From e3e6df412897e65d3afcf07a865195ecb76e7def Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.com>
Date: Tue, 5 Sep 2023 10:36:51 +0200
Subject: drm/vmwgfx: Test shader type against SVGA3d_SHADERTYPE_MIN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Patch-mainline: Never, upstream has replaced the fixed code
References: bsc#1203517 CVE-2022-36402
Fixes bsc#1203517 / CVE-2022-36402.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.com>
Suggested-by: Michal Koutný <mkoutny@suse.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.com>
---
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -2454,6 +2454,7 @@ static int vmw_cmd_dx_set_shader_res(str
if ((u64) cmd->body.startView + (u64) num_sr_view >
(u64) SVGA3D_DX_MAX_SRVIEWS ||
+ cmd->body.type < SVGA3D_SHADERTYPE_MIN ||
cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX) {
DRM_ERROR("Invalid shader binding.\n");
return -EINVAL;