The relocs_num field from user-controlled struct drm_qxl_command is used directly in kmalloc_objs() without validation against the driver-defined limit QXL_MAX_RES (96). This allows userspace to trigger large kernel allocations (up to ~8MB) and prolonged kernel loops (up to 200k iterations), leading to memory exhaustion and CPU starvation.
While kmalloc_objs() prevents integer overflow via size_mul(), it does not prevent unreasonably large allocation requests. The QXL hardware and driver enforce a maximum of 96 relocations via QXL_MAX_RES, which is exposed to userspace through the QXL_PARAM_MAX_RELOCS parameter, but this limit is not enforced when processing execbuffer commands. Add validation to reject relocs_num values exceeding QXL_MAX_RES before allocation. This is similar to the recent fix in the Xe driver (commit 6e61a2df9ad "drm/xe: Add bounds check for num_binds to prevent memory exhaustion"). Signed-off-by: Ramesh Adhikari <[email protected]> --- drivers/gpu/drm/qxl/qxl_ioctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 591b026ceff..aae9ca636ae 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -164,6 +164,9 @@ static int qxl_process_single_command(struct qxl_device *qdev, if (cmd->command_size > PAGE_SIZE - sizeof(union qxl_release_info)) return -EINVAL; + if (cmd->relocs_num > QXL_MAX_RES) + return -EINVAL; + if (!access_ok(u64_to_user_ptr(cmd->command), cmd->command_size)) return -EFAULT; -- 2.43.0
