> The primary plane's atomic_update() copies the shadow framebuffer > into the ioremapped VRAM with the fb pitch as the row stride. The > blit offset and length grow with the pitch, but nothing checks them > against the size of the VRAM mapping. > > Addfb2 only enforces a minimum pitch, so userspace can pick an > arbitrarily large one. A single atomic commit then writes > framebuffer content beyond the VRAM mapping, e.g. on mainline > v7.4-rc1 (KASAN build): > > BUG: unable to handle page fault for address: ffffc90002800000 > Oops: Oops: 0002 [#1] SMP KASAN NOPTI > CPU: 2 UID: 1000 PID: 1258 Comm: poc Not tainted 7.4.0-rc1 #1 > RIP: 0010:memcpy_toio+0x22/0x50 > CR2: ffffc90002800000 CR3: 0000000110f75000 CR4: 00000000003006f0 > Call Trace: > drm_fb_memcpy+0x37c/0x6b0 > bochs_primary_plane_helper_atomic_update+0x36c/0xa20 > > Reject framebuffers whose pitch * height exceeds the VRAM size in > the primary plane's atomic_check(), same as the hyperv DRM driver > does. > > This issue was discovered by Tencent CodeBuddy Security. > > Reported-by: zeroday zhao <[email protected]> > Fixes: c3ac343c14485 ("drm/bochs: Use GEM SHMEM helpers for memory > management") > Cc: [email protected] > Signed-off-by: Henry Martin <[email protected]>
Sashiko has reviewed this patch and found no issues. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
