Re: [PATCH] drm/qxl: validate client monitor index before access

[sashiko-bot@kernel.org]

> client_monitors_config is allocated with space for count heads, while QXL
> creates qxl_num_crtc outputs whose indexes range from zero to
> qxl_num_crtc - 1.  The monitor count may be smaller than qxl_num_crtc, but
> qxl_update_offset_props() and qxl_conn_get_modes() use the output index to
> access heads[] without checking it against count.
> 
> Starting QEMU with "-device qxl-vga,xres=1024,yres=768" provides one
> client monitor while the driver creates four outputs by default.  KASAN
> reported the first out-of-bounds access during probe, with
> qxl_update_offset_props() inlined into its caller:
> 
>   BUG: KASAN: slab-out-of-bounds in
>   qxl_display_read_client_monitors_config+0x2379/0x2e30
>   Read of size 4 at addr ffff88810403e170 by task swapper/0/1
>   Call Trace:
>    qxl_display_read_client_monitors_config+0x2379/0x2e30
>    qxl_modeset_init+0x6a6/0x7b0
>    qxl_pci_probe+0x150/0x2d0
> 
> The same configuration reaches the unchecked access in
> qxl_conn_get_modes() when userspace enumerates connectors.
> 
> Skip offset updates for outputs that have no corresponding client head,
> and retain the default preferred mode dimensions in qxl_conn_get_modes()
> when its output index is outside the client head array.
> 
> Fixes: 7dea0941f880 ("drm/qxl: use suggested x/y offset properties to pass guest prefs")
> Fixes: 1b043677d4be ("drm/qxl: add qxl_add_mode helper function")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924123731.803007-1-yaojiale02@163.com?part=1