qxl_bo_kmap_atomic_page() takes a page_offset parameter that callers
compute as a byte offset aligned to a page boundary:
reloc_page = qxl_bo_kmap_atomic_page(qdev, info->dst_bo,
info->dst_offset & PAGE_MASK);
The VRAM/PRIV path adds it directly to the mapping base (both in
bytes), which is correct:
offset = bo->tbo.resource->start << PAGE_SHIFT;
return io_mapping_map_atomic_wc(map, offset + page_offset);
But the two system-memory fallback paths multiply it by PAGE_SIZE
again:
rptr = bo->kptr + (page_offset * PAGE_SIZE);
For page_offset = 0x5000 (page 5), this computes
0x5000 * 0x1000 = 0x5000000, a 80 MiB offset instead of 20 KiB,
producing a massive out-of-bounds access into kernel memory.
Remove the spurious multiplication so the fallback paths use the
same byte-offset semantics as the io_mapping path.
Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
Cc: [email protected]
Reported-by: Sashiko <[email protected]>
Signed-off-by: Aldo Ariel Panzardo <[email protected]>
---
drivers/gpu/drm/qxl/qxl_object.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c
index XXXXXXX..YYYYYYY 100644
--- a/drivers/gpu/drm/qxl/qxl_object.c
+++ b/drivers/gpu/drm/qxl/qxl_object.c
@@ -223,7 +223,7 @@ void *qxl_bo_kmap_atomic_page(struct qxl_device *qdev,
return io_mapping_map_atomic_wc(map, offset + page_offset);
fallback:
if (bo->kptr) {
- rptr = bo->kptr + (page_offset * PAGE_SIZE);
+ rptr = bo->kptr + page_offset;
return rptr;
}
@@ -232,7 +232,7 @@ void *qxl_bo_kmap_atomic_page(struct qxl_device *qdev,
return NULL;
rptr = bo_map.vaddr; /* TODO: Use mapping abstraction properly */
- rptr += page_offset * PAGE_SIZE;
+ rptr += page_offset;
return rptr;
}
--
2.43.0
