Re: [PATCH] drm/qxl: Fix out-of-bounds read in qxl_update_offset_props()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] drm/qxl: Incomplete fix leaves out-of-bounds read in qxl_conn_get_modes()
- [High] drm/qxl: Lockless reallocation of client_monitors_config causes Use-After-Free
--

commit 3364903c8ea46fb8e3ab3b182d79c5b5a9cc250d
Author: Julio Faracco <jcfaracco@gmail.com>

    drm/qxl: Fix out-of-bounds read in qxl_update_offset_props()

This patch introduces a helper to safely validate bounds when the client
reports fewer monitors than configured, preventing an out-of-bounds read.
The helper is applied to several functions across the qxl display driver.

> diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
> --- a/drivers/gpu/drm/qxl/qxl_display.c
> +++ b/drivers/gpu/drm/qxl/qxl_display.c
> @@ -148,6 +148,21 @@ static int qxl_display_copy_rom_client_monitors_config(struct qxl_device *qdev)
>  	return status;
>  }
>  
> +/*
> + * Return the client monitors config head for @output, or NULL when the
> + * client monitors config is absent or does not cover this output's index.
> + */
> +static struct qxl_head *qxl_output_get_client_head(struct qxl_output *output)
> +{
> +	struct qxl_device *qdev = to_qxl(output->base.dev);
> +	struct qxl_monitors_config *cfg = qdev->client_monitors_config;
> +
> +	if (!cfg || output->index >= cfg->count)
> +		return NULL;
> +
> +	return &cfg->heads[output->index];

[Severity: High]
Does this code create a use-after-free race condition?

The qxl_client_monitors_config_work_func() workqueue asynchronously executes
qxl_display_copy_rom_client_monitors_config() and 
qxl_alloc_client_monitors_config(), which frees and reallocates 
qdev->client_monitors_config before acquiring the DRM modeset locks.

Since this helper reads qdev->client_monitors_config into cfg without any
synchronization locks, if the background workqueue frees the configuration
array immediately after this fetch:

    kfree(qdev->client_monitors_config);

could the subsequent bounds check (cfg->count) and array access
(&cfg->heads[output->index]) dereference freed memory?

> +}
> +
>  static void qxl_update_offset_props(struct qxl_device *qdev)

[ ... ]

> @@ -1111,15 +1127,17 @@ static enum drm_connector_status qxl_conn_detect(
>  		drm_connector_to_qxl_output(connector);
>  	struct drm_device *ddev = connector->dev;
>  	struct qxl_device *qdev = to_qxl(ddev);
> +	struct qxl_head *head;
>  	bool connected = false;
>  
>  	/* The first monitor is always connected */
>  	if (!qdev->client_monitors_config) {
>  		if (output->index == 0)
>  			connected = true;
> -	} else
> -		connected = qdev->client_monitors_config->count > output->index &&
> -		     qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]);
> +	} else {
> +		head = qxl_output_get_client_head(output);
> +		connected = head && qxl_head_enabled(head);
> +	}

[Severity: High]
Does qxl_conn_get_modes() remain vulnerable to the same out-of-bounds read?

This patch fixes the issue here and in a few other places, but 
qxl_conn_get_modes() has an identical pattern that was not updated:

    if (qdev->client_monitors_config) {
        struct qxl_head *head;
        head = &qdev->client_monitors_config->heads[output->index];
        if (head->width)
            ...

If output->index exceeds qdev->client_monitors_config->count during a mode
probe, won't this still trigger the KASAN slab-out-of-bounds memory read?

>  
>  	DRM_DEBUG("#%d connected: %d\n", output->index, connected);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008124317.32199-1-jcfaracco@gmail.com?part=1