From 10211ef4c3ba1f4a59c950dbc92b5a1b2a21f6e4 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sat, 16 Jan 2016 04:04:53 +0000 Subject: [PATCH] [x86] drm/vmwgfx: Fix a width / pitch mismatch on framebuffer updates --- debian/changelog | 1 + ...-width-pitch-mismatch-on-framebuffer.patch | 60 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 62 insertions(+) create mode 100644 debian/patches/bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch diff --git a/debian/changelog b/debian/changelog index 9808cd55a..f93cd4a73 100644 --- a/debian/changelog +++ b/debian/changelog @@ -16,6 +16,7 @@ linux (4.3.3-6) UNRELEASED; urgency=medium (CVE-2015-7566) * tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) (CVE-2016-0723) * block/sd: Fix device-imposed transfer length limits (Closes: #805252) + * [x86] drm/vmwgfx: Fix a width / pitch mismatch on framebuffer updates -- Ben Hutchings Fri, 08 Jan 2016 12:08:13 +0000 diff --git a/debian/patches/bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch b/debian/patches/bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch new file mode 100644 index 000000000..dd2d3da59 --- /dev/null +++ b/debian/patches/bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch @@ -0,0 +1,60 @@ +From: Thomas Hellstrom +Date: Fri, 8 Jan 2016 20:29:40 +0100 +Subject: drm/vmwgfx: Fix a width / pitch mismatch on framebuffer updates +Origin: https://git.kernel.org/linus/a50e2bf5a0f674d62b69f51f6935a30e82bd015c + +When the framebuffer is a vmwgfx dma buffer and a proxy surface is +created, the vmw_kms_update_proxy() function requires that the proxy +surface width and the framebuffer pitch are compatible, otherwise +display corruption occurs as seen in gnome-shell/native with software +3D. Since the framebuffer pitch is determined by user-space, allocate +a proxy surface the width of which is based on the framebuffer pitch +rather than on the framebuffer width. + +Cc: +Reported-by: Raphael Hertzog +Tested-by: Mati Aharoni +Signed-off-by: Thomas Hellstrom +Reviewed-by: Brian Paul +Signed-off-by: Dave Airlie +--- + drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +@@ -725,21 +725,25 @@ static int vmw_create_dmabuf_proxy(struc + uint32_t format; + struct drm_vmw_size content_base_size; + struct vmw_resource *res; ++ unsigned int bytes_pp; + int ret; + + switch (mode_cmd->depth) { + case 32: + case 24: + format = SVGA3D_X8R8G8B8; ++ bytes_pp = 4; + break; + + case 16: + case 15: + format = SVGA3D_R5G6B5; ++ bytes_pp = 2; + break; + + case 8: + format = SVGA3D_P8; ++ bytes_pp = 1; + break; + + default: +@@ -747,7 +751,7 @@ static int vmw_create_dmabuf_proxy(struc + return -EINVAL; + } + +- content_base_size.width = mode_cmd->width; ++ content_base_size.width = mode_cmd->pitch / bytes_pp; + content_base_size.height = mode_cmd->height; + content_base_size.depth = 1; + diff --git a/debian/patches/series b/debian/patches/series index 826e9b559..ad076a3f1 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -137,3 +137,4 @@ bugfix/all/xen-gntdev-grant-maps-should-not-be-subject-to-numa-.patch bugfix/all/usb-serial-visor-fix-crash-on-detecting-device-without-write_urbs.patch bugfix/all/tty-fix-unsafe-ldisc-reference-via-ioctl-tiocgetd.patch bugfix/all/block-sd-fix-device-imposed-transfer-length-limits.patch +bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch