From 05639043d88c1ed4c13670721d222b8621d2fbca Mon Sep 17 00:00:00 2001

From: Joe Lawrence <joe.lawrence@redhat.com>

Date: Wed, 9 Feb 2022 13:27:43 -0500

Subject: [KPATCH CVE-2022-22942] drm/vmwgfx: kpatch fixes for CVE-2022-22942

Kernels:

3.10.0-1160.21.1.el7

3.10.0-1160.24.1.el7

3.10.0-1160.25.1.el7

3.10.0-1160.31.1.el7

3.10.0-1160.36.2.el7

3.10.0-1160.41.1.el7

3.10.0-1160.42.2.el7

3.10.0-1160.45.1.el7

3.10.0-1160.49.1.el7

3.10.0-1160.53.1.el7

Changes since last build:

arches: x86_64

vmwgfx_execbuf.o: changed function: vmw_execbuf_copy_fence_user

vmwgfx_execbuf.o: changed function: vmw_execbuf_process

vmwgfx_fence.o: changed function: vmw_fence_event_ioctl

vmwgfx_kms.o: changed function: vmw_kms_helper_validation_finish

---------------------------

Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-7/-/merge_requests/23

Approved-by: Yannick Cote (@ycote1)

Approved-by: Artem Savkov (@artem.savkov)

Kernels:

3.10.0-1160.21.1.el7

3.10.0-1160.24.1.el7

3.10.0-1160.25.1.el7

3.10.0-1160.31.1.el7

3.10.0-1160.36.2.el7

3.10.0-1160.41.1.el7

3.10.0-1160.42.2.el7

3.10.0-1160.45.1.el7

3.10.0-1160.49.1.el7

3.10.0-1160.53.1.el7

Modifications: none

commit 26695bc7aeaf0bae32d7ab7fcf8950143acb5020

Author: Dave Airlie <airlied@redhat.com>

Date:   Sat Jan 29 02:36:46 2022 -0500

    drm/vmwgfx: Fix stale file descriptors on failed usercopy

    Bugzilla: http://bugzilla.redhat.com/2047597

    CVE: CVE-2022-22942

    commit a0f90c8815706981c483a652a6aefca51a5e191c

    Author: Mathias Krause <minipli@grsecurity.net>

    Date:   Thu Jan 27 18:34:19 2022 +1000

        drm/vmwgfx: Fix stale file descriptors on failed usercopy

        A failing usercopy of the fence_rep object will lead to a stale entry in

        the file descriptor table as put_unused_fd() won't release it. This

        enables userland to refer to a dangling 'file' object through that still

        valid file descriptor, leading to all kinds of use-after-free

        exploitation scenarios.

        Fix this by deferring the call to fd_install() until after the usercopy

        has succeeded.

        Fixes: c906965dee22 ("drm/vmwgfx: Add export fence to file descriptor support")

        Signed-off-by: Mathias Krause <minipli@grsecurity.net>

        Signed-off-by: Zack Rusin <zackr@vmware.com>

        Signed-off-by: Dave Airlie <airlied@redhat.com>

        Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

    Signed-off-by: Dave Airlie <airlied@redhat.com>

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>

---

 drivers/gpu/drm/vmwgfx/vmwgfx_drv.h     |  5 ++--

 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 34 ++++++++++++-------------

 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c   |  2 +-

 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c     |  2 +-

 4 files changed, 21 insertions(+), 22 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h

index cd607ba9c2fe..efd540f02227 100644

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h

+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h

@@ -924,15 +924,14 @@ extern int vmw_execbuf_fence_commands(struct drm_file *file_priv,

 				      struct vmw_private *dev_priv,

 				      struct vmw_fence_obj **p_fence,

 				      uint32_t *p_handle);

-extern void vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,

+extern int vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,

 					struct vmw_fpriv *vmw_fp,

 					int ret,

 					struct drm_vmw_fence_rep __user

 					*user_fence_rep,

 					struct vmw_fence_obj *fence,

 					uint32_t fence_handle,

-					int32_t out_fence_fd,

-					struct sync_file *sync_file);

+					int32_t out_fence_fd);

 bool vmw_cmd_describe(const void *buf, u32 *size, char const **cmd);

 /**

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c

index 88b8178d4687..4f792fb89bb8 100644

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c

+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c

@@ -3595,20 +3595,19 @@ int vmw_execbuf_fence_commands(struct drm_file *file_priv,

  * object so we wait for it immediately, and then unreference the

  * user-space reference.

  */

-void

+int

 vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,

 			    struct vmw_fpriv *vmw_fp,

 			    int ret,

 			    struct drm_vmw_fence_rep __user *user_fence_rep,

 			    struct vmw_fence_obj *fence,

 			    uint32_t fence_handle,

-			    int32_t out_fence_fd,

-			    struct sync_file *sync_file)

+			    int32_t out_fence_fd)

 {

 	struct drm_vmw_fence_rep fence_rep;

 	if (user_fence_rep == NULL)

-		return;

+		return 0;

 	memset(&fence_rep, 0, sizeof(fence_rep));

@@ -3636,20 +3635,14 @@ vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,

 	 * and unreference the handle.

 	 */

 	if (unlikely(ret != 0) && (fence_rep.error == 0)) {

-		if (sync_file)

-			fput(sync_file->file);

-

-		if (fence_rep.fd != -1) {

-			put_unused_fd(fence_rep.fd);

-			fence_rep.fd = -1;

-		}

-

 		ttm_ref_object_base_unref(vmw_fp->tfile,

 					  fence_handle, TTM_REF_USAGE);

 		DRM_ERROR("Fence copy error. Syncing.\n");

 		(void) vmw_fence_obj_wait(fence, false, false,

 					  VMW_FENCE_WAIT_TIMEOUT);

 	}

+

+	return ret ? -EFAULT : 0;

 }

 /**

@@ -3997,16 +3990,23 @@ int vmw_execbuf_process(struct drm_file *file_priv,

 			(void) vmw_fence_obj_wait(fence, false, false,

 						  VMW_FENCE_WAIT_TIMEOUT);

+		}

+	}

+

+	ret = vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), ret,

+				    user_fence_rep, fence, handle, out_fence_fd);

+

+	if (sync_file) {

+		if (ret) {

+			/* usercopy of fence failed, put the file object */

+			fput(sync_file->file);

+			put_unused_fd(out_fence_fd);

 		} else {

 			/* Link the fence with the FD created earlier */

 			fd_install(out_fence_fd, sync_file->file);

 		}

 	}

-	vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), ret,

-				    user_fence_rep, fence, handle,

-				    out_fence_fd, sync_file);

-

 	/* Don't unreference when handing fence out */

 	if (unlikely(out_fence != NULL)) {

 		*out_fence = fence;

@@ -4024,7 +4024,7 @@ int vmw_execbuf_process(struct drm_file *file_priv,

 	 */

 	vmw_validation_unref_lists(&val_ctx);

-	return 0;

+	return ret;

 out_unlock_binding:

 	mutex_unlock(&dev_priv->binding_mutex);

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c

index 301260e23e52..624754cc4fc1 100644

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c

+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c

@@ -1167,7 +1167,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,

 	}

 	vmw_execbuf_copy_fence_user(dev_priv, vmw_fp, 0, user_fence_rep, fence,

-				    handle, -1, NULL);

+				    handle, -1);

 	vmw_fence_obj_unreference(&fence);

 	return 0;

 out_no_create:

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c

index ed2f67822f45..fdf58090aa4a 100644

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c

+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c

@@ -2565,7 +2565,7 @@ void vmw_kms_helper_validation_finish(struct vmw_private *dev_priv,

 	if (file_priv)

 		vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv),

 					    ret, user_fence_rep, fence,

-					    handle, -1, NULL);

+					    handle, -1);

 	if (out_fence)

 		*out_fence = fence;

 	else

-- 

2.26.3