drm/vmwgfx: Validate the box size for the snooped cursor
commit4cf949c7fa
upstream. Invalid userspace dma surface copies could potentially overflow the memcpy from the surface to the snooped image leading to crashes. To fix it the dimensions of the copybox have to be validated against the expected size of the snooped cursor. Signed-off-by: Zack Rusin <zackr@vmware.com> Fixes:2ac863719e
("vmwgfx: Snoop DMA transfers with non-covering sizes") Cc: <stable@vger.kernel.org> # v3.2+ Reviewed-by: Michael Banack <banackm@vmware.com> Reviewed-by: Martin Krastev <krastevm@vmware.com> Link: https://patchwork.freedesktop.org/patch/msgid/20221026031936.1004280-1-zack@kde.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
080569aa3c
commit
ee8d31836c
|
@ -301,7 +301,8 @@ void vmw_kms_cursor_snoop(struct vmw_surface *srf,
|
|||
if (cmd->dma.guest.ptr.offset % PAGE_SIZE ||
|
||||
box->x != 0 || box->y != 0 || box->z != 0 ||
|
||||
box->srcx != 0 || box->srcy != 0 || box->srcz != 0 ||
|
||||
box->d != 1 || box_count != 1) {
|
||||
box->d != 1 || box_count != 1 ||
|
||||
box->w > 64 || box->h > 64) {
|
||||
/* TODO handle none page aligned offsets */
|
||||
/* TODO handle more dst & src != 0 */
|
||||
/* TODO handle more then one copy */
|
||||
|
|
Loading…
Reference in New Issue