queue-4.9/drm-vmwgfx-integer-underflow-in-vmw_cmd_dx_set_shader-leading-to-an-invalid-read.patch

   1 From 5ed7f4b5eca11c3c69e7c8b53e4321812bc1ee1e Mon Sep 17 00:00:00 2001
   2 From: Murray McAllister <murray.mcallister@gmail.com>
   3 Date: Mon, 20 May 2019 21:57:34 +1200
   4 Subject: drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read
   5
   6 From: Murray McAllister <murray.mcallister@gmail.com>
   7
   8 commit 5ed7f4b5eca11c3c69e7c8b53e4321812bc1ee1e upstream.
   9
  10 If SVGA_3D_CMD_DX_SET_SHADER is called with a shader ID
  11 of SVGA3D_INVALID_ID, and a shader type of
  12 SVGA3D_SHADERTYPE_INVALID, the calculated binding.shader_slot
  13 will be 4294967295, leading to an out-of-bounds read in vmw_binding_loc()
  14 when the offset is calculated.
  15
  16 Cc: <stable@vger.kernel.org>
  17 Fixes: d80efd5cb3de ("drm/vmwgfx: Initial DX support")
  18 Signed-off-by: Murray McAllister <murray.mcallister@gmail.com>
  19 Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
  20 Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22
  23
  24 ---
  25  drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c |    3 ++-
  26  1 file changed, 2 insertions(+), 1 deletion(-)
  27
  28 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
  29 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
  30 @@ -2493,7 +2493,8 @@ static int vmw_cmd_dx_set_shader(struct
  31
  32         cmd = container_of(header, typeof(*cmd), header);
  33
  34 -       if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX) {
  35 +       if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX ||
  36 +           cmd->body.type < SVGA3D_SHADERTYPE_MIN) {
  37                 DRM_ERROR("Illegal shader type %u.\n",
  38                           (unsigned) cmd->body.type);
  39                 return -EINVAL;