Ian ForbesandZack Rusin a4f55260f7 drm/vmwgfx: Validate vmw_surface_metadata::array_size ...

This field comes from userspace and should be validated against specific
limits depending on which Shader Model (SM) is available.

Fixes: 504901dbb0 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata")
Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com

2026-07-21 11:44:53 -04:00

..

device_include

…

Kconfig

…

Makefile

…

ttm_object.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ttm_object.h

…

vmw_surface_cache.h

…

vmwgfx_binding.c

…

vmwgfx_binding.h

…

vmwgfx_blit.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

vmwgfx_bo.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_bo.h

…

vmwgfx_cmd.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_cmdbuf_res.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_cmdbuf.c

Merge drm/drm-fixes into drm-misc-fixes

2026-02-23 10:09:45 +01:00

vmwgfx_context.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_cotable.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_cursor_plane.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

vmwgfx_cursor_plane.h

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

vmwgfx_devcaps.c

…

vmwgfx_devcaps.h

…

vmwgfx_drv.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_drv.h

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

vmwgfx_execbuf.c

drm/vmwgfx: Return the correct value in vmw_translate_ptr functions

2026-02-05 12:44:23 -05:00

vmwgfx_fence.c

dma-buf: inline spinlock for fence protection v5

2026-02-23 16:14:19 +01:00

vmwgfx_fence.h

…

vmwgfx_gem.c

…

vmwgfx_gmr.c

…

vmwgfx_gmrid_manager.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_ioctl.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_irq.c

…

vmwgfx_kms.c

drm: Rename struct drm_atomic_state to drm_atomic_commit

2026-05-04 14:05:04 +10:00

vmwgfx_kms.h

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

vmwgfx_ldu.c

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

vmwgfx_mksstat.h

…

vmwgfx_mob.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_msg_arm64.h

…

vmwgfx_msg_x86.h

…

vmwgfx_msg.c

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

vmwgfx_overlay.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_page_dirty.c

drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release

2026-02-05 12:43:51 -05:00

vmwgfx_prime.c

…

vmwgfx_reg.h

…

vmwgfx_resource_priv.h

…

vmwgfx_resource.c

…

vmwgfx_scrn.c

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

vmwgfx_shader.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_simple_resource.c

…

vmwgfx_so.c

…

vmwgfx_so.h

…

vmwgfx_stdu.c

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

vmwgfx_streamoutput.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_surface.c

drm/vmwgfx: Validate vmw_surface_metadata::array_size

2026-07-21 11:44:53 -04:00

vmwgfx_system_manager.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_ttm_buffer.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vmwgfx_va.c

…

vmwgfx_validation.c

…

vmwgfx_validation.h

…

vmwgfx_vkms.c

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00

vmwgfx_vkms.h

Merge tag 'drm-misc-next-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-05-08 14:16:04 +10:00