tree 29f80c6b9c9a03122c6a3cabfa9ca14d3a208290
parent 508716d00dcff9940ee933723bb1df5f3b8065f4
author Kristian H. Kristensen <hoegsberg@google.com> 1574289161 -0800
committer Mattias Nissler <mnissler@chromium.org> 1575369878 +0000

CHROMIUM: drm/i965: Reject execbuffer ioctls for blit ring

See CVE-2019-0155. libva uses the blitter to clear the VASurface before
decoding into it. The VA API allows for the video to be decoded into a
subrectangle of the surface, in which case the rest of the surface gets
cleared to a solid color.  Chrome always decodes to the entire surface
and the clear can be removed since the clear color is fully overwritten.

libva nevers checks the return value from execbuf, so we could stop
here, but CL:1923067 removes the blit commands from libva and returns
an error if Chrome ever starts using the subrectangle feature.

BUG=chromium:1024182
TEST=Video decode works for GPUs and codecs affected

Change-Id: Ie978d9c4093b4a1674eae3392bc2e0072a815396
Signed-off-by: Kristian H. Kristensen <hoegsberg@google.com>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/1933129
Tested-by: Kristian H. Kristensen <hoegsberg@chromium.org>
Reviewed-by: Mattias Nissler <mnissler@chromium.org>
Reviewed-by: Miguel Casas <mcasas@chromium.org>
Commit-Queue: Kristian H. Kristensen <hoegsberg@chromium.org>
(cherry picked from commit 9dba8c4ac0a9442c9037564870e06a19cd733dc9)
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/1948625
Tested-by: Mattias Nissler <mnissler@chromium.org>