From: Greg Kroah-Hartman Date: Wed, 5 Aug 2026 12:19:28 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v5.10.263~23 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5a52f31b1ab38d093d39310557421162e3a83c20;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: drm-vmwgfx-bound-dma-command-body-size-against-suffix-pointer.patch drm-vmwgfx-drop-dma_buf-reference-on-foreign-fd-prime-import.patch drm-vmwgfx-validate-draw_primitives-header-size-before-division.patch --- diff --git a/queue-6.1/drm-vmwgfx-bound-dma-command-body-size-against-suffix-pointer.patch b/queue-6.1/drm-vmwgfx-bound-dma-command-body-size-against-suffix-pointer.patch new file mode 100644 index 0000000000..388fd98220 --- /dev/null +++ b/queue-6.1/drm-vmwgfx-bound-dma-command-body-size-against-suffix-pointer.patch @@ -0,0 +1,49 @@ +From f4f1db96bfd68b81053693ba53405b6f510ac16c Mon Sep 17 00:00:00 2001 +From: Zack Rusin +Date: Tue, 5 May 2026 18:22:28 -0400 +Subject: drm/vmwgfx: bound DMA command body size against suffix pointer + +From: Zack Rusin + +commit f4f1db96bfd68b81053693ba53405b6f510ac16c upstream. + +vmw_cmd_dma() locates the DMA suffix at + + (unsigned long) &cmd->body + header->size - sizeof(*suffix) + +without checking that header->size is large enough to contain both +cmd->body and the suffix. An undersized header makes the suffix +pointer underflow back into the previous command in the bounce +buffer. The verifier later writes suffix->maximumOffset, clobbering +verified fields of an already-relocated earlier command -- a TOCTOU +on the device-visible command stream that lets one command rewrite +another's GMR id, surface id, or other authenticated fields. + +Reject the command if the body is too small for the suffix to fit. + +Fixes: 4e4ddd477743 ("drm/vmwgfx: Fix queries if no dma buffer thrashing is occuring.") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4.7 +Signed-off-by: Zack Rusin +Reviewed-by: Ian Forbes +Link: https://patch.msgid.link/20260505222728.519626-8-zack.rusin@broadcom.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -1516,6 +1516,12 @@ static int vmw_cmd_dma(struct vmw_privat + bool dirty; + + cmd = container_of(header, typeof(*cmd), header); ++ ++ if (unlikely(header->size < sizeof(cmd->body) + sizeof(*suffix))) { ++ VMW_DEBUG_USER("Illegal SVGA_3D_CMD_SURFACE_DMA size.\n"); ++ return -EINVAL; ++ } ++ + suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->body + + header->size - sizeof(*suffix)); + diff --git a/queue-6.1/drm-vmwgfx-drop-dma_buf-reference-on-foreign-fd-prime-import.patch b/queue-6.1/drm-vmwgfx-drop-dma_buf-reference-on-foreign-fd-prime-import.patch new file mode 100644 index 0000000000..8f7a1712a4 --- /dev/null +++ b/queue-6.1/drm-vmwgfx-drop-dma_buf-reference-on-foreign-fd-prime-import.patch @@ -0,0 +1,52 @@ +From f739416dc555fa205a785e5135d73fa39b26f35d Mon Sep 17 00:00:00 2001 +From: Zack Rusin +Date: Tue, 5 May 2026 18:22:26 -0400 +Subject: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import + +From: Zack Rusin + +commit f739416dc555fa205a785e5135d73fa39b26f35d upstream. + +ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's +dma_buf->ops do not match the ttm_object_device's ops, but does so +without releasing the reference acquired by dma_buf_get(). Any +unprivileged renderD client passing a non-vmwgfx prime fd through the +DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per +call and indefinitely pins the foreign exporter's GEM resources. + +Funnel the error path through the existing dma_buf_put() so the +reference is always dropped. + +Fixes: 65981f7681ab ("drm/ttm: Add a minimal prime implementation for ttm base objects") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4.7 +Signed-off-by: Zack Rusin +Reviewed-by: Ian Forbes +Link: https://patch.msgid.link/20260505222728.519626-6-zack.rusin@broadcom.