[PATCH] Backport commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read") to linux-4.9-stable

[PATCH] Backport commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read") to linux-4.9-stable

[Murray McAllister]

Commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in
vmw_cmd_dx_set_shader() leading to an invalid read") upstream.

Commit 5ed7f4b5eca1 ("drm/vmwgfx: integer underflow in
vmw_cmd_dx_set_shader() leading to an invalid read") resolved
an integer underflow when SVGA_3D_CMD_DX_SET_SHADER was called
with a shader ID of SVGA3D_INVALID_ID, and a shader type of
SVGA3D_SHADERTYPE_INVALID.

(The original patch failed to apply cleanly in 4.9-stable
as VMW_DEBUG_USER does not exist here.)

Signed-off-by: Murray McAllister <murray.mcallister@gmail.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index c7b53d987f06..ae807436e7fe 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -2493,7 +2493,8 @@ static int vmw_cmd_dx_set_shader(struct vmw_private *dev_priv,
 
 	cmd = container_of(header, typeof(*cmd), header);
 
-	if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX) {
+	if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX ||
+	    cmd->body.type < SVGA3D_SHADERTYPE_MIN) {
 		DRM_ERROR("Illegal shader type %u.\n",
 			  (unsigned) cmd->body.type);
 		return -EINVAL;
-- 
2.20.1