Merge 4.16-rc6 into tty-next

We want the serial/tty fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 11 insertions, 6 deletions

diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
index 5720a0d4ac0a..677ac16c8a6d 100644
--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
@@ -197,6 +197,9 @@ static int virtio_gpu_getparam_ioctl(struct drm_device *dev, void *data,
         case VIRTGPU_PARAM_3D_FEATURES:
                 value = vgdev->has_virgl_3d == true ? 1 : 0;
                 break;
+        case VIRTGPU_PARAM_CAPSET_QUERY_FIX:
+                value = 1;
+                break;
         default:
                 return -EINVAL;
         }
@@ -472,7 +475,7 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
 {
         struct virtio_gpu_device *vgdev = dev->dev_private;
         struct drm_virtgpu_get_caps *args = data;
-        int size;
+        unsigned size, host_caps_size;
         int i;
         int found_valid = -1;
         int ret;
@@ -481,6 +484,10 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
         if (vgdev->num_capsets == 0)
                 return -ENOSYS;
 
+        /* don't allow userspace to pass 0 */
+        if (args->size == 0)
+                return -EINVAL;
+
         spin_lock(&vgdev->display_info_lock);
         for (i = 0; i < vgdev->num_capsets; i++) {
                 if (vgdev->capsets[i].id == args->cap_set_id) {
@@ -496,11 +503,9 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
                 return -EINVAL;
         }
 
-        size = vgdev->capsets[found_valid].max_size;
-        if (args->size > size) {
-                spin_unlock(&vgdev->display_info_lock);
-                return -EINVAL;
-        }
+        host_caps_size = vgdev->capsets[found_valid].max_size;
+        /* only copy to user the minimum of the host caps size or the guest caps size */
+        size = min(args->size, host_caps_size);
 
         list_for_each_entry(cache_ent, &vgdev->cap_cache, head) {
                 if (cache_ent->id == args->cap_set_id &&