From 73c1db23af5c7364af380d21739a6e1220a2490d Mon Sep 17 00:00:00 2001

From: Joe Lawrence <joe.lawrence@redhat.com>

Date: Tue, 1 Mar 2022 15:34:07 -0500

Subject: [KPATCH CVE-2022-22942] drm/vmwgfx: kpatch fixes for CVE-2022-22942

Kernels:

4.18.0-348.el8

4.18.0-348.2.1.el8_5

4.18.0-348.7.1.el8_5

4.18.0-348.12.2.el8_5

Changes since last build:

arches: x86_64

vmwgfx_execbuf.o: changed function: vmw_execbuf_copy_fence_user

vmwgfx_execbuf.o: changed function: vmw_execbuf_process

vmwgfx_fence.o: changed function: vmw_fence_event_ioctl

vmwgfx_kms.o: changed function: vmw_kms_helper_validation_finish

---------------------------

Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-8/-/merge_requests/32

Approved-by: Yannick Cote (@ycote1)

Kernels:

4.18.0-348.el8

4.18.0-348.2.1.el8_5

4.18.0-348.7.1.el8_5

4.18.0-348.12.2.el8_5

Modifications: none

commit 1b221c65601c93cb4ad2b24487c0015d6bae7c7f

Author: Dave Airlie <airlied@redhat.com>

Date:   Fri Jan 28 16:36:48 2022 -0500

    drm/vmwgfx: Fix stale file descriptors on failed usercopy

    Bugzilla: https://bugzilla.redhat.com/2047601

    CVE: CVE-2022-22942

    Y-Commit: b6793b842fba127aa491384431e84b79c7619afd

    O-Bugzilla: http://bugzilla.redhat.com/2047602

    O-CVE: CVE-2022-22942

    commit a0f90c8815706981c483a652a6aefca51a5e191c

    Author: Mathias Krause <minipli@grsecurity.net>

    Date:   Thu Jan 27 18:34:19 2022 +1000

        drm/vmwgfx: Fix stale file descriptors on failed usercopy

        A failing usercopy of the fence_rep object will lead to a stale entry in

        the file descriptor table as put_unused_fd() won't release it. This

        enables userland to refer to a dangling 'file' object through that still

        valid file descriptor, leading to all kinds of use-after-free

        exploitation scenarios.

        Fix this by deferring the call to fd_install() until after the usercopy

        has succeeded.

        Fixes: c906965dee22 ("drm/vmwgfx: Add export fence to file descriptor support")

        Signed-off-by: Mathias Krause <minipli@grsecurity.net>

        Signed-off-by: Zack Rusin <zackr@vmware.com>

        Signed-off-by: Dave Airlie <airlied@redhat.com>

        Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

    Signed-off-by: Dave Airlie <airlied@redhat.com>

    Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>

---

 drivers/gpu/drm/vmwgfx/vmwgfx_drv.h     |  5 ++--

 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 33 +++++++++++++------------

 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c   |  2 +-

 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c     |  2 +-

 4 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h

index eb76a6b9ebca..2f4f39446240 100644

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h

+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h

@@ -1069,15 +1069,14 @@ extern int vmw_execbuf_fence_commands(struct drm_file *file_priv,

 				      struct vmw_private *dev_priv,

 				      struct vmw_fence_obj **p_fence,

 				      uint32_t *p_handle);

-extern void vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,

+extern int vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,

 					struct vmw_fpriv *vmw_fp,

 					int ret,

 					struct drm_vmw_fence_rep __user

 					*user_fence_rep,

 					struct vmw_fence_obj *fence,

 					uint32_t fence_handle,

-					int32_t out_fence_fd,

-					struct sync_file *sync_file);

+					int32_t out_fence_fd);

 bool vmw_cmd_describe(const void *buf, u32 *size, char const **cmd);

 /**

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c

index 462f17320708..399cb4cce292 100644

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c

+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c

@@ -3804,17 +3804,17 @@ int vmw_execbuf_fence_commands(struct drm_file *file_priv,

  * Also if copying fails, user-space will be unable to signal the fence object

  * so we wait for it immediately, and then unreference the user-space reference.

  */

-void

+int

 vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,

 			    struct vmw_fpriv *vmw_fp, int ret,

 			    struct drm_vmw_fence_rep __user *user_fence_rep,

 			    struct vmw_fence_obj *fence, uint32_t fence_handle,

-			    int32_t out_fence_fd, struct sync_file *sync_file)

+			    int32_t out_fence_fd)

 {

 	struct drm_vmw_fence_rep fence_rep;

 	if (user_fence_rep == NULL)

-		return;

+		return 0;

 	memset(&fence_rep, 0, sizeof(fence_rep));

@@ -3842,20 +3842,14 @@ vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,

 	 * handle.

 	 */

 	if (unlikely(ret != 0) && (fence_rep.error == 0)) {

-		if (sync_file)

-			fput(sync_file->file);

-

-		if (fence_rep.fd != -1) {

-			put_unused_fd(fence_rep.fd);

-			fence_rep.fd = -1;

-		}

-

 		ttm_ref_object_base_unref(vmw_fp->tfile, fence_handle,

 					  TTM_REF_USAGE);

 		VMW_DEBUG_USER("Fence copy error. Syncing.\n");

 		(void) vmw_fence_obj_wait(fence, false, false,

 					  VMW_FENCE_WAIT_TIMEOUT);

 	}

+

+	return ret ? -EFAULT : 0;

 }

 /**

@@ -4193,16 +4187,23 @@ int vmw_execbuf_process(struct drm_file *file_priv,

 			(void) vmw_fence_obj_wait(fence, false, false,

 						  VMW_FENCE_WAIT_TIMEOUT);

+		}

+	}

+

+	ret = vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), ret,

+				    user_fence_rep, fence, handle, out_fence_fd);

+

+	if (sync_file) {

+		if (ret) {

+			/* usercopy of fence failed, put the file object */

+			fput(sync_file->file);

+			put_unused_fd(out_fence_fd);

 		} else {

 			/* Link the fence with the FD created earlier */

 			fd_install(out_fence_fd, sync_file->file);

 		}

 	}

-	vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), ret,

-				    user_fence_rep, fence, handle, out_fence_fd,

-				    sync_file);

-

 	/* Don't unreference when handing fence out */

 	if (unlikely(out_fence != NULL)) {

 		*out_fence = fence;

@@ -4220,7 +4221,7 @@ int vmw_execbuf_process(struct drm_file *file_priv,

 	 */

 	vmw_validation_unref_lists(&val_ctx);

-	return 0;

+	return ret;

 out_unlock_binding:

 	mutex_unlock(&dev_priv->binding_mutex);

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c

index 378ec7600154..23cf8a264f3d 100644

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c

+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c

@@ -1167,7 +1167,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,

 	}

 	vmw_execbuf_copy_fence_user(dev_priv, vmw_fp, 0, user_fence_rep, fence,

-				    handle, -1, NULL);

+				    handle, -1);

 	vmw_fence_obj_unreference(&fence);

 	return 0;

 out_no_create:

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c

index 9a89f658e501..bb0448044ced 100644

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c

+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c

@@ -2477,7 +2477,7 @@ void vmw_kms_helper_validation_finish(struct vmw_private *dev_priv,

 	if (file_priv)

 		vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv),

 					    ret, user_fence_rep, fence,

-					    handle, -1, NULL);

+					    handle, -1);

 	if (out_fence)

 		*out_fence = fence;

 	else

-- 

2.34.1