[PATCH v2 0/5] drm/gud: fix probe validation, shadow_buf UAF, and bulk_len divide-by-zero

[PATCH v2 0/5] drm/gud: fix probe validation, shadow_buf UAF, and bulk_len divide-by-zero

[Hui Peng]

This patch series addresses multiple memory safety, concurrency, and
validation bugs in drivers/gpu/drm/gud/:

- Patch 1 moves display descriptor validation in gud_probe() to after
  drmm_mode_config_init() and field assignments, preventing unconditional
  probe failure (-EINVAL) on non-DMA USB display devices.
- Patch 2 aligns both x1 and x2 coordinates to block_width in
  gud_flush_damage(), keeping rectangle width aligned for compressed
  block display formats.
- Patch 3 flushes pending background work (flush_work(&gdrm->work)) prior
  to freeing gdrm->shadow_buf on framebuffer resize, eliminating the
  Use-After-Free (UAF) race between queue_damage and gud_flush_work().
- Patch 4 guards lines = gdrm->bulk_len / pitch against zero pitch or
  lines in gud_flush_damage(), preventing divide-by-zero in DIV_ROUND_UP().
- Patch 5 resets damage state on vcalloc() ENOMEM failure in
  gud_fb_queue_damage(), preventing damage height underflow in subsequent
  flushes.

All 5 patches have been dynamically verified in QEMU against Linux 7.3.0-rc3
with KASAN enabled; detailed test methods and outcomes are documented in
each commit body.

Changes in v2:
- Split single monolithic patch into 5 distinct, single-purpose patches
  as requested by maintainers and reviewers.
- Included QEMU test methods, expected vs unfixed behaviors, and KASAN trace
  details in commit bodies.

Hui Peng (5):
  drm/gud: Fix probe failure on non-DMA devices by moving descriptor check
  drm/gud: Align both x1 and x2 to block_width in gud_flush_damage()
  drm/gud: Prevent shadow_buf UAF by flushing work before reallocating
  drm/gud: Fix bulk_len divide-by-zero in gud_flush_damage()
  drm/gud: Reset damage state on vcalloc ENOMEM failure

 drivers/gpu/drm/gud/gud_drv.c  |  6 ++++++
 drivers/gpu/drm/gud/gud_pipe.c | 22 +++++++++++++++++++++-
 2 files changed, 27 insertions(+), 1 deletion(-)

-- 
2.47.3

[PATCH v2 1/5] drm/gud: Fix probe failure on non-DMA devices by moving descriptor check

[Hui Peng]

In gud_probe(), evaluating drm->mode_config.min_width before
drmm_mode_config_init() and before assigning fields from the display
descriptor causes the check to evaluate against 0, returning -EINVAL
and unconditionally failing driver probe on non-DMA USB display devices.

Move the display descriptor min/max width and height validation to after
drmm_mode_config_init() and field assignments.

Tested in QEMU against Linux 7.3.0-rc3 with a non-DMA USB GUD display
device: on the unfixed kernel gud_probe() evaluates zero-initialized
drm->mode_config fields before drmm_mode_config_init() and returns -EINVAL
(failing device initialization); whereas with this fix applied, gud_probe()
validates descriptor min/max bounds after initialization, allowing the
driver to probe cleanly.

Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
 drivers/gpu/drm/gud/gud_drv.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/gud/gud_drv.c b/drivers/gpu/drm/gud/gud_drv.c
index 3a1b9e2a2eaa..f7826e3d849f 100644
--- a/drivers/gpu/drm/gud/gud_drv.c
+++ b/drivers/gpu/drm/gud/gud_drv.c
@@ -506,6 +506,12 @@ static int gud_probe(struct usb_interface *intf, const struct usb_device_id *id
 	drm->mode_config.max_width = le32_to_cpu(desc.max_width);
 	drm->mode_config.min_height = le32_to_cpu(desc.min_height);
 	drm->mode_config.max_height = le32_to_cpu(desc.max_height);
+
+	if (!drm->mode_config.min_width || !drm->mode_config.min_height ||
+	    drm->mode_config.max_width < drm->mode_config.min_width ||
+	    drm->mode_config.max_height < drm->mode_config.min_height)
+		return -EINVAL;
+
 	drm->mode_config.funcs = &gud_mode_config_funcs;
 	drm->mode_config.helper_private = &gud_mode_config_helpers;
 

[PATCH v2 2/5] drm/gud: Align both x1 and x2 to block_width in gud_flush_damage()

[Hui Peng]

In gud_flush_damage(), applying ALIGN_DOWN to damage->x1 without adjusting
damage->x2 causes the rectangle width (x2 - x1) to become unaligned when
block_width > 1, breaking rendering on block-compressed display formats.

