
>         cmd = container_of(header, typeof(*cmd), header);
>         ret = vmw_cotable_notify(res, cmd->defined_id);
>
> @@ -2689,6 +2693,8 @@ static int vmw_cmd_dx_define_shader(struct vmw_private *dev_priv,
>                 return -EINVAL;
>
>         res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXSHADER);
> +       if (IS_ERR_OR_NULL(res))
> +               return res ? PTR_ERR(res) : -EINVAL;
>         ret = vmw_cotable_notify(res, cmd->body.shaderId);
>         if (ret)
>                 return ret;
> @@ -3010,6 +3016,8 @@ static int vmw_cmd_dx_define_streamoutput(struct vmw_private *dev_priv,
>         }
>
>         res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_STREAMOUTPUT);
> +       if (IS_ERR_OR_NULL(res))
> +               return res ? PTR_ERR(res) : -EINVAL;
>         ret = vmw_cotable_notify(res, cmd->body.soid);
>         if (ret)
>                 return ret;
> --
> 2.40.1
>

LGTM

Reviewed-by: Martin Krastev <martin.krastev@broadcom.com>

Regards,
Martin
diff mbox series

Patch

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 272141b6164c..4f09959d27ba 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -447,7 +447,7 @@  static int vmw_resource_context_res_add(struct vmw_private *dev_priv,
 	    vmw_res_type(ctx) == vmw_res_dx_context) {
 		for (i = 0; i < cotable_max; ++i) {
 			res = vmw_context_cotable(ctx, i);
-			if (IS_ERR(res))
+			if (IS_ERR_OR_NULL(res))
 				continue;
 
 			ret = vmw_execbuf_res_val_add(sw_context, res,
@@ -1266,6 +1266,8 @@  static int vmw_cmd_dx_define_query(struct vmw_private *dev_priv,
 		return -EINVAL;
 
 	cotable_res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXQUERY);
+	if (IS_ERR_OR_NULL(cotable_res))
+		return cotable_res ? PTR_ERR(cotable_res) : -EINVAL;
 	ret = vmw_cotable_notify(cotable_res, cmd->body.queryId);
 
 	return ret;
@@ -2484,6 +2486,8 @@  static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv,
 		return ret;
 
 	res = vmw_context_cotable(ctx_node->ctx, vmw_view_cotables[view_type]);
+	if (IS_ERR_OR_NULL(res))
+		return res ? PTR_ERR(res) : -EINVAL;
 	ret = vmw_cotable_notify(res, cmd->defined_id);
 	if (unlikely(ret != 0))
 		return ret;
@@ -2569,8 +2573,8 @@  static int vmw_cmd_dx_so_define(struct vmw_private *dev_priv,
 
 	so_type = vmw_so_cmd_to_type(header->id);
 	res = vmw_context_cotable(ctx_node->ctx, vmw_so_cotables[so_type]);
-	if (IS_ERR(res))
-		return PTR_ERR(res);
+	if (IS_ERR_OR_NULL(res))
+		return res ? PTR_ERR(res) : -EINVAL;
 	cmd = container_of(header, typeof(*cmd), header);
 	ret = vmw_cotable_notify(res, cmd->defined_id);
 
@@ -2689,6 +2693,8 @@  static int vmw_cmd_dx_define_shader(struct vmw_private *dev_priv,
 		return -EINVAL;
 
 	res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXSHADER);
+	if (IS_ERR_OR_NULL(res))
+		return res ? PTR_ERR(res) : -EINVAL;
 	ret = vmw_cotable_notify(res, cmd->body.shaderId);
 	if (ret)
 		return ret;
@@ -3010,6 +3016,8 @@  static int vmw_cmd_dx_define_streamoutput(struct vmw_private *dev_priv,
 	}
 
 	res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_STREAMOUTPUT);
+	if (IS_ERR_OR_NULL(res))
+		return res ? PTR_ERR(res) : -EINVAL;
 	ret = vmw_cotable_notify(res, cmd->body.soid);
 	if (ret)
 		return ret;