[PATCH] drm/qxl: remove double page-size scaling in kmap fallback paths

[PATCH] drm/qxl: remove double page-size scaling in kmap fallback paths

[Aldo Ariel Panzardo]

qxl_bo_kmap_atomic_page() takes a page_offset parameter that callers
compute as a byte offset aligned to a page boundary:

    reloc_page = qxl_bo_kmap_atomic_page(qdev, info->dst_bo,
                                         info->dst_offset & PAGE_MASK);

The VRAM/PRIV path adds it directly to the mapping base (both in
bytes), which is correct:

    offset = bo->tbo.resource->start << PAGE_SHIFT;
    return io_mapping_map_atomic_wc(map, offset + page_offset);

But the two system-memory fallback paths multiply it by PAGE_SIZE
again:

    rptr = bo->kptr + (page_offset * PAGE_SIZE);

For page_offset = 0x5000 (page 5), this computes
0x5000 * 0x1000 = 0x5000000, a 80 MiB offset instead of 20 KiB,
producing a massive out-of-bounds access into kernel memory.

Remove the spurious multiplication so the fallback paths use the
same byte-offset semantics as the io_mapping path.

Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 drivers/gpu/drm/qxl/qxl_object.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c
index XXXXXXX..YYYYYYY 100644
--- a/drivers/gpu/drm/qxl/qxl_object.c
+++ b/drivers/gpu/drm/qxl/qxl_object.c
@@ -223,7 +223,7 @@ void *qxl_bo_kmap_atomic_page(struct qxl_device *qdev,
 	return io_mapping_map_atomic_wc(map, offset + page_offset);
 fallback:
 	if (bo->kptr) {
-		rptr = bo->kptr + (page_offset * PAGE_SIZE);
+		rptr = bo->kptr + page_offset;
 		return rptr;
 	}

@@ -232,7 +232,7 @@ void *qxl_bo_kmap_atomic_page(struct qxl_device *qdev,
 		return NULL;
 	rptr = bo_map.vaddr; /* TODO: Use mapping abstraction properly */

-	rptr += page_offset * PAGE_SIZE;
+	rptr += page_offset;
 	return rptr;
 }

--
2.43.0

Re: [PATCH] drm/qxl: remove double page-size scaling in kmap fallback paths

[sashiko-bot]

> qxl_bo_kmap_atomic_page() takes a page_offset parameter that callers
> compute as a byte offset aligned to a page boundary:
> 
>     reloc_page = qxl_bo_kmap_atomic_page(qdev, info->dst_bo,
>                                          info->dst_offset & PAGE_MASK);
> 
> The VRAM/PRIV path adds it directly to the mapping base (both in
> bytes), which is correct:
> 
>     offset = bo->tbo.resource->start << PAGE_SHIFT;
>     return io_mapping_map_atomic_wc(map, offset + page_offset);
> 
> But the two system-memory fallback paths multiply it by PAGE_SIZE
> again:
> 
>     rptr = bo->kptr + (page_offset * PAGE_SIZE);
> 
> For page_offset = 0x5000 (page 5), this computes
> 0x5000 * 0x1000 = 0x5000000, a 80 MiB offset instead of 20 KiB,
> producing a massive out-of-bounds access into kernel memory.
> 
> Remove the spurious multiplication so the fallback paths use the
> same byte-offset semantics as the io_mapping path.
> 
> Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
> Cc: stable@vger.kernel.org
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923134952.1750600-1-qwe.aldo@gmail.com?part=1

Re: [PATCH] drm/qxl: remove double page-size scaling in kmap fallback paths

[Aldo Ariel]

[-- Attachment #1: Type: text/plain, Size: 2272 bytes --]

Gentle ping — any feedback on this patch?

thanks,
Aldo

On Wed, Sep 23, 2026 10:50 AM, Aldo Ariel Panzardo <qwe.aldo@gmail.com>
wrote:

> qxl_bo_kmap_atomic_page() takes a page_offset parameter that callers
> compute as a byte offset aligned to a page boundary:
>
>     reloc_page = qxl_bo_kmap_atomic_page(qdev, info->dst_bo,
>                                          info->dst_offset & PAGE_MASK);
>
> The VRAM/PRIV path adds it directly to the mapping base (both in
> bytes), which is correct:
>
>     offset = bo->tbo.resource->start << PAGE_SHIFT;
>     return io_mapping_map_atomic_wc(map, offset + page_offset);
>
> But the two system-memory fallback paths multiply it by PAGE_SIZE
> again:
>
>     rptr = bo->kptr + (page_offset * PAGE_SIZE);
>
> For page_offset = 0x5000 (page 5), this computes
> 0x5000 * 0x1000 = 0x5000000, a 80 MiB offset instead of 20 KiB,
> producing a massive out-of-bounds access into kernel memory.
>
> Remove the spurious multiplication so the fallback paths use the
> same byte-offset semantics as the io_mapping path.
>
> Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
> Cc: stable@vger.kernel.org
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
> ---
>  drivers/gpu/drm/qxl/qxl_object.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/qxl/qxl_object.c
> b/drivers/gpu/drm/qxl/qxl_object.c
> index XXXXXXX..YYYYYYY 100644
> --- a/drivers/gpu/drm/qxl/qxl_object.c
> +++ b/drivers/gpu/drm/qxl/qxl_object.c
> @@ -223,7 +223,7 @@ void *qxl_bo_kmap_atomic_page(struct qxl_device *qdev,
>         return io_mapping_map_atomic_wc(map, offset + page_offset);
>  fallback:
>         if (bo->kptr) {
> -               rptr = bo->kptr + (page_offset * PAGE_SIZE);
> +               rptr = bo->kptr + page_offset;
>                 return rptr;
>         }
>
> @@ -232,7 +232,7 @@ void *qxl_bo_kmap_atomic_page(struct qxl_device *qdev,
>                 return NULL;
>         rptr = bo_map.vaddr; /* TODO: Use mapping abstraction properly */
>
> -       rptr += page_offset * PAGE_SIZE;
> +       rptr += page_offset;
>         return rptr;
>  }
>
> --
> 2.43.0
>

[-- Attachment #2: Type: text/html, Size: 3008 bytes --]