CHROMIUM: drm/i965: Reject execbuffer ioctls for blit ring
See CVE-2019-0155. libva uses the blitter to clear the VASurface before
decoding into it. The VA API allows for the video to be decoded into a
subrectangle of the surface, in which case the rest of the surface gets
cleared to a solid color. Chrome always decodes to the entire surface
and the clear can be removed since the clear color is fully overwritten.
libva nevers checks the return value from execbuf, so we could stop
here, but CL:1923067 removes the blit commands from libva and returns
an error if Chrome ever starts using the subrectangle feature.
BUG=chromium:1024182
TEST=Video decode works for GPUs and codecs affected
Change-Id: Ie978d9c4093b4a1674eae3392bc2e0072a815396
Signed-off-by: Kristian H. Kristensen <hoegsberg@google.com>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/1927351
Tested-by: Kristian H. Kristensen <hoegsberg@chromium.org>
Reviewed-by: Mattias Nissler <mnissler@chromium.org>
Reviewed-by: Miguel Casas <mcasas@chromium.org>
Commit-Queue: Kristian H. Kristensen <hoegsberg@chromium.org>
(cherry picked from commit 97fce269706f2e05d7be4304763307a1fbe3a0f4)
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/1948624
Tested-by: Mattias Nissler <mnissler@chromium.org>
1 file changed
