qxl_alloc_surf_ioctl() works out the backing size of a surface with
actual_stride = param->stride < 0 ? -param->stride : param->stride;
size = actual_stride * param->height + actual_stride;
where size and actual_stride are int and param->height is __u32. Every
operand comes straight from userspace through DRM_IOCTL_QXL_ALLOC_SURF,
which is DRM_AUTH, and the expression is evaluated modulo 2^32 with no
overflow check.
The wrapped value is what reaches qxl_bo_create(), which only rounds it
up to a page. The original width, height and stride are kept verbatim
in bo->surf and are later handed to the device by qxl_hw_surface_alloc()
together with the address of that undersized allocation, so the driver
tells the host about a surface far larger than the memory backing it.
For example stride=4096, height=1048576 gives
4096 * (1048576 + 1) = 0x1_0000_1000, which truncates to 4096: a
one-page buffer object described to the device as a 4 GiB surface.
Measured on 6.12.101 by probing mmap() lengths against the resulting
GEM object, the backing is 4096 bytes while the surface declared to the
device is 4294967296 bytes.
Two smaller problems are fixed at the same time. Negating param->stride
is undefined for INT_MIN, and unlike QXL_ALLOC there is no rejection of
a zero-sized request.
Compute the size in a type that cannot wrap, reject INT_MIN and zero
dimensions, and bound the result so it still fits the int parameter of
qxl_gem_object_create().
Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
Cc: [email protected]
Signed-off-by: Aldo Ariel Panzardo <[email protected]>
---
drivers/gpu/drm/qxl/qxl_ioctl.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -23,6 +23,7 @@
* Alon Levy
*/
+#include <linux/overflow.h>
#include <linux/pci.h>
#include <linux/uaccess.h>
@@ -386,12 +387,26 @@
struct drm_qxl_alloc_surf *param = data;
int handle;
int ret;
- int size, actual_stride;
+ int actual_stride;
+ size_t size;
struct qxl_surface surf;
/* work out size allocate bo with handle */
+ if (param->stride == INT_MIN)
+ return -EINVAL;
actual_stride = param->stride < 0 ? -param->stride : param->stride;
- size = actual_stride * param->height + actual_stride;
+ if (!actual_stride || !param->width || !param->height)
+ return -EINVAL;
+ /*
+ * size = actual_stride * (height + 1), evaluated in a type that cannot
+ * wrap, then bounded so it survives the int parameter of
+ * qxl_gem_object_create().
+ */
+ if (check_mul_overflow((size_t)actual_stride,
+ (size_t)param->height + 1, &size))
+ return -EINVAL;
+ if (size > INT_MAX)
+ return -EINVAL;
surf.format = param->format;
surf.width = param->width;
