github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/drivers/gpu/drm/vmwgfx
History
Ian Forbes a4f55260f7 drm/vmwgfx: Validate vmw_surface_metadata::array_size 
This field comes from userspace and should be validated against specific
limits depending on which Shader Model (SM) is available.

Fixes: 504901dbb0 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata")
Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com
2026-07-21 11:44:53 -04:00
..
device_include
Kconfig PCI: Add CONFIG_MMU dependency 2025-04-23 15:40:30 -05:00
Makefile drm/vmwgfx: Refactor cursor handling 2025-03-10 14:30:33 -04:00
ttm_object.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ttm_object.h drm/vmwgfx: Make all surfaces shareable 2024-01-30 14:18:18 -05:00
vmw_surface_cache.h drm/vmwgfx: Fix handling of dumb buffers 2024-07-24 22:21:53 -04:00
vmwgfx_binding.c fix missing vmalloc.h includes 2024-04-25 20:55:49 -07:00
vmwgfx_binding.h
vmwgfx_blit.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
vmwgfx_bo.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_bo.h drm/vmwgfx: Switch to exclusively using GEM references 2025-03-18 23:59:51 -04:00
vmwgfx_cmd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_cmdbuf_res.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_cmdbuf.c Merge drm/drm-fixes into drm-misc-fixes 2026-02-23 10:09:45 +01:00
vmwgfx_context.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_cotable.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_cursor_plane.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
vmwgfx_cursor_plane.h drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
vmwgfx_devcaps.c fix missing vmalloc.h includes 2024-04-25 20:55:49 -07:00
vmwgfx_devcaps.h
vmwgfx_drv.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_drv.h drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
vmwgfx_execbuf.c drm/vmwgfx: Return the correct value in vmw_translate_ptr functions 2026-02-05 12:44:23 -05:00
vmwgfx_fence.c dma-buf: inline spinlock for fence protection v5 2026-02-23 16:14:19 +01:00
vmwgfx_fence.h drm/vmwgfx: Implement dma_fence_ops properly 2025-06-17 22:49:33 -04:00
vmwgfx_gem.c drm/ttm: rename ttm_bo_put to _fini v3 2025-09-17 14:03:21 +02:00
vmwgfx_gmr.c
vmwgfx_gmrid_manager.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_ioctl.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_irq.c drm/vmwgfx: Implement dma_fence_ops properly 2025-06-17 22:49:33 -04:00
vmwgfx_kms.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
vmwgfx_kms.h drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00
vmwgfx_ldu.c drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00
vmwgfx_mksstat.h
vmwgfx_mob.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_msg_arm64.h drm/vmwgfx: Use VMware hypercall API 2024-06-25 17:15:47 +02:00
vmwgfx_msg_x86.h drm/vmwgfx: Use VMware hypercall API 2024-06-25 17:15:47 +02:00
vmwgfx_msg.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
vmwgfx_overlay.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_page_dirty.c drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release 2026-02-05 12:43:51 -05:00
vmwgfx_prime.c drm/vmwgfx: Fix handling of dumb buffers 2024-07-24 22:21:53 -04:00
vmwgfx_reg.h
vmwgfx_resource_priv.h
vmwgfx_resource.c drm/vmwgfx: Switch to exclusively using GEM references 2025-03-18 23:59:51 -04:00
vmwgfx_scrn.c drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00
vmwgfx_shader.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_simple_resource.c
vmwgfx_so.c
vmwgfx_so.h
vmwgfx_stdu.c drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00
vmwgfx_streamoutput.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_surface.c drm/vmwgfx: Validate vmw_surface_metadata::array_size 2026-07-21 11:44:53 -04:00
vmwgfx_system_manager.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_ttm_buffer.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmwgfx_va.c
vmwgfx_validation.c drm/vmwgfx: Fix copy-paste typo in validation 2025-10-06 11:57:59 -04:00
vmwgfx_validation.h drm/vmwgfx: Remove unused code 2024-03-28 21:25:08 -04:00
vmwgfx_vkms.c drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00
vmwgfx_vkms.h drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00