Gentle ping — any feedback on this patch? thanks, Aldo
On Wed, Sep 23, 2026 10:50 AM, Aldo Ariel Panzardo <[email protected]> wrote: > qxl_bo_kmap_atomic_page() takes a page_offset parameter that callers > compute as a byte offset aligned to a page boundary: > > reloc_page = qxl_bo_kmap_atomic_page(qdev, info->dst_bo, > info->dst_offset & PAGE_MASK); > > The VRAM/PRIV path adds it directly to the mapping base (both in > bytes), which is correct: > > offset = bo->tbo.resource->start << PAGE_SHIFT; > return io_mapping_map_atomic_wc(map, offset + page_offset); > > But the two system-memory fallback paths multiply it by PAGE_SIZE > again: > > rptr = bo->kptr + (page_offset * PAGE_SIZE); > > For page_offset = 0x5000 (page 5), this computes > 0x5000 * 0x1000 = 0x5000000, a 80 MiB offset instead of 20 KiB, > producing a massive out-of-bounds access into kernel memory. > > Remove the spurious multiplication so the fallback paths use the > same byte-offset semantics as the io_mapping path. > > Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") > Cc: [email protected] > Reported-by: Sashiko <[email protected]> > Signed-off-by: Aldo Ariel Panzardo <[email protected]> > --- > drivers/gpu/drm/qxl/qxl_object.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/qxl/qxl_object.c > b/drivers/gpu/drm/qxl/qxl_object.c > index XXXXXXX..YYYYYYY 100644 > --- a/drivers/gpu/drm/qxl/qxl_object.c > +++ b/drivers/gpu/drm/qxl/qxl_object.c > @@ -223,7 +223,7 @@ void *qxl_bo_kmap_atomic_page(struct qxl_device *qdev, > return io_mapping_map_atomic_wc(map, offset + page_offset); > fallback: > if (bo->kptr) { > - rptr = bo->kptr + (page_offset * PAGE_SIZE); > + rptr = bo->kptr + page_offset; > return rptr; > } > > @@ -232,7 +232,7 @@ void *qxl_bo_kmap_atomic_page(struct qxl_device *qdev, > return NULL; > rptr = bo_map.vaddr; /* TODO: Use mapping abstraction properly */ > > - rptr += page_offset * PAGE_SIZE; > + rptr += page_offset; > return rptr; > } > > -- > 2.43.0 >
