Re: [PATCH] drm/vmwgfx: Validate vmw_surface_metadata::array_size

[Maaz Mombasawala <maaz.mombasawala@broadcom.com>]

On 6/23/26 12:33 PM, Ian Forbes wrote:
> This field comes from userspace and should be validated against specific
> limits depending on which Shader Model (SM) is available.
> 
> Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata")
> Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +++++++++++++++++-----
>  1 file changed, 17 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
> index b2d3927b5567..bd0563741e89 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
> @@ -78,7 +78,7 @@ static int vmw_gb_surface_unbind(struct vmw_resource *res,
>  static int vmw_gb_surface_destroy(struct vmw_resource *res);
>  static int
>  vmw_gb_surface_define_internal(struct drm_device *dev,
> -			       struct drm_vmw_gb_surface_create_ext_req *req,
> +			       const  struct drm_vmw_gb_surface_create_ext_req *req,
>  			       struct drm_vmw_gb_surface_create_rep *rep,
>  			       struct drm_file *file_priv);
>  static int
> @@ -1503,7 +1503,7 @@ int vmw_gb_surface_reference_ext_ioctl(struct drm_device *dev, void *data,
>   */
>  static int
>  vmw_gb_surface_define_internal(struct drm_device *dev,
> -			       struct drm_vmw_gb_surface_create_ext_req *req,
> +			       const  struct drm_vmw_gb_surface_create_ext_req *req,
>  			       struct drm_vmw_gb_surface_create_rep *rep,
>  			       struct drm_file *file_priv)
>  {
> @@ -1521,9 +1521,21 @@ vmw_gb_surface_define_internal(struct drm_device *dev,
>  				req->base.svga3d_flags);
>  
>  	/* array_size must be null for non-GL3 host. */
> -	if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) {
> -		VMW_DEBUG_USER("SM4 surface not supported.\n");
> -		return -EINVAL;
> +	if (req->base.array_size > 0) {
> +		if (has_sm5_context(dev_priv)) {
> +			if (req->base.array_size > SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE) {
> +				VMW_DEBUG_USER("Invalid Surface Array Size.\n");
> +				return -EINVAL;
> +			}
> +		} else if (has_sm4_context(dev_priv)) {
> +			if (req->base.array_size > SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE) {
> +				VMW_DEBUG_USER("Invalid Surface Array Size.\n");
> +				return -EINVAL;
> +			}
> +		} else {
> +			VMW_DEBUG_USER("SM4+ surface not supported.\n");
> +			return -EINVAL;
> +		}
>  	}
>  
>  	if (!has_sm4_1_context(dev_priv)) {

LGTM!

Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>

-- 
Maaz Mombasawala <maaz.mombasawala@broadcom.com>