On Wed, Jan 10, 2024 at 10:03 PM Zack Rusin zack.rusin@broadcom.com wrote:

vmw_context_cotable can return either an error or a null pointer and its usage sometimes went unchecked. Subsequent code would then try to access either a null pointer or an error value.

The invalid dereferences were only possible with malformed userspace apps which never properly initialized the rendering contexts.

Check the results of vmw_context_cotable to fix the invalid derefs.

Thanks: ziming zhang(@ezrak1e) from Ant Group Light-Year Security Lab who was the first person to discover it. Niels De Graef who reported it and helped to track down the poc.

Fixes: 9c079b8ce8bf ("drm/vmwgfx: Adapt execbuf to the new validation api") Cc: stable@vger.kernel.org # v4.20+ Reported-by: Niels De Graef ndegraef@redhat.com Signed-off-by: Zack Rusin zack.rusin@broadcom.com Cc: Martin Krastev martin.krastev@broadcom.com Cc: Maaz Mombasawala maaz.mombasawala@broadcom.com Cc: Ian Forbes ian.forbes@broadcom.com Cc: Broadcom internal kernel review list bcm-kernel-feedback-list@broadcom.com Cc: dri-devel@lists.freedesktop.org

---

drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 272141b6164c..4f09959d27ba 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -447,7 +447,7 @@ static int vmw_resource_context_res_add(struct vmw_private *dev_priv, vmw_res_type(ctx) == vmw_res_dx_context) { for (i = 0; i < cotable_max; ++i) { res = vmw_context_cotable(ctx, i);

•                   if (IS_ERR(res))
  

•                   if (IS_ERR_OR_NULL(res))
                            continue;
  
                    ret = vmw_execbuf_res_val_add(sw_context, res,
  

@@ -1266,6 +1266,8 @@ static int vmw_cmd_dx_define_query(struct vmw_private *dev_priv, return -EINVAL;

    cotable_res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXQUERY);

•   if (IS_ERR_OR_NULL(cotable_res))
  

•           return cotable_res ? PTR_ERR(cotable_res) : -EINVAL;
    ret = vmw_cotable_notify(cotable_res, cmd->body.queryId);
  
    return ret;
  

@@ -2484,6 +2486,8 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv, return ret;

    res = vmw_context_cotable(ctx_node->ctx, vmw_view_cotables[view_type]);

•   if (IS_ERR_OR_NULL(res))
  

•           return res ? PTR_ERR(res) : -EINVAL;
    ret = vmw_cotable_notify(res, cmd->defined_id);
    if (unlikely(ret != 0))
            return ret;
  

@@ -2569,8 +2573,8 @@ static int vmw_cmd_dx_so_define(struct vmw_private *dev_priv,

    so_type = vmw_so_cmd_to_type(header->id);
    res = vmw_context_cotable(ctx_node->ctx, vmw_so_cotables[so_type]);

•   if (IS_ERR(res))
  

•           return PTR_ERR(res);
  

•   if (IS_ERR_OR_NULL(res))
  

•           return res ? PTR_ERR(res) : -EINVAL;
    cmd = container_of(header, typeof(*cmd), header);
    ret = vmw_cotable_notify(res, cmd->defined_id);
  
  

@@ -2689,6 +2693,8 @@ static int vmw_cmd_dx_define_shader(struct vmw_private *dev_priv, return -EINVAL;

    res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXSHADER);

•   if (IS_ERR_OR_NULL(res))
  

•           return res ? PTR_ERR(res) : -EINVAL;
    ret = vmw_cotable_notify(res, cmd->body.shaderId);
    if (ret)
            return ret;
  

@@ -3010,6 +3016,8 @@ static int vmw_cmd_dx_define_streamoutput(struct vmw_private *dev_priv, }

    res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_STREAMOUTPUT);

•   if (IS_ERR_OR_NULL(res))
  

•           return res ? PTR_ERR(res) : -EINVAL;
    ret = vmw_cotable_notify(res, cmd->body.soid);
    if (ret)
            return ret;
  

-- 2.40.1

LGTM

Reviewed-by: Martin Krastev martin.krastev@broadcom.com

Regards, Martin