drm/vmwgfx: Validate vmw_surface_metadata::array_size

This field comes from userspace and should be validated against specific
limits depending on which Shader Model (SM) is available.

Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata")
Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index b2d3927b5567395748d322d234b07d0f91425b38..bd0563741e89d93ab4651dd8cdbd56bac4880dfc 100644 (file)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -78,7 +78,7 @@ static int vmw_gb_surface_unbind(struct vmw_resource *res,
 static int vmw_gb_surface_destroy(struct vmw_resource *res);
 static int
 vmw_gb_surface_define_internal(struct drm_device *dev,
-                              struct drm_vmw_gb_surface_create_ext_req *req,
+                              const  struct drm_vmw_gb_surface_create_ext_req *req,
                               struct drm_vmw_gb_surface_create_rep *rep,
                               struct drm_file *file_priv);
 static int
@@ -1503,7 +1503,7 @@ int vmw_gb_surface_reference_ext_ioctl(struct drm_device *dev, void *data,
  */
 static int
 vmw_gb_surface_define_internal(struct drm_device *dev,
-                              struct drm_vmw_gb_surface_create_ext_req *req,
+                              const  struct drm_vmw_gb_surface_create_ext_req *req,
                               struct drm_vmw_gb_surface_create_rep *rep,
                               struct drm_file *file_priv)
 {
@@ -1521,9 +1521,21 @@ vmw_gb_surface_define_internal(struct drm_device *dev,
                                req->base.svga3d_flags);
 
        /* array_size must be null for non-GL3 host. */
-       if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) {
-               VMW_DEBUG_USER("SM4 surface not supported.\n");
-               return -EINVAL;
+       if (req->base.array_size > 0) {
+               if (has_sm5_context(dev_priv)) {
+                       if (req->base.array_size > SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE) {
+                               VMW_DEBUG_USER("Invalid Surface Array Size.\n");
+                               return -EINVAL;
+                       }
+               } else if (has_sm4_context(dev_priv)) {
+                       if (req->base.array_size > SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE) {
+                               VMW_DEBUG_USER("Invalid Surface Array Size.\n");
+                               return -EINVAL;
+                       }
+               } else {
+                       VMW_DEBUG_USER("SM4+ surface not supported.\n");
+                       return -EINVAL;
+               }
        }
 
        if (!has_sm4_1_context(dev_priv)) {