Re: [PATCH] drm/bochs: fix VRAM out-of-bounds blit with oversized fb pitch

[sashiko-bot@kernel.org]

> The primary plane's atomic_update() copies the shadow framebuffer
> into the ioremapped VRAM with the fb pitch as the row stride.  The
> blit offset and length grow with the pitch, but nothing checks them
> against the size of the VRAM mapping.
> 
> Addfb2 only enforces a minimum pitch, so userspace can pick an
> arbitrarily large one.  A single atomic commit then writes
> framebuffer content beyond the VRAM mapping, e.g. on mainline
> v7.4-rc1 (KASAN build):
> 
>     BUG: unable to handle page fault for address: ffffc90002800000
>     Oops: Oops: 0002 [#1] SMP KASAN NOPTI
>     CPU: 2 UID: 1000 PID: 1258 Comm: poc Not tainted 7.4.0-rc1 #1
>     RIP: 0010:memcpy_toio+0x22/0x50
>     CR2: ffffc90002800000 CR3: 0000000110f75000 CR4: 00000000003006f0
>     Call Trace:
>      drm_fb_memcpy+0x37c/0x6b0
>      bochs_primary_plane_helper_atomic_update+0x36c/0xa20
> 
> Reject framebuffers whose pitch * height exceeds the VRAM size in
> the primary plane's atomic_check(), same as the hyperv DRM driver
> does.
> 
> This issue was discovered by Tencent CodeBuddy Security.
> 
> Reported-by: zeroday zhao <zerodayzhao@tencent.com>
> Fixes: c3ac343c14485 ("drm/bochs: Use GEM SHMEM helpers for memory management")
> Cc: stable@vger.kernel.org
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105055000.1873029-1-bsdhenrymartin@gmail.com?part=1