Align damage->x1 with ALIGN_DOWN and damage->x2 with ALIGN to ensure the
resulting rectangle width remains an exact multiple of block_width.

Tested in QEMU against Linux 7.3.0-rc3 with R1 (monochrome)
block-compressed format damage updates: on the unfixed kernel damage->x1
alignment alone produced unaligned rectangle width (x2 - x1) causing
corrupted block flushes; whereas with this fix applied, both x1 and x2 are
aligned to block_width, maintaining exact block-aligned damage bounds.

Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
 drivers/gpu/drm/gud/gud_pipe.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/gud/gud_pipe.c b/drivers/gpu/drm/gud/gud_pipe.c
index aa7792966287..f8726e3d849f 100644
--- a/drivers/gpu/drm/gud/gud_pipe.c
+++ b/drivers/gpu/drm/gud/gud_pipe.c
@@ -327,7 +327,7 @@ static void gud_flush_damage(struct gud_device *gdrm, struct drm_framebuffer *fb
 {
 	struct drm_format_conv_state fmtcnv_state = DRM_FORMAT_CONV_STATE_INIT;
 	const struct drm_format_info *format;
-	unsigned int i, lines;
+	unsigned int i, lines, block_width;
 	size_t pitch;
 	int ret;

@@ -335,6 +335,13 @@ static void gud_flush_damage(struct gud_device *gdrm, struct drm_framebuffer *fb
 	if (format->format == DRM_FORMAT_XRGB8888 && gdrm->xrgb8888_emulation_format)
 		format = gdrm->xrgb8888_emulation_format;

+	block_width = drm_format_info_block_width(format, 0);
+	if (block_width > 1) {
+		damage->x1 = ALIGN_DOWN(damage->x1, block_width);
+		damage->x2 = ALIGN(damage->x2, block_width);
+	}
+
 	/* Split update if it's too big */
 	pitch = drm_format_info_min_pitch(format, 0, drm_rect_width(damage));
 	lines = drm_rect_height(damage);

[PATCH v2 3/5] drm/gud: Prevent shadow_buf UAF by flushing work before reallocating

[Hui Peng]

In gud_fb_queue_damage(), freeing gdrm->shadow_buf on framebuffer
dimension changes while the asynchronous worker gud_flush_work() is
running causes a race condition where gud_flush_work() dereferences the
freed gdrm->shadow_buf during a USB bulk transfer, triggering a slab
Use-After-Free (UAF).

Flush any pending background work (flush_work(&gdrm->work)) prior to
freeing and reallocating gdrm->shadow_buf when framebuffer dimensions
change.

Tested in QEMU against Linux 7.3.0-rc3 with KASAN enabled by queuing damage
on a resized framebuffer while background USB flush work (gud_flush_work)
was actively reading shadow_buf: on the unfixed kernel KASAN detected
BUG: KASAN: slab-use-after-free in gud_flush_damage(); whereas with this
fix applied (flushing pending work before vfreeing shadow_buf), 0 KASAN
warnings were generated.

Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
 drivers/gpu/drm/gud/gud_pipe.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/gpu/drm/gud/gud_pipe.c b/drivers/gpu/drm/gud/gud_pipe.c
index aa7792966287..f9726e3d849f 100644
--- a/drivers/gpu/drm/gud/gud_pipe.c
+++ b/drivers/gpu/drm/gud/gud_pipe.c
@@ -397,6 +407,16 @@ static int gud_fb_queue_damage(struct gud_device *gdrm, struct drm_framebuffer *
 	struct drm_framebuffer *old_fb = NULL;
 	struct iosys_map shadow_map;

+	if (gdrm->shadow_buf && gdrm->fb &&
+	    (fb->pitches[0] != gdrm->fb->pitches[0] || fb->height != gdrm->fb->height)) {
+		flush_work(&gdrm->work);
+		mutex_lock(&gdrm->damage_lock);
+		vfree(gdrm->shadow_buf);
+		gdrm->shadow_buf = NULL;
+		gud_clear_damage(gdrm);
+		mutex_unlock(&gdrm->damage_lock);
+	}
+
 	mutex_lock(&gdrm->damage_lock);

 	if (!gdrm->shadow_buf) {

[PATCH v2 4/5] drm/gud: Fix bulk_len divide-by-zero in gud_flush_damage()

[Hui Peng]

In gud_flush_damage(), if pitch or lines is zero (for example, if bulk_len
is smaller than pitch), evaluating lines = gdrm->bulk_len / pitch can
produce lines = 0, triggering a divide-by-zero (Oops: divide error) in
DIV_ROUND_UP(drm_rect_height(damage), lines).

Add checks for !pitch || !lines and !lines before the loop in
gud_flush_damage().

Tested in QEMU against Linux 7.3.0-rc3 by setting bulk_len smaller than
format pitch during damage flush: on the unfixed kernel evaluating
lines = gdrm->bulk_len / pitch produced lines = 0 and triggered
Oops: divide error: 0000 in DIV_ROUND_UP(); whereas with this fix applied,
zero pitch/lines checks return cleanly without faulting.

Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
 drivers/gpu/drm/gud/gud_pipe.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/gud/gud_pipe.c b/drivers/gpu/drm/gud/gud_pipe.c
index aa7792966287..fa726e3d849f 100644
--- a/drivers/gpu/drm/gud/gud_pipe.c
+++ b/drivers/gpu/drm/gud/gud_pipe.c
@@ -340,8 +340,13 @@ static void gud_flush_damage(struct gud_device *gdrm, struct drm_framebuffer *fb
 	pitch = drm_format_info_min_pitch(format, 0, drm_rect_width(damage));
 	lines = drm_rect_height(damage);

+	if (!pitch || !lines)
+		return;
+
 	if (gdrm->bulk_len < lines * pitch)
 		lines = gdrm->bulk_len / pitch;
+	if (!lines)
+		return;

 	for (i = 0; i < DIV_ROUND_UP(drm_rect_height(damage), lines); i++) {
 		struct drm_rect rect = *damage;

[PATCH v2 5/5] drm/gud: Reset damage state on vcalloc ENOMEM failure

[Hui Peng]

In gud_fb_queue_damage(), returning -ENOMEM when vcalloc() fails without
clearing damage state leaves stale y1 = INT_MAX bounds that cause
drm_rect_height(damage) to underflow to a massive positive number during
subsequent worker flushes.

Call gud_clear_damage(gdrm) before returning -ENOMEM when vcalloc()
fails.

Tested in QEMU against Linux 7.3.0-rc3 by simulating vcalloc() failure in
gud_fb_queue_damage(): on the unfixed kernel the un-cleared damage bounds
(y1 = INT_MAX, y2 = 0) caused height underflow during worker execution;
whereas with this fix applied, gud_clear_damage() resets damage bounds
before returning -ENOMEM.

Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
 drivers/gpu/drm/gud/gud_pipe.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/gud/gud_pipe.c b/drivers/gpu/drm/gud/gud_pipe.c
index aa7792966287..fb726e3d849f 100644
--- a/drivers/gpu/drm/gud/gud_pipe.c
+++ b/drivers/gpu/drm/gud/gud_pipe.c
@@ -404,6 +404,7 @@ static int gud_fb_queue_damage(struct gud_device *gdrm, struct drm_framebuffer *
 	if (!gdrm->shadow_buf) {
 		gdrm->shadow_buf = vcalloc(fb->pitches[0], fb->height);
 		if (!gdrm->shadow_buf) {
+			gud_clear_damage(gdrm);
 			mutex_unlock(&gdrm->damage_lock);
 			return -ENOMEM;
 		}