kernel/linux.git/drivers/gpu/drm/hyperv/hyperv_drm_proto.c, branch v7.1

drm/hyperv: validate VMBus packet size in receive callback

2026-05-25T11:31:53+00:00

hyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv->recv_buf. The completion path then runs memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that wakes on wait_for_completion_timeout() can read up to 16 KiB of residue from a prior message as if it were the response payload. Pass bytes_recvd into hyperv_receive_sub() and reject any packet that does not cover the pipe + synthvid header. A single switch on msg->vid_hdr.type then computes the type-specific payload size: the three completion-driving types (SYNTHVID_VERSION_RESPONSE, SYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through to a shared exit that requires that size before memcpy/complete, while SYNTHVID_FEATURE_CHANGE validates its own payload and returns before reading is_dirt_needed. Unknown types are dropped. SYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills resolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT array. Validate the fixed prefix first so resolution_count can be read, bound it against the array, then require only the count-sized array, so the shorter responses the host actually sends are accepted. Only run the sub-handler when vmbus_recvpacket() returned success. The memcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE only on a successful receive; on -ENOBUFS vmbus_recvpacket() instead reports the required length, which can exceed hv->recv_buf, so copying bytes_recvd would read and write past the 16 KiB buffers. Gating on the success return keeps the copy bounded. The nonzero-return path is itself a malformed-message case and is now logged rather than silently skipped; channel recovery is not attempted. Rejected packets are reported via drm_err_ratelimited() rather than silently dropped, matching the CoCo-hardened pattern in hv_kvp_onchannelcallback(). Fixes: 76c56a5affeb ("drm/hyperv: Add DRM driver for hyperv synthetic video device") Cc: stable@vger.kernel.org # 5.14+ Signed-off-by: Berkant Koc Assisted-by: Claude:claude-opus-4-7 berkoc-pipeline Reviewed-by: Michael Kelley Tested-by: Michael Kelley Signed-off-by: Hamza Mahfooz Link: https://patch.msgid.link/8200dbc199c7a9b75ac7e8af6c748d2189b5ebd5.1779542874.git.me@berkoc.com

drm/hyperv: validate resolution_count and fix WIN8 fallback

2026-05-25T11:31:36+00:00

A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 walks past the supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT] array in the parse loop. Bound resolution_count against the array size, folded into the existing zero-check. When the WIN10 resolution probe fails, the caller in hyperv_connect_vsp() left hv->screen_*_max / preferred_* unpopulated, which sets mode_config.max_width / max_height to 0 and makes drm_internal_framebuffer_create() reject every userspace framebuffer with -EINVAL. The pre-WIN10 branch had the same gap for preferred_width / preferred_height. Use a single post-probe fallback guarded by screen_width_max == 0 so both paths converge on the WIN8 defaults. Signed-off-by: Berkant Koc Assisted-by: Claude:claude-opus-4-7 berkoc-pipeline Fixes: 76c56a5affeb ("drm/hyperv: Add DRM driver for hyperv synthetic video device") Cc: stable@vger.kernel.org # 5.14+ Reviewed-by: Michael Kelley Tested-by: Michael Kelley Signed-off-by: Hamza Mahfooz Link: https://patch.msgid.link/6945b22419c7d404b4954a113de2ac9c900dba93.1779542874.git.me@berkoc.com

drm/hyperv: Remove reference to hyperv_fb driver

2026-02-14T10:09:38+00:00

Remove hyperv_fb reference as the driver is removed. Signed-off-by: Prasanna Kumar T S M Signed-off-by: Helge Deller

drm/hyperv: Add ratelimit on error message

2022-09-29T16:28:28+00:00

Due to a full ring buffer, the driver may be unable to send updates to the Hyper-V host. But outputing the error message can make the problem worse because console output is also typically written to the frame buffer. Rate limiting the error message, also output the error code for additional diagnosability. Signed-off-by: Saurabh Sengar Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1662736193-31379-1-git-send-email-ssengar@linux.microsoft.com Signed-off-by: Wei Liu

drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7

2022-05-11T17:49:49+00:00

The DRM Hyper-V driver has special case code for running on the first released versions of Hyper-V: 2008 and 2008 R2/Windows 7. These versions are now out of support (except for extended security updates) and lack support for performance features that are needed for effective production usage of Linux guests. The negotiation of the VMbus protocol versions required by these old Hyper-V versions has been removed from the VMbus driver. So now remove the handling of these VMbus protocol versions from the DRM Hyper-V driver. Signed-off-by: Michael Kelley Reviewed-by: Deepak Rawat Reviewed-by: Andrea Parri (Microsoft) Link: https://lore.kernel.org/r/1651509391-2058-5-git-send-email-mikelley@microsoft.com Signed-off-by: Wei Liu

drm/hyperv: Fix double mouse pointers

2021-10-15T05:04:44+00:00

Hyper-V supports a hardware cursor feature. It is not used by Linux VM, but the Hyper-V host still draws a point as an extra mouse pointer, which is unwanted, especially when Xorg is running. The hyperv_fb driver uses synthvid_send_ptr() to hide the unwanted pointer. When the hyperv_drm driver was developed, the function synthvid_send_ptr() was not copied from the hyperv_fb driver. Fix the issue by adding the function into hyperv_drm. Fixes: 76c56a5affeb ("drm/hyperv: Add DRM driver for hyperv synthetic video device") Signed-off-by: Dexuan Cui Reviewed-by: Haiyang Zhang Reviewed-by: Deepak Rawat Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20210916193644.45650-1-decui@microsoft.com Signed-off-by: Dave Airlie

drm/hyperv: Handle feature change message from device

2021-06-07T15:04:10+00:00

Virtual device inform if screen update is needed or not with SYNTHVID_FEATURE_CHANGE message. Handle this message to set dirt_needed flag. Suggested-by: Dexuan Cui Signed-off-by: Deepak Rawat Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20210527112230.1274-2-drawat.floss@gmail.com

drm/hyperv: Add DRM driver for hyperv synthetic video device

2021-06-07T15:04:10+00:00

DRM driver for hyperv synthetic video device, based on hyperv_fb framebuffer driver. Also added config option "DRM_HYPERV" to enabled this driver. v2: - Add support for gen2 VM - Fixed review comments v3: - Split into multiple files as suggested by Thomas Zimmermann - Fixed hibernation issue as suggested by Dexuan Cui - Use ioremap_cache as suggested by Dexuan Cui - Incorporated other review comments v4: - Fix bitrotted code - Review comments - Updated the copyright and license to match hyperv_fb v5: - Address review comments and rebased with drm-misc-next v6: - Minor code/comment improvement as suggested by Dexuan Cui Signed-off-by: Deepak Rawat Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20210527112230.1274-1-drawat.floss@gmail.com