Re: [PATCH 2/6] drm/vmwgfx: validate GB-only cursor command limits

["Maaz Mombasawala <maaz.mombasawala@broadcom.com>" <maaz.mombasawala@broadcom.com>]

On Tue Oct 27, 2026 at 2:17 PM PDT, Zack Rusin wrote:
> Guest-backed devices without cursor MOB support define cursor images with
> SVGA_CMD_DEFINE_ALPHA_CURSOR. SVGA_REG_CURSOR_MAX_DIMENSION belongs to the
> cursor MOB register class and reads as zero on devices that do not expose
> that class. Applying this register to GB-only cursors rejects every
> nonempty image submitted by KMS clients, leaving Xorg without a hardware
> cursor.
>
> The submission transport also limits the command size. A 96x96 image fits
> the 40 KiB FIFO image limit, but exceeds the 32 KiB command-buffer limit
> and causes a device command error when submitted through that transport.
>
> Validate GB-only images against SVGA_MAX_CURSOR_CMD_DIMENSION and
> SVGA_MAX_CURSOR_CMD_BYTES. For command-buffer submission, also bound the
> whole command by SVGA_CB_MAX_COMMAND_SIZE, including its header. Calculate
> the image byte count in 64 bits and keep the register-based dimension and
> MOB size checks for MOB cursors.
>
> Fixes: d5ed8749168a ("drm/vmwgfx: enforce cursor size limits for MOB cursors")
> Cc: stable@vger.kernel.org
> Reported-by: Yunfeng Li <yunfeng.li.nb@gmail.com>
> Closes: https://patch.msgid.link/20260830151619.2452307-1-yunfeng.li.nb@gmail.com
> Assisted-by: LLM
> Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 23 ++++++++++++++++++--
>  1 file changed, 21 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
> index 942d07079ef7..14490ead99cd 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c
> @@ -778,8 +778,27 @@ int vmw_cursor_plane_atomic_check(struct drm_plane *plane,
>  				 "surface not suitable for cursor\n");
>  			return -EINVAL;
>  		}
> -	} else if (update_type == VMW_CURSOR_UPDATE_GB_ONLY ||
> -		   update_type == VMW_CURSOR_UPDATE_MOB) {
> +	} else if (update_type == VMW_CURSOR_UPDATE_GB_ONLY) {
> +		u64 image_size = (u64)new_state->crtc_w *
> +				 new_state->crtc_h * sizeof(u32);
> +		u32 max_size = SVGA_MAX_CURSOR_CMD_BYTES;
> +
> +		/* The command-buffer limit includes the define-cursor header. */
> +		if (vmw->cman)
> +			max_size = min_t(u32, max_size,
> +					 SVGA_CB_MAX_COMMAND_SIZE -
> +					 sizeof(struct vmw_svga_fifo_cmd_define_cursor));
> +
> +		if (!new_state->crtc_w || !new_state->crtc_h ||
> +		    new_state->crtc_w > SVGA_MAX_CURSOR_CMD_DIMENSION ||
> +		    new_state->crtc_h > SVGA_MAX_CURSOR_CMD_DIMENSION ||
> +		    image_size > max_size) {

We should have a separate message for image_size > max_size.

> +			drm_dbg_kms(&vmw->drm,
> +				    "Cursor dimensions (%u, %u) violate command limits\n",
> +				    new_state->crtc_w, new_state->crtc_h);
> +			return -EINVAL;
> +		}
> +	} else if (update_type == VMW_CURSOR_UPDATE_MOB) {
>  		u32 cursor_max_dim =
>  			vmw_read(vmw, SVGA_REG_CURSOR_MAX_DIMENSION);
>  


-- 
Maaz Mombasawala <maaz.mombasawala@broadcom.com>