[PATCH V2] drm/qxl: Fix out-of-bounds read in client monitors head access

[PATCH V2] drm/qxl: Fix out-of-bounds read in client monitors head access

[Julio Faracco]

qxl_update_offset_props() dereferences
qdev->client_monitors_config->heads[output->index] for every connector.
The connector list holds qxl_num_crtc entries (default 4), but heads[] is
only allocated for client_monitors_config->count entries. When the client
reports fewer monitors than qxl_num_crtc (e.g. a guest started with
heads=1), output->index exceeds count and the read runs off the end:

    BUG: KASAN: slab-out-of-bounds in
         qxl_display_read_client_monitors_config+0x61e/0x6f0 [qxl]
    Read of size 4 ... located 16 bytes to the right of
    allocated 32-byte region

Factor the index-vs-count check already open-coded in
qxl_add_monitors_config_modes() and qxl_conn_detect() into a
qxl_output_get_client_head() helper that returns the head or NULL when the
config is absent or does not cover the output's index, and use it in all
four places, including qxl_conn_get_modes() which had the same unchecked
heads[output->index] access reachable from the mode probe path.

Signed-off-by: Julio Faracco <jcfaracco@gmail.com>
---
v2:
- Also convert qxl_conn_get_modes(), same unchecked access
  (from Sashiko AI review).

 drivers/gpu/drm/qxl/qxl_display.c | 40 ++++++++++++++++++++++---------
 1 file changed, 29 insertions(+), 11 deletions(-)

diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 0719fc6a52d5..35440ee71b83 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -148,6 +148,21 @@ static int qxl_display_copy_rom_client_monitors_config(struct qxl_device *qdev)
 	return status;
 }
 
+/*
+ * Return the client monitors config head for @output, or NULL when the
+ * client monitors config is absent or does not cover this output's index.
+ */
+static struct qxl_head *qxl_output_get_client_head(struct qxl_output *output)
+{
+	struct qxl_device *qdev = to_qxl(output->base.dev);
+	struct qxl_monitors_config *cfg = qdev->client_monitors_config;
+
+	if (!cfg || output->index >= cfg->count)
+		return NULL;
+
+	return &cfg->heads[output->index];
+}
+
 static void qxl_update_offset_props(struct qxl_device *qdev)
 {
 	struct drm_device *dev = &qdev->ddev;
@@ -158,7 +173,9 @@ static void qxl_update_offset_props(struct qxl_device *qdev)
 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
 		output = drm_connector_to_qxl_output(connector);
 
-		head = &qdev->client_monitors_config->heads[output->index];
+		head = qxl_output_get_client_head(output);
+		if (!head)
+			continue;
 
 		drm_object_property_set_value(&connector->base,
 			dev->mode_config.suggested_x_property, head->x);
@@ -263,12 +280,11 @@ static int qxl_add_monitors_config_modes(struct drm_connector *connector)
 		return 0;
 	if (h >= qxl_num_crtc)
 		return 0;
-	if (!qdev->client_monitors_config)
-		return 0;
-	if (h >= qdev->client_monitors_config->count)
+
+	head = qxl_output_get_client_head(output);
+	if (!head)
 		return 0;
 
-	head = &qdev->client_monitors_config->heads[h];
 	DRM_DEBUG_KMS("head %d is %dx%d\n", h, head->width, head->height);
 
 	return qxl_add_mode(connector, head->width, head->height, true);
@@ -1054,11 +1070,11 @@ static int qxl_conn_get_modes(struct drm_connector *connector)
 	struct qxl_output *output = drm_connector_to_qxl_output(connector);
 	unsigned int pwidth = 1024;
 	unsigned int pheight = 768;
+	struct qxl_head *head;
 	int ret = 0;
 
-	if (qdev->client_monitors_config) {
-		struct qxl_head *head;
-		head = &qdev->client_monitors_config->heads[output->index];
+	head = qxl_output_get_client_head(output);
+	if (head) {
 		if (head->width)
 			pwidth = head->width;
 		if (head->height)
@@ -1111,15 +1127,17 @@ static enum drm_connector_status qxl_conn_detect(
 		drm_connector_to_qxl_output(connector);
 	struct drm_device *ddev = connector->dev;
 	struct qxl_device *qdev = to_qxl(ddev);
+	struct qxl_head *head;
 	bool connected = false;
 
 	/* The first monitor is always connected */
 	if (!qdev->client_monitors_config) {
 		if (output->index == 0)
 			connected = true;
-	} else
-		connected = qdev->client_monitors_config->count > output->index &&
-		     qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]);
+	} else {
+		head = qxl_output_get_client_head(output);
+		connected = head && qxl_head_enabled(head);
+	}
 
 	DRM_DEBUG("#%d connected: %d\n", output->index, connected);
 
-- 
2.55.0

Re: [PATCH V2] drm/qxl: Fix out-of-bounds read in client monitors head access

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/qxl: use-after-free in qxl_output_get_client_head() due to concurrent reallocation
--

commit 81383457292a90ad6073bf06583b55f1415d8a86
Author: Julio Faracco <jcfaracco@gmail.com>

drm/qxl: Fix out-of-bounds read in client monitors head access

This commit factors out the client monitors configuration access into a new
qxl_output_get_client_head() helper function to prevent out-of-bounds reads
when the client reports fewer monitors than the default. It updates several
places, including the mode probe path, to use this new helper.

> diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
> index 63fc7c6a7f1a5..9be9ded8d1639 100644
> --- a/drivers/gpu/drm/qxl/qxl_display.c
> +++ b/drivers/gpu/drm/qxl/qxl_display.c
> @@ -148,6 +148,21 @@ static int qxl_display_copy_rom_client_monitors_config(struct qxl_device *qdev)
>  	return status;
>  }
>  
> +/*
> + * Return the client monitors config head for @output, or NULL when the
> + * client monitors config is absent or does not cover this output's index.
> + */
> +static struct qxl_head *qxl_output_get_client_head(struct qxl_output *output)
> +{
> +	struct qxl_device *qdev = to_qxl(output->base.dev);
> +	struct qxl_monitors_config *cfg = qdev->client_monitors_config;
> +
> +	if (!cfg || output->index >= cfg->count)
> +		return NULL;
> +
> +	return &cfg->heads[output->index];
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

[Severity: High]
Does this introduce a potential use-after-free?

If an unprivileged userspace process inside the guest repeatedly invokes the
DRM_IOCTL_MODE_GETCONNECTOR ioctl (which calls qxl_conn_detect() and
qxl_conn_get_modes()), it will read qdev->client_monitors_config into the
local cfg pointer here.

Meanwhile, a concurrent qxl_client_monitors_config_work_func worker thread
could be reallocating qdev->client_monitors_config in response to host
monitor configuration changes:

qxl_display_copy_rom_client_monitors_config() {
  ...
  if (qxl_alloc_client_monitors_config(qdev, num_monitors)) {
  ...
}

qxl_alloc_client_monitors_config() {
  ...
  kfree(qdev->client_monitors_config);
  qdev->client_monitors_config = NULL;
  ...
}

Since the worker thread frees the structure without holding
mode_config.connection_mutex or any other lock, could the worker free the
configuration after the reader fetches the pointer but before it accesses the
array?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008155034.55688-1-jcfaracco@gmail.com?part=1

Re: [PATCH V2] drm/qxl: Fix out-of-bounds read in client monitors head access

[kernel test robot]

Hi Julio,

kernel test robot noticed the following build warnings:

[auto build test WARNING on drm-misc/drm-misc-next]
[also build test WARNING on drm/drm-next linus/master v7.3-rc6 next-20261008]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Julio-Faracco/drm-qxl-Fix-out-of-bounds-read-in-client-monitors-head-access/20261008-125034
base:   https://gitlab.freedesktop.org/drm/misc/kernel.git drm-misc-next
patch link:    https://lore.kernel.org/r/20261008155034.55688-1-jcfaracco%40gmail.com
patch subject: [PATCH V2] drm/qxl: Fix out-of-bounds read in client monitors head access
config: x86_64-randconfig-1017-20261009 (https://download.01.org/0day-ci/archive/20261009/202610092302.Y90qfnp6-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261009/202610092302.Y90qfnp6-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202610092302.Y90qfnp6-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/gpu/drm/qxl/qxl_display.c: In function 'qxl_conn_get_modes':
>> drivers/gpu/drm/qxl/qxl_display.c:1069:28: warning: unused variable 'qdev' [-Wunused-variable]
    1069 |         struct qxl_device *qdev = to_qxl(dev);
         |                            ^~~~


vim +/qdev +1069 drivers/gpu/drm/qxl/qxl_display.c

f64122c1f6ade30 Dave Airlie           2013-02-25  1065  
f64122c1f6ade30 Dave Airlie           2013-02-25  1066  static int qxl_conn_get_modes(struct drm_connector *connector)
f64122c1f6ade30 Dave Airlie           2013-02-25  1067  {
1b043677d4be206 Gerd Hoffmann         2019-01-18  1068  	struct drm_device *dev = connector->dev;
e304f8a0513b830 Simona Vetter         2020-04-15 @1069  	struct qxl_device *qdev = to_qxl(dev);
1b043677d4be206 Gerd Hoffmann         2019-01-18  1070  	struct qxl_output *output = drm_connector_to_qxl_output(connector);
1b000494978d2f3 Shayenne da Luz Moura 2018-10-26  1071  	unsigned int pwidth = 1024;
1b000494978d2f3 Shayenne da Luz Moura 2018-10-26  1072  	unsigned int pheight = 768;
bf72b40d47f83ac Julio Faracco         2026-10-08  1073  	struct qxl_head *head;
2d856f94e6d2532 Gerd Hoffmann         2017-03-01  1074  	int ret = 0;
f64122c1f6ade30 Dave Airlie           2013-02-25  1075  
bf72b40d47f83ac Julio Faracco         2026-10-08  1076  	head = qxl_output_get_client_head(output);
bf72b40d47f83ac Julio Faracco         2026-10-08  1077  	if (head) {
1b043677d4be206 Gerd Hoffmann         2019-01-18  1078  		if (head->width)
1b043677d4be206 Gerd Hoffmann         2019-01-18  1079  			pwidth = head->width;
1b043677d4be206 Gerd Hoffmann         2019-01-18  1080  		if (head->height)
1b043677d4be206 Gerd Hoffmann         2019-01-18  1081  			pheight = head->height;
1b043677d4be206 Gerd Hoffmann         2019-01-18  1082  	}
1b043677d4be206 Gerd Hoffmann         2019-01-18  1083  
b5f030b7b4a5c8e Gerd Hoffmann         2019-01-18  1084  	ret += drm_add_modes_noedid(connector, 8192, 8192);
b5f030b7b4a5c8e Gerd Hoffmann         2019-01-18  1085  	ret += qxl_add_extra_modes(connector);
1b043677d4be206 Gerd Hoffmann         2019-01-18  1086  	ret += qxl_add_monitors_config_modes(connector);
1b043677d4be206 Gerd Hoffmann         2019-01-18  1087  	drm_set_preferred_mode(connector, pwidth, pheight);
f64122c1f6ade30 Dave Airlie           2013-02-25  1088  	return ret;
f64122c1f6ade30 Dave Airlie           2013-02-25  1089  }
f64122c1f6ade30 Dave Airlie           2013-02-25  1090  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki