drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA

[ Upstream commit d92b90f9a54d9300a6e883258e79f36dab53bfae ]

Replace the fake VLA at end of the vbva_mouse_pointer_shape shape with
a real VLA to fix a "memcpy: detected field-spanning write error" warning:

[   13.319813] memcpy: detected field-spanning write (size 16896) of single field "p->data" at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 (size 4)
[   13.319841] WARNING: CPU: 0 PID: 1105 at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 hgsmi_update_pointer_shape+0x192/0x1c0 [vboxvideo]
[   13.320038] Call Trace:
[   13.320173]  hgsmi_update_pointer_shape [vboxvideo]
[   13.320184]  vbox_cursor_atomic_update [vboxvideo]

Note as mentioned in the added comment it seems the original length
calculation for the allocated and send hgsmi buffer is 4 bytes too large.
Changing this is not the goal of this patch, so this behavior is kept.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240827104523.17442-1-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/gpu/drm/vboxvideo/hgsmi_base.c b/drivers/gpu/drm/vboxvideo/hgsmi_base.c
index 361d3193258eafbd4abe68b8c3ba38283a6e3bab..7edc9cf6a6069dd8cd1d1c8ab32d09ede0cb8119 100644 (file)
--- a/drivers/gpu/drm/vboxvideo/hgsmi_base.c
+++ b/drivers/gpu/drm/vboxvideo/hgsmi_base.c
@@ -135,7 +135,15 @@ int hgsmi_update_pointer_shape(struct gen_pool *ctx, u32 flags,
                flags |= VBOX_MOUSE_POINTER_VISIBLE;
        }
 
-       p = hgsmi_buffer_alloc(ctx, sizeof(*p) + pixel_len, HGSMI_CH_VBVA,
+       /*
+        * The 4 extra bytes come from switching struct vbva_mouse_pointer_shape
+        * from having a 4 bytes fixed array at the end to using a proper VLA
+        * at the end. These 4 extra bytes were not subtracted from sizeof(*p)
+        * before the switch to the VLA, so this way the behavior is unchanged.
+        * Chances are these 4 extra bytes are not necessary but they are kept
+        * to avoid regressions.
+        */
+       p = hgsmi_buffer_alloc(ctx, sizeof(*p) + pixel_len + 4, HGSMI_CH_VBVA,
                               VBVA_MOUSE_POINTER_SHAPE);
        if (!p)
                return -ENOMEM;

diff --git a/drivers/gpu/drm/vboxvideo/vboxvideo.h b/drivers/gpu/drm/vboxvideo/vboxvideo.h
index a5de40fe1a76a30978208c5dde2b2ed6172bf5ed..bed285fe083c876262c8c5f81b5a46a8d3ca8265 100644 (file)
--- a/drivers/gpu/drm/vboxvideo/vboxvideo.h
+++ b/drivers/gpu/drm/vboxvideo/vboxvideo.h
@@ -351,10 +351,8 @@ struct vbva_mouse_pointer_shape {
         * Bytes in the gap between the AND and the XOR mask are undefined.
         * XOR mask scanlines have no gap between them and size of XOR mask is:
         * xor_len = width * 4 * height.
-        *
-        * Preallocate 4 bytes for accessing actual data as p->data.
         */
-       u8 data[4];
+       u8 data[];
 } __packed;
 
 /* pointer is visible */