Commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read") upstream.

Commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read") resolved an integer underflow when SVGA_3D_CMD_DX_SET_SHADER was called with a shader ID of SVGA3D_INVALID_ID, and a shader type of SVGA3D_SHADERTYPE_INVALID.

(The original patch failed to apply cleanly in 4.9-stable as VMW_DEBUG_USER does not exist here.)

Signed-off-by: Murray McAllister murray.mcallister@gmail.com --- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index c7b53d987f06..ae807436e7fe 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -2493,7 +2493,8 @@ static int vmw_cmd_dx_set_shader(struct vmw_private *dev_priv,

cmd = container_of(header, typeof(*cmd), header);

- if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX) { + if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX || + cmd->body.type < SVGA3D_SHADERTYPE_MIN) { DRM_ERROR("Illegal shader type %u.\n", (unsigned) cmd->body.type); return -EINVAL;