DF-5782 — i915 fb offset/size u32 overflow (missing upstream 70bbe53c6eac guard)

What

intel_fb_offset_to_xy() in sys/dev/drm/i915/intel_display.c:2398 lacks the driver-side "Catch potential overflows early" guard that upstream Linux added in commit 70bbe53c6eac ("drm/i915: Make sure fb gtt offsets stay within 32bits", landed v5.0). The DragonFly copy is vendored Linux v4.20 (proven by whole-file differential, see differential/), which predates that fix.

Build / Run / Expected (on gen9+ Intel hardware)

cc -O2 -o addfb2_offset_overflow addfb2_offset_overflow.c
./addfb2_offset_overflow

• vulnerable driver: crafted NV12/CCS ADDFB2 accepted (ioctl returns 0) where fixed driver returns -ERANGE ("Bad offset 0x... or pitch ... for color plane")
• igt testcases upstream uses: kms_big_fb/{x,y}-tiled-addfb-size-offset-overflow

On this audit rig

QEMU guest has Bochs VGA only (pciconf chip 0x1234:1111, no i915 attach, no drm kld). The trigger therefore cannot execute here; verification is by static code path proof + upstream differential — see VERDICT.md.

Contents

• addfb2_offset_overflow.c — the trigger (card discovery + crafted ADDFB2)
• differential/dfly_vs_v4.20.nonmechanical.txt — proof the DFly file == upstream v4.20 + KPI shims + 2 backports (no DFly-invented semantics)
• differential/upstream_4.20_to_v5.1.fb_overflow_hunk.txt — the exact missing fix hunk
• fix.diff — standalone backport of the guard (explicit u64 math, no helper dependency)
• verdict.json, manifest.json, env.txt

VERDICT — DF-5782

Status: untested (no Intel GPU on the audit rig; verified by line-level static analysis + upstream differential). Impact ceiling: OOB GPU scanout read from wrong/adjacent GGTT mappings — info-leak-class to the display and/or hardware upset. Upstream author's own impact statement for this bug family (commit 4e05047d3e00, the other half of the same check, which IS present): "in the worst case we might anger the hw by attempting scanout past the end of the ggtt, or we might scan out some data that we're not supposed to see from other parts of the ggtt." The display engine cannot write; this is a read-side primitive disclosed through the visible screen content.

Proven chain (all line refs into sys/dev/drm/i915/intel_display.c unless noted)

1. Entry, unprivileged: DRM_IOCTL_MODE_ADDFB2 is registered DRM_UNLOCKED with no DRM_AUTH/DRM_MASTER in sys/dev/drm/drm_ioctl.c:671 → any local user holding an open /dev/dri/card0 fd reaches intel_user_framebuffer_create() (intel_display.c:14770) → intel_framebuffer_init() (14544) → intel_fill_fb_info() (2487) → intel_fb_offset_to_xy() (2398).

2. Core check passes: sys/dev/drm/drm_framebuffer.c:205-209 rejects (u64)height * pitch + offset > UINT_MAX using the raw plane height.

3. Driver re-heights and overflows: the driver aligns the plane height up to the tile height (intel_fb_align_height 1989-1996; intel_fill_fb_info 2587 DIV_ROUND_UP(y + height, tile_height)), and computes with u32 arithmetic: * intel_compute_aligned_offset :2360 offset = (tile_rows * pitch_tiles + tiles) * tile_size; * intel_fill_fb_info :2635 size = DIV_ROUND_UP((y + height) * fb->pitches[i] + x * cpp, tile_size); With offsets[1] ∈ [0, 0xffffffff] (only plane 1: offsets[0] is forced to 0 at :14706) and an 8192-wide tiled NV12/CCS geometry, the tile-aligned product crosses 2^32 and wraps after the core check already passed.

4. Final sanity check fooled: the wrapped size is small, so mul_u32_u32(max_size, tile_size) > obj->base.size (:2643) passes while the real plane extent exceeds the object → scanout runs past the object's GGTT mapping.

5. The guard that should exist here (from upstream v5.0 70bbe53c6eac, absent in this tree — differential hunk stored in differential/upstream_4.20_to_v5.1.fb_overflow_hunk.txt): c height = drm_framebuffer_plane_height(fb->height, fb, color_plane); height = ALIGN(height, intel_tile_height(fb, color_plane)); /* Catch potential overflows early */ if (add_overflows_t(u32, mul_u32_u32(height, fb->pitches[color_plane]), fb->offsets[color_plane])) return -ERANGE;

Hardware gating (honest bound)

• NV12 path only on gen9 KBL/CFL/GLK/CNL (intel_framebuffer_init :14690-14698 rejects NV12 on <gen9, SKL, BXT, ≥gen11).
• CCS path needs I915_FORMAT_MOD_{Y,Yf}_TILED_CCS (gen9+ with CCS planes).
• Creating the malicious fb needs no master; displaying it (to realize the leak) needs a plane update (DRM master) — or a cooperating compositor importing attacker-specified geometry (DRI3/pixmap-from-fd with crafted stride/offset is the realistic vector on a multi-user desktop).

Why not executed here

Guest is QEMU with Bochs VGA (pciconf -lv: chip=0x11111234); the i915 driver never attaches and /dev/dri/card* is absent — the trigger's own first step reports this (see env.txt). No panic/leak can be produced on this rig. Classification: untested with static+differential proof, per task instructions ("verification is code-reading + differential where arithmetic classes appear (no hardware)").

Fix validation

fix.diff is the faithful backport of 70bbe53c6eac written with explicit 64-bit math (the DFly tree has add_overflows but not add_overflows_t, so the diff avoids the helper). Not kernel-built here — no i915 hardware to boot; fix_status=not_tested.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.