drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

This data originates from userspace and is used in buffer offset
calculations which could potentially overflow causing an out-of-bounds
access.

Fixes: 8ce75f8ab904 ("drm/vmwgfx: Update device includes for DX device functionality")
Reported-by: Rohit Keshri <[e-mail]>
Signed-off-by: Ian Forbes <[e-mail]>
Reviewed-by: Maaz Mombasawala <[e-mail]>
Signed-off-by: Zack Rusin <[e-mail]>
Link: https://patch.msgid.link/[e-mail]

drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c

···
 
 
 	cmd_id = header->id;
+	if (header->size > SVGA_CMD_MAX_DATASIZE) {
+		VMW_DEBUG_USER("SVGA3D command: %d is too big.\n",
+			       cmd_id + SVGA_3D_CMD_BASE);
+		return -E2BIG;
+	}
 	*size = header->size + sizeof(SVGA3dCmdHeader);
 
 	cmd_id -= SVGA_3D_CMD_BASE;