]> git.ipfire.org Git - thirdparty/linux.git/commit
drm/vmwgfx: Validate vmw_surface_metadata::array_size
authorIan Forbes <ian.forbes@broadcom.com>
Tue, 23 Jun 2026 19:33:14 +0000 (14:33 -0500)
committerZack Rusin <zack.rusin@broadcom.com>
Tue, 21 Jul 2026 15:44:53 +0000 (11:44 -0400)
commita4f55260f7f7d4dc4d0ee55063dfb0c457b77991
tree8379d12afed00661871e4fcef1694edf2e8bea05
parent0c9e6367639548307d3f578f6943ce72c9d39087
drm/vmwgfx: Validate vmw_surface_metadata::array_size

This field comes from userspace and should be validated against specific
limits depending on which Shader Model (SM) is available.

Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata")
Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com
drivers/gpu/drm/vmwgfx/vmwgfx_surface.c