Hi Dave, Gerd, Following up on this fix. Some list copies of my previous follow-up were rejected because they contained HTML, so I'm following up in plain text.
Is there any additional validation or any change that would help move the review forward? I'm happy to help. Thanks, Aldo On Wed, 23 Sep 2026 10:49:52 -0300, Aldo Ariel Panzardo <[email protected]> wrote: > qxl_bo_kmap_atomic_page() takes a page_offset parameter that callers > compute as a byte offset aligned to a page boundary: > > reloc_page = qxl_bo_kmap_atomic_page(qdev, info->dst_bo, > info->dst_offset & PAGE_MASK); > > The VRAM/PRIV path adds it directly to the mapping base (both in > bytes), which is correct: > > offset = bo->tbo.resource->start << PAGE_SHIFT; > return io_mapping_map_atomic_wc(map, offset + page_offset); > > But the two system-memory fallback paths multiply it by PAGE_SIZE > again: > > rptr = bo->kptr + (page_offset * PAGE_SIZE); > > For page_offset = 0x5000 (page 5), this computes > 0x5000 * 0x1000 = 0x5000000, a 80 MiB offset instead of 20 KiB, > producing a massive out-of-bounds access into kernel memory. > > Remove the spurious multiplication so the fallback paths use the > same byte-offset semantics as the io_mapping path. > > Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") > Cc: [email protected] > Reported-by: Sashiko <[email protected]> > Signed-off-by: Aldo Ariel Panzardo <[email protected]> > --- > drivers/gpu/drm/qxl/qxl_object.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c > index XXXXXXX..YYYYYYY 100644 > --- a/drivers/gpu/drm/qxl/qxl_object.c > +++ b/drivers/gpu/drm/qxl/qxl_object.c > @@ -223,7 +223,7 @@ void *qxl_bo_kmap_atomic_page(struct qxl_device *qdev, > return io_mapping_map_atomic_wc(map, offset + page_offset); > fallback: > if (bo->kptr) { > - rptr = bo->kptr + (page_offset * PAGE_SIZE); > + rptr = bo->kptr + page_offset; > return rptr; > } > > @@ -232,7 +232,7 @@ void *qxl_bo_kmap_atomic_page(struct qxl_device *qdev, > return NULL; > rptr = bo_map.vaddr; /* TODO: Use mapping abstraction properly */ > > - rptr += page_offset * PAGE_SIZE; > + rptr += page_offset; > return rptr; > } > > -- > 2.43.0
