]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
authorIan Forbes <ian.forbes@broadcom.com>
Tue, 21 Oct 2025 19:01:28 +0000 (14:01 -0500)
committerZack Rusin <zack.rusin@broadcom.com>
Fri, 7 Nov 2025 04:59:40 +0000 (23:59 -0500)
commit32b415a9dc2c212e809b7ebc2b14bc3fbda2b9af
treef6a8a6d5e2524cc0881fc83ffab7deffcacac305
parentb750f5a9d64df6cfe9103c7feb7314694318818d
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

This data originates from userspace and is used in buffer offset
calculations which could potentially overflow causing an out-of-bounds
access.

Fixes: 8ce75f8ab904 ("drm/vmwgfx: Update device includes for DX device functionality")
Reported-by: Rohit Keshri <rkeshri@redhat.com>
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/20251021190128.13014-1-ian.forbes@broadcom.com
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c