--- /dev/null
+From f4f1db96bfd68b81053693ba53405b6f510ac16c Mon Sep 17 00:00:00 2001
+From: Zack Rusin <zack.rusin@broadcom.com>
+Date: Tue, 5 May 2026 18:22:28 -0400
+Subject: drm/vmwgfx: bound DMA command body size against suffix pointer
+
+From: Zack Rusin <zack.rusin@broadcom.com>
+
+commit f4f1db96bfd68b81053693ba53405b6f510ac16c upstream.
+
+vmw_cmd_dma() locates the DMA suffix at
+
+ (unsigned long) &cmd->body + header->size - sizeof(*suffix)
+
+without checking that header->size is large enough to contain both
+cmd->body and the suffix. An undersized header makes the suffix
+pointer underflow back into the previous command in the bounce
+buffer. The verifier later writes suffix->maximumOffset, clobbering
+verified fields of an already-relocated earlier command -- a TOCTOU
+on the device-visible command stream that lets one command rewrite
+another's GMR id, surface id, or other authenticated fields.
+
+Reject the command if the body is too small for the suffix to fit.
+
+Fixes: 4e4ddd477743 ("drm/vmwgfx: Fix queries if no dma buffer thrashing is occuring.")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4.7
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Reviewed-by: Ian Forbes <ian.forbes@broadcom.com>
+Link: https://patch.msgid.link/20260505222728.519626-8-zack.rusin@broadcom.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -1516,6 +1516,12 @@ static int vmw_cmd_dma(struct vmw_privat
+ bool dirty;
+
+ cmd = container_of(header, typeof(*cmd), header);
++
++ if (unlikely(header->size < sizeof(cmd->body) + sizeof(*suffix))) {
++ VMW_DEBUG_USER("Illegal SVGA_3D_CMD_SURFACE_DMA size.\n");
++ return -EINVAL;
++ }
++
+ suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->body +
+ header->size - sizeof(*suffix));
+
--- /dev/null
+From f739416dc555fa205a785e5135d73fa39b26f35d Mon Sep 17 00:00:00 2001
+From: Zack Rusin <zack.rusin@broadcom.com>
+Date: Tue, 5 May 2026 18:22:26 -0400
+Subject: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
+
+From: Zack Rusin <zack.rusin@broadcom.com>
+
+commit f739416dc555fa205a785e5135d73fa39b26f35d upstream.
+
+ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's
+dma_buf->ops do not match the ttm_object_device's ops, but does so
+without releasing the reference acquired by dma_buf_get(). Any
+unprivileged renderD client passing a non-vmwgfx prime fd through the
+DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per
+call and indefinitely pins the foreign exporter's GEM resources.
+
+Funnel the error path through the existing dma_buf_put() so the
+reference is always dropped.
+
+Fixes: 65981f7681ab ("drm/ttm: Add a minimal prime implementation for ttm base objects")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4.7
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Reviewed-by: Ian Forbes <ian.forbes@broadcom.com>
+Link: https://patch.msgid.link/20260505222728.519626-6-zack.rusin@broadcom.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/ttm_object.c
++++ b/drivers/gpu/drm/vmwgfx/ttm_object.c
+@@ -551,14 +551,17 @@ int ttm_prime_fd_to_handle(struct ttm_ob
+ if (IS_ERR(dma_buf))
+ return PTR_ERR(dma_buf);
+
+- if (dma_buf->ops != &tdev->ops)
+- return -ENOSYS;
++ if (dma_buf->ops != &tdev->ops) {
++ ret = -ENOSYS;
++ goto out;
++ }
+
+ prime = (struct ttm_prime_object *) dma_buf->priv;
+ base = &prime->base;
+ *handle = base->handle;
+ ret = ttm_ref_object_add(tfile, base, NULL, false);
+
++out:
+ dma_buf_put(dma_buf);
+
+ return ret;
--- /dev/null
+From 85891d174707d8bddcec7a888fb4e1d17def34f3 Mon Sep 17 00:00:00 2001
+From: Zack Rusin <zack.rusin@broadcom.com>
+Date: Tue, 5 May 2026 18:22:27 -0400
+Subject: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
+
+From: Zack Rusin <zack.rusin@broadcom.com>
+
+commit 85891d174707d8bddcec7a888fb4e1d17def34f3 upstream.
+
+vmw_cmd_draw() computes
+
+ maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);
+
+where header->size is u32 and is taken straight from the user-supplied
+command stream. When header->size is less than sizeof(cmd->body) the
+unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.
+Any user-controlled cmd->body.numVertexDecls then passes the bound and
+the loop dereferences decl[i] far past the end of the kernel command
+bounce buffer, producing an out-of-bounds read of kernel memory.
+
+Reject undersized headers up front.
+
+Fixes: 7a73ba7469cb ("drm/vmwgfx: Use TTM handles instead of SIDs as user-space surface handles.")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4.7
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Reviewed-by: Ian Forbes <ian.forbes@broadcom.com>
+Link: https://patch.msgid.link/20260505222728.519626-7-zack.rusin@broadcom.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -1577,11 +1577,17 @@ static int vmw_cmd_draw(struct vmw_priva
+ uint32_t maxnum;
+ int ret;
+
++ cmd = container_of(header, typeof(*cmd), header);
++
++ if (unlikely(header->size < sizeof(cmd->body))) {
++ VMW_DEBUG_USER("Illegal DRAW_PRIMITIVES header size.\n");
++ return -EINVAL;
++ }
++
+ ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
+ if (unlikely(ret != 0))
+ return ret;
+
+- cmd = container_of(header, typeof(*cmd), header);
+ maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);
+
+ if (unlikely(cmd->body.numVertexDecls > maxnum)) {
drm-amdgpu-cap-gtt-size-to-physical-ram-on-apus.patch
drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch
drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch
+drm-vmwgfx-drop-dma_buf-reference-on-foreign-fd-prime-import.patch
+drm-vmwgfx-validate-draw_primitives-header-size-before-division.patch
+drm-vmwgfx-bound-dma-command-body-size-against-suffix-pointer.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
