github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/vmwgfx: Validate vmw_surface_metadata::array_size

Browse Source 
This field comes from userspace and should be validated against specific
limits depending on which Shader Model (SM) is available.

Fixes: 504901dbb0 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata")
Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com
This commit is contained in:
Ian Forbes 2026-06-23 14:33:14 -05:00 committed by Zack Rusin
parent 0c9e636763
commit a4f55260f7
1 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
View File

@ -78,7 +78,7 @@ static int vmw_gb_surface_unbind(struct vmw_resource *res,
static int vmw_gb_surface_destroy(struct vmw_resource *res);
static int
vmw_gb_surface_define_internal(struct drm_device *dev,
struct drm_vmw_gb_surface_create_ext_req *req,
const struct drm_vmw_gb_surface_create_ext_req *req,
struct drm_vmw_gb_surface_create_rep *rep,
struct drm_file *file_priv);
static int
@ -1503,7 +1503,7 @@ int vmw_gb_surface_reference_ext_ioctl(struct drm_device *dev, void *data,
*/
static int
vmw_gb_surface_define_internal(struct drm_device *dev,
struct drm_vmw_gb_surface_create_ext_req *req,
const struct drm_vmw_gb_surface_create_ext_req *req,
struct drm_vmw_gb_surface_create_rep *rep,
struct drm_file *file_priv)
{
@ -1521,9 +1521,21 @@ vmw_gb_surface_define_internal(struct drm_device *dev,
req->base.svga3d_flags);
/* array_size must be null for non-GL3 host. */
if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) {
VMW_DEBUG_USER("SM4 surface not supported.\n");
return -EINVAL;
if (req->base.array_size > 0) {
if (has_sm5_context(dev_priv)) {
if (req->base.array_size > SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE) {
VMW_DEBUG_USER("Invalid Surface Array Size.\n");
return -EINVAL;
}
} else if (has_sm4_context(dev_priv)) {
if (req->base.array_size > SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE) {
VMW_DEBUG_USER("Invalid Surface Array Size.\n");
return -EINVAL;
}
} else {
VMW_DEBUG_USER("SM4+ surface not supported.\n");
return -EINVAL;
}
}
if (!has_sm4_1_context(dev_priv)) {