CHROMIUM: drm/i965: Reject execbuffer ioctls for blit ring
See CVE-2019-0155. libva uses the blitter to clear the VASurface before
decoding into it. The VA API allows for the video to be decoded into a
subrectangle of the surface, in which case the rest of the surface gets
cleared to a solid color. Chrome always decodes to the entire surface
and the clear can be removed since the clear color is fully overwritten.
libva nevers checks the return value from execbuf, so we could stop
here, but CL:1923067 removes the blit commands from libva and returns
an error if Chrome ever starts using the subrectangle feature.
BUG=chromium:1024182
TEST=Video decode works for GPUs and codecs affected
Change-Id: Ie978d9c4093b4a1674eae3392bc2e0072a815396
Signed-off-by: Kristian H. Kristensen <hoegsberg@google.com>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/1933129
Tested-by: Kristian H. Kristensen <hoegsberg@chromium.org>
Reviewed-by: Mattias Nissler <mnissler@chromium.org>
Reviewed-by: Miguel Casas <mcasas@chromium.org>
Commit-Queue: Kristian H. Kristensen <hoegsberg@chromium.org>
(cherry picked from commit 9dba8c4ac0a9442c9037564870e06a19cd733dc9)
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/1948625
Tested-by: Mattias Nissler <mnissler@chromium.org>
1 file changed
