Claude review: drm/vmwgfx: validate execbuf header.size lower bound

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: drm/vmwgfx: validate execbuf header.size lower bound
Author: Berkant Koc <me@berkoc.com>
Patches: 3
Reviewed: 2026-05-18T16:07:05.252863

---

This is a single-patch security fix for integer underflow vulnerabilities in the vmwgfx execbuf command validation. The analysis in the commit message is accurate and well-written — the missing lower-bound check on `header->size` allows `size_t` underflow in three separate command handlers, all reachable from unprivileged userspace via `DRM_VMW_EXECBUF` (which has `DRM_RENDER_ALLOW`).

The patch is **correct and necessary**, but it has one gap: the second `maxnum` calculation in `vmw_cmd_draw` (line 1591-1592) can still underflow even after the patch's check passes.

**Severity**: High. The commit message accurately describes a path from OOB-read to kernel write via `vmw_resource_relocations_apply`. This is reachable from render nodes.

**Recommendation**: The patch should be accepted with one fix — the `vmw_cmd_draw` check needs to be tightened, or a second check is needed before the second `maxnum` calculation.

---
Generated by Claude Code Patch Reviewer