drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

[PATCH] drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

Posted by Sajal Gupta 3 weeks, 2 days ago

The plane property loop uses req->properties[num_properties + i] as write
index while simultaneously incrementing `num_properties` inside the loop.
At iteration i, num_properties has also incremented by i, so the write
is done at `initial_num_properties + 2*i`, skipping every other index and
advancing by 2 per iteration.

With just 2 connector and 32 plane properties the last write happens at
index 64, one slot past the end of the 64-slot (indices 0–63)
allocation. A USB device can trigger OOB by advertising the maximum
number of properties.

Fix by dropping the redundant `+ i`; num_properties is already the correct
running index, as gud_connector_fill_properties() fills the preceding
slots.

Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260821071812.16500-1-sajal2005gupta%40gmail.com?part=1
Signed-off-by: Sajal Gupta <sajal2005gupta@gmail.com>
---

Verified with KASAN using a raw-gadget fake GUD device reporting 2
connector properties and 32 plane properties:

  BUG: KASAN: slab-out-of-bounds in gud_plane_atomic_check+0x1352/0x1ba0
  Write of size 2 at addr ffff88800d029a9a by task temm/270

  Call Trace:
   <TASK>
   kasan_report+0xfa/0x120
   gud_plane_atomic_check+0x1352/0x1ba0
   drm_atomic_helper_check_planes+0x2f2/0x9b0
   drm_atomic_helper_check+0x72/0x140
   drm_atomic_check_only+0x127b/0x3420
   drm_atomic_commit+0x124/0x2e0
   drm_atomic_helper_set_config+0xd9/0x130
   drm_mode_setcrtc+0xcfd/0x1b20
   drm_ioctl_kernel+0x167/0x2d0
   drm_ioctl+0x53f/0xbe0
   __x64_sys_ioctl+0x137/0x1c0
   do_syscall_64+0xde/0x4b0
   </TASK>

  The buggy address is located 0 bytes to the right of
  allocated 666-byte region [ffff88800d029800, ffff88800d029a9a)


 drivers/gpu/drm/gud/gud_pipe.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/gud/gud_pipe.c b/drivers/gpu/drm/gud/gud_pipe.c
index 5ef887d8485a..54adc401bc1b 100644
--- a/drivers/gpu/drm/gud/gud_pipe.c
+++ b/drivers/gpu/drm/gud/gud_pipe.c
@@ -562,8 +562,8 @@ int gud_plane_atomic_check(struct drm_plane *plane,
 			goto out;
 		}

-		req->properties[num_properties + i].prop = cpu_to_le16(prop);
-		req->properties[num_properties + i].val = cpu_to_le64(val);
+		req->properties[num_properties].prop = cpu_to_le16(prop);
+		req->properties[num_properties].val = cpu_to_le64(val);
 		num_properties++;
 	}

--
2.55.0

Re: [PATCH] drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

Posted by Ruben Wauters 1 week, 6 days ago

On Wed, 2026-09-02 at 18:00 +0530, Sajal Gupta wrote:
> The plane property loop uses req->properties[num_properties + i] as write
> index while simultaneously incrementing `num_properties` inside the loop.
> At iteration i, num_properties has also incremented by i, so the write
> is done at `initial_num_properties + 2*i`, skipping every other index and
> advancing by 2 per iteration.
> 
> With just 2 connector and 32 plane properties the last write happens at
> index 64, one slot past the end of the 64-slot (indices 0–63)
> allocation. A USB device can trigger OOB by advertising the maximum
> number of properties.
> 
> Fix by dropping the redundant `+ i`; num_properties is already the correct
> running index, as gud_connector_fill_properties() fills the preceding
> slots.
> 
> Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Link: https://sashiko.dev/#/patchset/20260821071812.16500-1-sajal2005gupta%40gmail.com?part=1
> Signed-off-by: Sajal Gupta <sajal2005gupta@gmail.com>
Cc: <stable@vger.kernel.org>
Acked-by: Ruben Wauters <rubenru09@aol.com>

Sorry, for some reason I didn't receive this patch in my mailbox, only
by manually searching for patches did I find it, thanks for the patch.
> ---
> 
> Verified with KASAN using a raw-gadget fake GUD device reporting 2
> connector properties and 32 plane properties:
> 
>   BUG: KASAN: slab-out-of-bounds in gud_plane_atomic_check+0x1352/0x1ba0
>   Write of size 2 at addr ffff88800d029a9a by task temm/270
> 
>   Call Trace:
>    <TASK>
>    kasan_report+0xfa/0x120
>    gud_plane_atomic_check+0x1352/0x1ba0
>    drm_atomic_helper_check_planes+0x2f2/0x9b0
>    drm_atomic_helper_check+0x72/0x140
>    drm_atomic_check_only+0x127b/0x3420
>    drm_atomic_commit+0x124/0x2e0
>    drm_atomic_helper_set_config+0xd9/0x130
>    drm_mode_setcrtc+0xcfd/0x1b20
>    drm_ioctl_kernel+0x167/0x2d0
>    drm_ioctl+0x53f/0xbe0
>    __x64_sys_ioctl+0x137/0x1c0
>    do_syscall_64+0xde/0x4b0
>    </TASK>
> 
>   The buggy address is located 0 bytes to the right of
>   allocated 666-byte region [ffff88800d029800, ffff88800d029a9a)
> 
> 
>  drivers/gpu/drm/gud/gud_pipe.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/gud/gud_pipe.c b/drivers/gpu/drm/gud/gud_pipe.c
> index 5ef887d8485a..54adc401bc1b 100644
> --- a/drivers/gpu/drm/gud/gud_pipe.c
> +++ b/drivers/gpu/drm/gud/gud_pipe.c
> @@ -562,8 +562,8 @@ int gud_plane_atomic_check(struct drm_plane *plane,
>  			goto out;
>  		}
> 
> -		req->properties[num_properties + i].prop = cpu_to_le16(prop);
> -		req->properties[num_properties + i].val = cpu_to_le64(val);
> +		req->properties[num_properties].prop = cpu_to_le16(prop);
> +		req->properties[num_properties].val = cpu_to_le64(val);
>  		num_properties++;
>  	}
> 
> --
> 2.55.0