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/ttm_object.c ++++ b/drivers/gpu/drm/vmwgfx/ttm_object.c +@@ -551,14 +551,17 @@ int ttm_prime_fd_to_handle(struct ttm_ob + if (IS_ERR(dma_buf)) + return PTR_ERR(dma_buf); + +- if (dma_buf->ops != &tdev->ops) +- return -ENOSYS; ++ if (dma_buf->ops != &tdev->ops) { ++ ret = -ENOSYS; ++ goto out; ++ } + + prime = (struct ttm_prime_object *) dma_buf->priv; + base = &prime->base; + *handle = base->handle; + ret = ttm_ref_object_add(tfile, base, NULL, false); + ++out: + dma_buf_put(dma_buf); + + return ret; diff --git a/queue-6.1/drm-vmwgfx-validate-draw_primitives-header-size-before-division.patch b/queue-6.1/drm-vmwgfx-validate-draw_primitives-header-size-before-division.patch new file mode 100644 index 0000000000..50054d5d19 --- /dev/null +++ b/queue-6.1/drm-vmwgfx-validate-draw_primitives-header-size-before-division.patch @@ -0,0 +1,54 @@ +From 85891d174707d8bddcec7a888fb4e1d17def34f3 Mon Sep 17 00:00:00 2001 +From: Zack Rusin +Date: Tue, 5 May 2026 18:22:27 -0400 +Subject: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division + +From: Zack Rusin + +commit 85891d174707d8bddcec7a888fb4e1d17def34f3 upstream. + +vmw_cmd_draw() computes + + maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); + +where header->size is u32 and is taken straight from the user-supplied +command stream. When header->size is less than sizeof(cmd->body) the +unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. +Any user-controlled cmd->body.numVertexDecls then passes the bound and +the loop dereferences decl[i] far past the end of the kernel command +bounce buffer, producing an out-of-bounds read of kernel memory. + +Reject undersized headers up front. + +Fixes: 7a73ba7469cb ("drm/vmwgfx: Use TTM handles instead of SIDs as user-space surface handles.") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4.7 +Signed-off-by: Zack Rusin +Reviewed-by: Ian Forbes +Link: https://patch.msgid.link/20260505222728.519626-7-zack.rusin@broadcom.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -1577,11 +1577,17 @@ static int vmw_cmd_draw(struct vmw_priva + uint32_t maxnum; + int ret; + ++ cmd = container_of(header, typeof(*cmd), header); ++ ++ if (unlikely(header->size < sizeof(cmd->body))) { ++ VMW_DEBUG_USER("Illegal DRAW_PRIMITIVES header size.\n"); ++ return -EINVAL; ++ } ++ + ret = vmw_cmd_cid_check(dev_priv, sw_context, header); + if (unlikely(ret != 0)) + return ret; + +- cmd = container_of(header, typeof(*cmd), header); + maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); + + if (unlikely(cmd->body.numVertexDecls > maxnum)) { diff --git a/queue-6.1/series b/queue-6.1/series index dca2204d5e..9a1a29f4b2 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -469,3 +469,6 @@ drm-amdgpu-restore-umd-profile-pstate-after-runtime-resume.patch drm-amdgpu-cap-gtt-size-to-physical-ram-on-apus.patch drm-amdkfd-handle-invalid-event-type-in-criu-event-restore.patch drm-amdkfd-hold-event_mutex-while-checkpointing-criu-events.patch +drm-vmwgfx-drop-dma_buf-reference-on-foreign-fd-prime-import.patch +drm-vmwgfx-validate-draw_primitives-header-size-before-division.patch +drm-vmwgfx-bound-dma-command-body-size-against-suffix-pointer.patch