[PATCH v2 4/4] drm/qxl: validate relocation src_offset and fix type truncation

[Aldo Ariel Panzardo <qwe.aldo@gmail.com>]

The UAPI struct drm_qxl_reloc declares src_offset as __u64, but the
internal struct qxl_reloc_info stores it as a signed int.  The
assignment silently truncates the 64-bit value without any bounds check.
A negative or very large truncated offset is then passed to
qxl_bo_physical_address(), which computes:

  slot->high_bits | ((bo->start << PAGE_SHIFT) + offset)

generating a physical address that points outside the source BO.  The
SPICE virtual GPU then interprets this forged address, potentially
reading from arbitrary device memory.

Fix by:
  - Changing src_offset in struct qxl_reloc_info from int to uint32_t
    to prevent sign extension.
  - Validating reloc.src_offset against the source BO size before
    the assignment.

Fixes: f64122c1f6ad ("drm: add qxl driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 drivers/gpu/drm/qxl/qxl_ioctl.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 9fba6e26d..6559ba7d8 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -75,7 +75,7 @@ struct qxl_reloc_info {
 	struct qxl_bo *dst_bo;
 	uint32_t dst_offset;
 	struct qxl_bo *src_bo;
-	int src_offset;
+	uint32_t src_offset;
 };
 
 /*
@@ -259,6 +259,10 @@ static int qxl_process_single_command(struct qxl_device *qdev,
 						 &reloc_info[i].src_bo);
 			if (ret)
 				goto out_free_bos;
+			if (reloc.src_offset >= reloc_info[i].src_bo->tbo.base.size) {
+				ret = -EINVAL;
+				goto out_free_bos;
+			}
 			reloc_info[i].src_offset = reloc.src_offset;
 		} else {
 			reloc_info[i].src_bo = NULL;
-- 
2.43.0