[x86] drm/vmwgfx: Fix a width / pitch mismatch on framebuffer updates
This commit is contained in:
parent
74cadf39f7
commit
10211ef4c3
|
@ -16,6 +16,7 @@ linux (4.3.3-6) UNRELEASED; urgency=medium
|
||||||
(CVE-2015-7566)
|
(CVE-2015-7566)
|
||||||
* tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) (CVE-2016-0723)
|
* tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) (CVE-2016-0723)
|
||||||
* block/sd: Fix device-imposed transfer length limits (Closes: #805252)
|
* block/sd: Fix device-imposed transfer length limits (Closes: #805252)
|
||||||
|
* [x86] drm/vmwgfx: Fix a width / pitch mismatch on framebuffer updates
|
||||||
|
|
||||||
-- Ben Hutchings <ben@decadent.org.uk> Fri, 08 Jan 2016 12:08:13 +0000
|
-- Ben Hutchings <ben@decadent.org.uk> Fri, 08 Jan 2016 12:08:13 +0000
|
||||||
|
|
||||||
|
|
60
debian/patches/bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch
vendored
Normal file
60
debian/patches/bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch
vendored
Normal file
|
@ -0,0 +1,60 @@
|
||||||
|
From: Thomas Hellstrom <thellstrom@vmware.com>
|
||||||
|
Date: Fri, 8 Jan 2016 20:29:40 +0100
|
||||||
|
Subject: drm/vmwgfx: Fix a width / pitch mismatch on framebuffer updates
|
||||||
|
Origin: https://git.kernel.org/linus/a50e2bf5a0f674d62b69f51f6935a30e82bd015c
|
||||||
|
|
||||||
|
When the framebuffer is a vmwgfx dma buffer and a proxy surface is
|
||||||
|
created, the vmw_kms_update_proxy() function requires that the proxy
|
||||||
|
surface width and the framebuffer pitch are compatible, otherwise
|
||||||
|
display corruption occurs as seen in gnome-shell/native with software
|
||||||
|
3D. Since the framebuffer pitch is determined by user-space, allocate
|
||||||
|
a proxy surface the width of which is based on the framebuffer pitch
|
||||||
|
rather than on the framebuffer width.
|
||||||
|
|
||||||
|
Cc: <stable@vger.kernel.org>
|
||||||
|
Reported-by: Raphael Hertzog <buxy@kali.org>
|
||||||
|
Tested-by: Mati Aharoni <muts@kali.org>
|
||||||
|
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
|
||||||
|
Reviewed-by: Brian Paul <brianp@vmware.com>
|
||||||
|
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
||||||
|
---
|
||||||
|
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 6 +++++-
|
||||||
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
|
||||||
|
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
|
||||||
|
@@ -725,21 +725,25 @@ static int vmw_create_dmabuf_proxy(struc
|
||||||
|
uint32_t format;
|
||||||
|
struct drm_vmw_size content_base_size;
|
||||||
|
struct vmw_resource *res;
|
||||||
|
+ unsigned int bytes_pp;
|
||||||
|
int ret;
|
||||||
|
|
||||||
|
switch (mode_cmd->depth) {
|
||||||
|
case 32:
|
||||||
|
case 24:
|
||||||
|
format = SVGA3D_X8R8G8B8;
|
||||||
|
+ bytes_pp = 4;
|
||||||
|
break;
|
||||||
|
|
||||||
|
case 16:
|
||||||
|
case 15:
|
||||||
|
format = SVGA3D_R5G6B5;
|
||||||
|
+ bytes_pp = 2;
|
||||||
|
break;
|
||||||
|
|
||||||
|
case 8:
|
||||||
|
format = SVGA3D_P8;
|
||||||
|
+ bytes_pp = 1;
|
||||||
|
break;
|
||||||
|
|
||||||
|
default:
|
||||||
|
@@ -747,7 +751,7 @@ static int vmw_create_dmabuf_proxy(struc
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
- content_base_size.width = mode_cmd->width;
|
||||||
|
+ content_base_size.width = mode_cmd->pitch / bytes_pp;
|
||||||
|
content_base_size.height = mode_cmd->height;
|
||||||
|
content_base_size.depth = 1;
|
||||||
|
|
|
@ -137,3 +137,4 @@ bugfix/all/xen-gntdev-grant-maps-should-not-be-subject-to-numa-.patch
|
||||||
bugfix/all/usb-serial-visor-fix-crash-on-detecting-device-without-write_urbs.patch
|
bugfix/all/usb-serial-visor-fix-crash-on-detecting-device-without-write_urbs.patch
|
||||||
bugfix/all/tty-fix-unsafe-ldisc-reference-via-ioctl-tiocgetd.patch
|
bugfix/all/tty-fix-unsafe-ldisc-reference-via-ioctl-tiocgetd.patch
|
||||||
bugfix/all/block-sd-fix-device-imposed-transfer-length-limits.patch
|
bugfix/all/block-sd-fix-device-imposed-transfer-length-limits.patch
|
||||||
|
bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch
|
||||||
|
|
Loading…
Reference in New Issue