Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package virglrenderer for openSUSE:Factory checked in at 2022-01-23 12:15:19 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/virglrenderer (Old) and /work/SRC/openSUSE:Factory/.virglrenderer.new.1938 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "virglrenderer" Sun Jan 23 12:15:19 2022 rev:14 rq:947915 version:0.9.1 Changes: -------- --- /work/SRC/openSUSE:Factory/virglrenderer/virglrenderer.changes 2021-05-01 00:46:12.647582417 +0200 +++ /work/SRC/openSUSE:Factory/.virglrenderer.new.1938/virglrenderer.changes 2022-01-23 12:16:37.720090719 +0100 @@ -1,0 +2,14 @@ +Fri Jan 21 10:45:13 UTC 2022 - Dario Faggioli <dfaggi...@suse.com> + +- Pick up the full upstream patch for bsc#1194601, so we know from where it comes + * No functional change intended + +------------------------------------------------------------------- +Mon Jan 17 07:47:07 UTC 2022 - pgaj...@suse.com + +- security update +- added patches + fix CVE-2022-0175 [bsc#1194601], VUL-0: CVE-2022-0175: virglrenderer: Missing initialization of res->ptr + + virglrenderer-CVE-2022-0175.patch + +------------------------------------------------------------------- New: ---- virglrenderer-CVE-2022-0175.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ virglrenderer.spec ++++++ --- /var/tmp/diff_new_pack.KTAWik/_old 2022-01-23 12:16:38.188087592 +0100 +++ /var/tmp/diff_new_pack.KTAWik/_new 2022-01-23 12:16:38.196087538 +0100 @@ -1,7 +1,7 @@ # # spec file for package virglrenderer # -# Copyright (c) 2021 SUSE LLC +# Copyright (c) 2022 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -25,6 +25,8 @@ Group: Development/Libraries/C and C++ URL: https://virgil3d.github.io/ Source0: https://gitlab.freedesktop.org/virgl/%{name}/-/archive/%{name}-%{version}/%{name}-%{name}-%{version}.tar.gz +# CVE-2022-0175 [bsc#1194601], VUL-0: CVE-2022-0175: virglrenderer: Missing initialization of res->ptr +Patch0: virglrenderer-CVE-2022-0175.patch BuildRequires: Mesa-devel BuildRequires: meson >= 0.46 BuildRequires: pkgconfig >= 0.9.0 @@ -70,6 +72,7 @@ %prep %setup -q -n %{name}-%{name}-%{version} +%patch0 -p1 %build %meson ++++++ virglrenderer-CVE-2022-0175.patch ++++++ >From b05bb61f454eeb8a85164c8a31510aeb9d79129c Mon Sep 17 00:00:00 2001 From: Gert Wollny <gert.wol...@collabora.com> Date: Tue, 30 Nov 2021 09:29:42 +0100 Subject: [PATCH] vrend: clear memory when allocating a host-backed memory resource Closes: #249 Signed-off-by: Gert Wollny <gert.wol...@collabora.com> Reviewed-by: Chia-I Wu <olva...@gmail.com> --- src/vrend_renderer.c | 2 +- tests/test_virgl_transfer.c | 51 +++++++++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+), 1 deletion(-) diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c index 53c52d07..28f66972 100644 --- a/src/vrend_renderer.c +++ b/src/vrend_renderer.c @@ -7063,7 +7063,7 @@ vrend_resource_alloc_buffer(struct vrend_resource *gr, uint32_t flags) if (bind == VIRGL_BIND_CUSTOM) { /* use iovec directly when attached */ gr->storage_bits |= VREND_STORAGE_HOST_SYSTEM_MEMORY; - gr->ptr = malloc(size); + gr->ptr = calloc(1, size); if (!gr->ptr) return -ENOMEM; } else if (bind == VIRGL_BIND_STAGING) { diff --git a/tests/test_virgl_transfer.c b/tests/test_virgl_transfer.c index bf7f4381..3c53c3df 100644 --- a/tests/test_virgl_transfer.c +++ b/tests/test_virgl_transfer.c @@ -952,6 +952,56 @@ START_TEST(virgl_test_transfer_near_res_bounds_with_stride_succeeds) } END_TEST +START_TEST(test_vrend_host_backed_memory_no_data_leak) +{ + struct iovec iovs[1]; + int niovs = 1; + + struct virgl_context ctx = {0}; + + int ret = testvirgl_init_ctx_cmdbuf(&ctx); + + struct virgl_renderer_resource_create_args res; + res.handle = 0x400; + res.target = PIPE_BUFFER; + res.format = VIRGL_FORMAT_R8_UNORM; + res.nr_samples = 0; + res.last_level = 0; + res.array_size = 1; + res.bind = VIRGL_BIND_CUSTOM; + res.depth = 1; + res.width = 32; + res.height = 1; + res.flags = 0; + + uint32_t size = 32; + uint8_t* data = calloc(1, size); + memset(data, 1, 32); + iovs[0].iov_base = data; + iovs[0].iov_len = size; + + struct pipe_box box = {0,0,0, size, 1,1}; + + virgl_renderer_resource_create(&res, NULL, 0); + virgl_renderer_ctx_attach_resource(ctx.ctx_id, res.handle); + + ret = virgl_renderer_transfer_read_iov(res.handle, ctx.ctx_id, 0, 0, 0, + (struct virgl_box *)&box, 0, iovs, niovs); + + ck_assert_int_eq(ret, 0); + + for (int i = 0; i < 32; ++i) + ck_assert_int_eq(data[i], 0); + + virgl_renderer_ctx_detach_resource(1, res.handle); + + virgl_renderer_resource_unref(res.handle); + free(data); + +} +END_TEST + + static Suite *virgl_init_suite(void) { Suite *s; @@ -981,6 +1031,7 @@ static Suite *virgl_init_suite(void) tcase_add_test(tc_core, virgl_test_transfer_buffer_bad_strides); tcase_add_test(tc_core, virgl_test_transfer_2d_array_bad_layer_stride); tcase_add_test(tc_core, virgl_test_transfer_2d_bad_level); + tcase_add_test(tc_core, test_vrend_host_backed_memory_no_data_leak); tcase_add_loop_test(tc_core, virgl_test_transfer_res_read_valid, 0, PIPE_MAX_TEXTURE_TYPES); tcase_add_loop_test(tc_core, virgl_test_transfer_res_write_valid, 0, PIPE_MAX_TEXTURE_TYPES); -- GitLab
