From e345ccbabe6b185e33b79149ebfc16bdd7349798 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Thu, 26 Jan 2017 21:26:41 +0000 Subject: [PATCH] [armhf,arm64] Add security fixes for vc4 driver --- debian/changelog | 4 +++ ...rflow-in-temporary-allocation-layout.patch | 36 +++++++++++++++++++ ...inval-on-the-overflow-checks-failing.patch | 27 ++++++++++++++ debian/patches/series | 2 ++ 4 files changed, 69 insertions(+) create mode 100644 debian/patches/bugfix/arm/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch create mode 100644 debian/patches/bugfix/arm/drm/vc4-return-einval-on-the-overflow-checks-failing.patch diff --git a/debian/changelog b/debian/changelog index e0d5c2b04..ce75e1918 100644 --- a/debian/changelog +++ b/debian/changelog @@ -459,6 +459,10 @@ linux (4.9.6-1) UNRELEASED; urgency=medium * fs: Disable LOGFS, as it is unmaintained and will be removed in 4.10 * [rt] genpatch.py: Verify tag and tarball signatures * fbdev: color map copying bounds checking (CVE-2016-8405) + * [armhf,arm64] drm/vc4: Fix an integer overflow in temporary allocation + layout. (CVE-2017-5576) + * [armhf,arm64] drm/vc4: Return -EINVAL on the overflow checks failing. + (CVE-2017-5577) [ Roger Shimizu ] * [armel] Add DT support of Buffalo Linkstation Live v3 (LS-CHL) diff --git a/debian/patches/bugfix/arm/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch b/debian/patches/bugfix/arm/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch new file mode 100644 index 000000000..be7736050 --- /dev/null +++ b/debian/patches/bugfix/arm/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch @@ -0,0 +1,36 @@ +From: Eric Anholt +Date: Wed, 18 Jan 2017 07:20:49 +1100 +Subject: drm/vc4: Fix an integer overflow in temporary allocation layout. +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-5576 +Origin: https://lkml.org/lkml/2017/1/17/761 + +We copy the unvalidated ioctl arguments from the user into kernel +temporary memory to run the validation from, to avoid a race where the +user updates the unvalidate contents in between validating them and +copying them into the validated BO. + +However, in setting up the layout of the kernel side, we failed to +check one of the additions (the roundup() for shader_rec_offset) +against integer overflow, allowing a nearly MAX_UINT value of +bin_cl_size to cause us to under-allocate the temporary space that we +then copy_from_user into. + +Reported-by: Murray McAllister +Signed-off-by: Eric Anholt +Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.") +--- + drivers/gpu/drm/vc4/vc4_gem.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vc4/vc4_gem.c ++++ b/drivers/gpu/drm/vc4/vc4_gem.c +@@ -594,7 +594,8 @@ vc4_get_bcl(struct drm_device *dev, stru + args->shader_rec_count); + struct vc4_bo *bo; + +- if (uniforms_offset < shader_rec_offset || ++ if (shader_rec_offset < args->bin_cl_size || ++ uniforms_offset < shader_rec_offset || + exec_size < uniforms_offset || + args->shader_rec_count >= (UINT_MAX / + sizeof(struct vc4_shader_state)) || diff --git a/debian/patches/bugfix/arm/drm/vc4-return-einval-on-the-overflow-checks-failing.patch b/debian/patches/bugfix/arm/drm/vc4-return-einval-on-the-overflow-checks-failing.patch new file mode 100644 index 000000000..95dc72119 --- /dev/null +++ b/debian/patches/bugfix/arm/drm/vc4-return-einval-on-the-overflow-checks-failing.patch @@ -0,0 +1,27 @@ +From: Eric Anholt +Date: Wed, 18 Jan 2017 07:20:50 +1100 +Subject: drm/vc4: Return -EINVAL on the overflow checks failing. +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-5577 +Origin: https://lkml.org/lkml/2017/1/17/759 + +By failing to set the errno, we'd continue on to trying to set up the +RCL, and then oops on trying to dereference the tile_bo that binning +validation should have set up. + +Reported-by: Ingo Molnar +Signed-off-by: Eric Anholt +Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.") +--- + drivers/gpu/drm/vc4/vc4_gem.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/vc4/vc4_gem.c ++++ b/drivers/gpu/drm/vc4/vc4_gem.c +@@ -601,6 +601,7 @@ vc4_get_bcl(struct drm_device *dev, stru + sizeof(struct vc4_shader_state)) || + temp_size < exec_size) { + DRM_ERROR("overflow in exec arguments\n"); ++ ret = -EINVAL; + goto fail; + } + diff --git a/debian/patches/series b/debian/patches/series index fd40d0c7a..dcbf05c05 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -100,6 +100,8 @@ features/all/securelevel/arm64-add-kernel-config-option-to-set-securelevel-wh.pa # Security fixes debian/i386-686-pae-pci-set-pci-nobios-by-default.patch bugfix/all/fbdev-color-map-coying-bounds-checking.patch +bugfix/arm/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch +bugfix/arm/drm/vc4-return-einval-on-the-overflow-checks-failing.patch # Fix exported symbol versions bugfix/ia64/revert-ia64-move-exports-to-definitions.patch