> qxl_bo_kmap_atomic_page() takes a page_offset parameter that callers
> compute as a byte offset aligned to a page boundary:
>
> reloc_page = qxl_bo_kmap_atomic_page(qdev, info->dst_bo,
> info->dst_offset & PAGE_MASK);
>
> The VRAM/PRIV path adds it directly to the mapping base (both in
> bytes), which is correct:
>
> offset = bo->tbo.resource->start << PAGE_SHIFT;
> return io_mapping_map_atomic_wc(map, offset + page_offset);
>
> But the two system-memory fallback paths multiply it by PAGE_SIZE
> again:
>
> rptr = bo->kptr + (page_offset * PAGE_SIZE);
>
> For page_offset = 0x5000 (page 5), this computes
> 0x5000 * 0x1000 = 0x5000000, a 80 MiB offset instead of 20 KiB,
> producing a massive out-of-bounds access into kernel memory.
>
> Remove the spurious multiplication so the fallback paths use the
> same byte-offset semantics as the io_mapping path.
>
> Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
> Cc: [email protected]
> Reported-by: Sashiko <[email protected]>
> Signed-off-by: Aldo Ariel Panzardo <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
