]> git.ipfire.org Git - thirdparty/linux.git/commit
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
authorZack Rusin <zack.rusin@broadcom.com>
Tue, 5 May 2026 22:22:22 +0000 (18:22 -0400)
committerZack Rusin <zack.rusin@broadcom.com>
Mon, 27 Jul 2026 15:29:24 +0000 (11:29 -0400)
commit83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa
tree5f066d93508414a14aa7081abb050f7f46bc4358
parent6a39ca1286dd97ad02bb8e03bbb65ee05368d778
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size

Two sites in vmwgfx_resource.c assign boolean literals to
res->guest_memory_size, which is an unsigned long allocation-size
field; the intended target is the adjacent res->guest_memory_dirty
bitfield.  After the assignments the field holds 0 or 1 instead of
the resource's MOB allocation size:

  - vmw_resource_release()       writes 0 (false), and
  - vmw_resource_unbind_list()   writes 1 (true).

Subsequent revalidation paths read guest_memory_size when computing
the dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer
allocation size (vmw_resource_buf_alloc()), producing zero-length
walks or wrap-around ranges that read or write past the MOB bitmap.
The dirty-tracking intent of the original code (mark the resource as
dirtied since the last sync) is also lost, since guest_memory_dirty
is never updated.

Rename both assignments to guest_memory_dirty.

Fixes: 668b206601c5 ("drm/vmwgfx: Stop using raw ttm_buffer_object's")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.7
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Reviewed-by: Ian Forbes <ian.forbes@broadcom.com>
Link: https://patch.msgid.link/20260505222728.519626-2-zack.rusin@broadcom.com
drivers/gpu/drm/vmwgfx/vmwgfx_resource.c