[PATCH] drm/qxl: Add bounds check for relocs_num to prevent memory exhaustion

[PATCH] drm/qxl: Add bounds check for relocs_num to prevent memory exhaustion

[Ramesh Adhikari]

The relocs_num field from user-controlled struct drm_qxl_command is used
directly in kmalloc_objs() without validation against the driver-defined
limit QXL_MAX_RES (96). This allows userspace to trigger large kernel
allocations (up to ~8MB) and prolonged kernel loops (up to 200k iterations),
leading to memory exhaustion and CPU starvation.

While kmalloc_objs() prevents integer overflow via size_mul(), it does not
prevent unreasonably large allocation requests. The QXL hardware and driver
enforce a maximum of 96 relocations via QXL_MAX_RES, which is exposed to
userspace through the QXL_PARAM_MAX_RELOCS parameter, but this limit is not
enforced when processing execbuffer commands.

Add validation to reject relocs_num values exceeding QXL_MAX_RES before
allocation.

This is similar to the recent fix in the Xe driver (commit 6e61a2df9ad
"drm/xe: Add bounds check for num_binds to prevent memory exhaustion").

Signed-off-by: Ramesh Adhikari <adhikari.resume@gmail.com>
---
 drivers/gpu/drm/qxl/qxl_ioctl.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 591b026ceff..aae9ca636ae 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -164,6 +164,9 @@ static int qxl_process_single_command(struct qxl_device *qdev,
 	if (cmd->command_size > PAGE_SIZE - sizeof(union qxl_release_info))
 		return -EINVAL;
 
+	if (cmd->relocs_num > QXL_MAX_RES)
+		return -EINVAL;
+
 	if (!access_ok(u64_to_user_ptr(cmd->command),
 		       cmd->command_size))
 		return -EFAULT;
-- 
2.43.0