On Mon, Oct 26, 2026 at 10:15 PM Zack Rusin <[email protected]> wrote: > > vmw_cmd_res_switch_backup lets userspace bind an arbitrary MOB to a > resource without checking that the MOB is large enough for the resource's > guest_memory_size. The dirty-tracking bitmap is allocated based on the > MOB size, but later accessed using the (larger) surface size, causing an > out-of-bounds write in the bitmap that corrupts adjacent slab memory. > > Add a check that backup_offset + res->guest_memory_size does not exceed > the buffer size before allowing the backup switch. > > DX shaders and stream outputs never set guest_memory_size, and both were > allocated with kmalloc(), so the check would read uninitialized memory for > SVGA_3D_CMD_DX_BIND_SHADER and SVGA_3D_CMD_DX_BIND_STREAMOUTPUT and could > reject valid binds. Allocate both with kzalloc() so their > guest_memory_size is 0 and the check only bounds the offset. > > Fixes: a97e21923b42 ("drm/vmwgfx: Hook up guest-backed surfaces") > Cc: [email protected] > Reported-by: Zero Day Initiative <[email protected]> > Reported-by: [email protected] # ZDI-CAN-34068 > Closes: > https://lore.kernel.org/all/byapr01mb38301cfc012e873340f77e3d80...@byapr01mb3830.prod.exchangelabs.com/ > Signed-off-by: Zack Rusin <[email protected]> > ---
Reviewed-by: Ian Forbes <[email protected]>
smime.p7s
Description: S/MIME Cryptographic Signature
