[PATCH] drm/vmwgfx: Validate vmw_surface_metadata::array_size

[Ian Forbes]

This field comes from userspace and should be validated against specific
limits depending on which Shader Model (SM) is available.

Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use 
vmw_surface_metadata")
Signed-off-by: Ian Forbes <ian.for...@broadcom.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index b2d3927b5567..bd0563741e89 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -78,7 +78,7 @@ static int vmw_gb_surface_unbind(struct vmw_resource *res,
 static int vmw_gb_surface_destroy(struct vmw_resource *res);
 static int
 vmw_gb_surface_define_internal(struct drm_device *dev,
-                              struct drm_vmw_gb_surface_create_ext_req *req,
+                              const  struct drm_vmw_gb_surface_create_ext_req 
*req,
                               struct drm_vmw_gb_surface_create_rep *rep,
                               struct drm_file *file_priv);
 static int
@@ -1503,7 +1503,7 @@ int vmw_gb_surface_reference_ext_ioctl(struct drm_device 
*dev, void *data,
  */
 static int
 vmw_gb_surface_define_internal(struct drm_device *dev,
-                              struct drm_vmw_gb_surface_create_ext_req *req,
+                              const  struct drm_vmw_gb_surface_create_ext_req 
*req,
                               struct drm_vmw_gb_surface_create_rep *rep,
                               struct drm_file *file_priv)
 {
@@ -1521,9 +1521,21 @@ vmw_gb_surface_define_internal(struct drm_device *dev,
                                req->base.svga3d_flags);
 
        /* array_size must be null for non-GL3 host. */
-       if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) {
-               VMW_DEBUG_USER("SM4 surface not supported.\n");
-               return -EINVAL;
+       if (req->base.array_size > 0) {
+               if (has_sm5_context(dev_priv)) {
+                       if (req->base.array_size > 
SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE) {
+                               VMW_DEBUG_USER("Invalid Surface Array Size.\n");
+                               return -EINVAL;
+                       }
+               } else if (has_sm4_context(dev_priv)) {
+                       if (req->base.array_size > 
SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE) {
+                               VMW_DEBUG_USER("Invalid Surface Array Size.\n");
+                               return -EINVAL;
+                       }
+               } else {
+                       VMW_DEBUG_USER("SM4+ surface not supported.\n");
+                       return -EINVAL;
+               }
        }
 
        if (!has_sm4_1_context(dev_priv)) {
-- 
2.54.0