The qxl execbuffer ioctl processes user-supplied relocation entries
without adequate validation, enabling several memory-safety violations
reachable from any DRM_AUTH render client.
Patch 1 is a v2 of a previously submitted single patch. The v1 had two
gaps identified by sashiko-bot review: the upper bound for dst_handle==0
relocations did not account for the write width, and the general BO
bounds check could overflow on ILP32. Both are fixed in this revision.
Patches 2-4 fix pre-existing issues in the same code path that were
surfaced during the v1 review:
- Patch 2: The release sub-allocator ignores the requested size and
always uses 256-byte slots, but the ioctl allows commands up to
~4088 bytes, overflowing into adjacent slots.
- Patch 3: Relocations with page-unaligned offsets can write past a
single-page kmap mapping.
- Patch 4: src_offset is silently truncated from __u64 to int and
never validated, generating out-of-bounds physical addresses.
Aldo Ariel Panzardo (4):
drm/qxl: validate relocation dst_offset against destination BO
drm/qxl: reject command sizes that exceed the release slot
drm/qxl: reject relocations whose writes cross a page boundary
drm/qxl: validate relocation src_offset and fix type truncation
drivers/gpu/drm/qxl/qxl_ioctl.c | 28 +++++++++++++++++++++++++++-
drivers/gpu/drm/qxl/qxl_release.c | 3 +++
2 files changed, 30 insertions(+), 1 deletion(-)
--
2.43.0
