[x86] drm/vmwgfx: Fix a width / pitch mismatch on framebuffer updates

debian/changelog

@@ -16,6 +16,7 @@ linux (4.3.3-6) UNRELEASED; urgency=medium
     (CVE-2015-7566)
   * tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) (CVE-2016-0723)
   * block/sd: Fix device-imposed transfer length limits (Closes: #805252)
+  * [x86] drm/vmwgfx: Fix a width / pitch mismatch on framebuffer updates
 
  -- Ben Hutchings <ben@decadent.org.uk>  Fri, 08 Jan 2016 12:08:13 +0000
 

debian/patches/bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch

@@ -0,0 +1,60 @@
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Fri, 8 Jan 2016 20:29:40 +0100
+Subject: drm/vmwgfx: Fix a width / pitch mismatch on framebuffer updates
+Origin: https://git.kernel.org/linus/a50e2bf5a0f674d62b69f51f6935a30e82bd015c
+
+When the framebuffer is a vmwgfx dma buffer and a proxy surface is
+created, the vmw_kms_update_proxy() function requires that the proxy
+surface width and the framebuffer pitch are compatible, otherwise
+display corruption occurs as seen in gnome-shell/native with software
+3D. Since the framebuffer pitch is determined by user-space, allocate
+a proxy surface the width of which is based on the framebuffer pitch
+rather than on the framebuffer width.
+
+Cc: <stable@vger.kernel.org>
+Reported-by: Raphael Hertzog <buxy@kali.org>
+Tested-by:  Mati Aharoni <muts@kali.org>
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Brian Paul <brianp@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -725,21 +725,25 @@ static int vmw_create_dmabuf_proxy(struc
+ 	uint32_t format;
+ 	struct drm_vmw_size content_base_size;
+ 	struct vmw_resource *res;
++	unsigned int bytes_pp;
+ 	int ret;
+ 
+ 	switch (mode_cmd->depth) {
+ 	case 32:
+ 	case 24:
+ 		format = SVGA3D_X8R8G8B8;
++		bytes_pp = 4;
+ 		break;
+ 
+ 	case 16:
+ 	case 15:
+ 		format = SVGA3D_R5G6B5;
++		bytes_pp = 2;
+ 		break;
+ 
+ 	case 8:
+ 		format = SVGA3D_P8;
++		bytes_pp = 1;
+ 		break;
+ 
+ 	default:
+@@ -747,7 +751,7 @@ static int vmw_create_dmabuf_proxy(struc
+ 		return -EINVAL;
+ 	}
+ 
+-	content_base_size.width  = mode_cmd->width;
++	content_base_size.width  = mode_cmd->pitch / bytes_pp;
+ 	content_base_size.height = mode_cmd->height;
+ 	content_base_size.depth  = 1;
+ 

debian/patches/series

@@ -137,3 +137,4 @@ bugfix/all/xen-gntdev-grant-maps-should-not-be-subject-to-numa-.patch
 bugfix/all/usb-serial-visor-fix-crash-on-detecting-device-without-write_urbs.patch
 bugfix/all/tty-fix-unsafe-ldisc-reference-via-ioctl-tiocgetd.patch
 bugfix/all/block-sd-fix-device-imposed-transfer-length-limits.patch
+bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch