[PATCH] Backport commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read") to linux-5.1-stable

[PATCH] Backport commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read") to linux-5.1-stable

[Murray McAllister]

Commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in
vmw_cmd_dx_set_shader() leading to an invalid read") upstream.

Commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in
vmw_cmd_dx_set_shader() leading to an invalid read") resolved
an integer underflow when SVGA_3D_CMD_DX_SET_SHADER was called
with a shader ID of SVGA3D_INVALID_ID, and a shader type of
SVGA3D_SHADERTYPE_INVALID.

(The original patch failed to apply cleanly in 5.1-stable
as VMW_DEBUG_USER does not exist here.)

Signed-off-by: Murray McAllister <murray.mcallister@gmail.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 88b8178d4687..00dc809e0303 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -2338,7 +2338,8 @@ static int vmw_cmd_dx_set_shader(struct vmw_private *dev_priv,
 
 	cmd = container_of(header, typeof(*cmd), header);
 
-	if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX) {
+	if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX ||
+	    cmd->body.type < SVGA3D_SHADERTYPE_MIN) {
 		DRM_ERROR("Illegal shader type %u.\n",
 			  (unsigned) cmd->body.type);
 		return -EINVAL;
-- 
2.20.1

Re: [PATCH] Backport commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read") to linux-5.1-stable

[Sasha Levin]

On Sun, Jun 16, 2019 at 05:57:40PM +1200, Murray McAllister wrote:
>Commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in
>vmw_cmd_dx_set_shader() leading to an invalid read") upstream.
>
>Commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in
>vmw_cmd_dx_set_shader() leading to an invalid read") resolved
>an integer underflow when SVGA_3D_CMD_DX_SET_SHADER was called
>with a shader ID of SVGA3D_INVALID_ID, and a shader type of
>SVGA3D_SHADERTYPE_INVALID.
>
>(The original patch failed to apply cleanly in 5.1-stable
>as VMW_DEBUG_USER does not exist here.)

What about 4.19 and 4.14?

Also, don't modify the commit message/subject, just add your backporting
notes to the original commit message.

--
Thanks,
Sasha

Re: [PATCH] Backport commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read") to linux-5.1-stable

[Greg KH]

On Sun, Jun 16, 2019 at 07:57:57PM -0400, Sasha Levin wrote:
> On Sun, Jun 16, 2019 at 05:57:40PM +1200, Murray McAllister wrote:
> > Commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in
> > vmw_cmd_dx_set_shader() leading to an invalid read") upstream.
> > 
> > Commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in
> > vmw_cmd_dx_set_shader() leading to an invalid read") resolved
> > an integer underflow when SVGA_3D_CMD_DX_SET_SHADER was called
> > with a shader ID of SVGA3D_INVALID_ID, and a shader type of
> > SVGA3D_SHADERTYPE_INVALID.
> > 
> > (The original patch failed to apply cleanly in 5.1-stable
> > as VMW_DEBUG_USER does not exist here.)
> 
> What about 4.19 and 4.14?

I already applied it everywhere (even 4.9.y and 4.4.y) :)

thanks,

greg k-h