|
Thomas Zimmermann |
f246ca |
From 4cf949c7fafe21e085a4ee386bb2dade9067316e Mon Sep 17 00:00:00 2001
|
|
Thomas Zimmermann |
f246ca |
From: Zack Rusin <zackr@vmware.com>
|
|
Thomas Zimmermann |
f246ca |
Date: Tue, 25 Oct 2022 23:19:35 -0400
|
|
Thomas Zimmermann |
f246ca |
Subject: drm/vmwgfx: Validate the box size for the snooped cursor
|
|
Thomas Zimmermann |
f246ca |
Git-commit: 4cf949c7fafe21e085a4ee386bb2dade9067316e
|
|
Thomas Zimmermann |
f246ca |
Patch-mainline: v6.2-rc1
|
|
Thomas Zimmermann |
f246ca |
References: bsc#1203332 CVE-2022-36280
|
|
Thomas Zimmermann |
f246ca |
|
|
Thomas Zimmermann |
f246ca |
Invalid userspace dma surface copies could potentially overflow
|
|
Thomas Zimmermann |
f246ca |
the memcpy from the surface to the snooped image leading to crashes.
|
|
Thomas Zimmermann |
f246ca |
To fix it the dimensions of the copybox have to be validated
|
|
Thomas Zimmermann |
f246ca |
against the expected size of the snooped cursor.
|
|
Thomas Zimmermann |
f246ca |
|
|
Thomas Zimmermann |
f246ca |
Signed-off-by: Zack Rusin <zackr@vmware.com>
|
|
Thomas Zimmermann |
f246ca |
Fixes: 2ac863719e51 ("vmwgfx: Snoop DMA transfers with non-covering sizes")
|
|
Thomas Zimmermann |
f246ca |
Cc: <stable@vger.kernel.org> # v3.2+
|
|
Thomas Zimmermann |
f246ca |
Reviewed-by: Michael Banack <banackm@vmware.com>
|
|
Thomas Zimmermann |
f246ca |
Reviewed-by: Martin Krastev <krastevm@vmware.com>
|
|
Thomas Zimmermann |
f246ca |
Link: https://patchwork.freedesktop.org/patch/msgid/20221026031936.1004280-1-zack@kde.org
|
|
Thomas Zimmermann |
f246ca |
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
|
|
Thomas Zimmermann |
f246ca |
---
|
|
Thomas Zimmermann |
f246ca |
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 3 ++-
|
|
Thomas Zimmermann |
f246ca |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
Thomas Zimmermann |
f246ca |
|
|
Thomas Zimmermann |
f246ca |
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
|
|
Thomas Zimmermann |
f246ca |
index 0342efdf9063..d434b6ae1092 100644
|
|
Thomas Zimmermann |
f246ca |
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
|
|
Thomas Zimmermann |
f246ca |
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
|
|
Thomas Zimmermann |
f246ca |
@@ -393,7 +393,8 @@ void vmw_kms_cursor_snoop(struct vmw_surface *srf,
|
|
Thomas Zimmermann |
f246ca |
if (cmd->dma.guest.ptr.offset % PAGE_SIZE ||
|
|
Thomas Zimmermann |
f246ca |
box->x != 0 || box->y != 0 || box->z != 0 ||
|
|
Thomas Zimmermann |
f246ca |
box->srcx != 0 || box->srcy != 0 || box->srcz != 0 ||
|
|
Thomas Zimmermann |
f246ca |
- box->d != 1 || box_count != 1) {
|
|
Thomas Zimmermann |
f246ca |
+ box->d != 1 || box_count != 1 ||
|
|
Thomas Zimmermann |
f246ca |
+ box->w > 64 || box->h > 64) {
|
|
Thomas Zimmermann |
f246ca |
/* TODO handle none page aligned offsets */
|
|
Thomas Zimmermann |
f246ca |
/* TODO handle more dst & src != 0 */
|
|
Thomas Zimmermann |
f246ca |
/* TODO handle more then one copy */
|
|
Thomas Zimmermann |
f246ca |
--
|
|
Thomas Zimmermann |
f246ca |
2.39.1
|
|
Thomas Zimmermann |
f246ca |
|