Claude review: drm/qxl: validate dst_offset in apply_reloc against BO size

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: drm/qxl: validate dst_offset in apply_reloc against BO size
Author: Berkant Koc <me@berkoc.com>
Patches: 1
Reviewed: 2026-05-16T10:59:08.741312

---

This is a single-patch security fix for a real out-of-bounds write vulnerability (CWE-787) in the QXL DRM driver that has existed since the driver was merged in v3.10 (2013). The commit message is thorough and well-written, clearly explaining the attack surface and scope. The fix itself is correct — it adds the missing bounds check that an existing aspirational comment explicitly called for but was never implemented.

The fix is the right approach (validate at the reloc processing site before the write), and the logic is sound. There are a few issues that should be addressed before merging, ranging from missing kernel metadata tags to a pre-existing cross-page write bug that should at minimum be noted.

**Verdict: Needs minor revision** — the core fix is correct but it needs a `Fixes:` tag, a `Cc: stable` tag, and ideally should also address the page-boundary crossing issue it partially inherits.

---

---
Generated by Claude Code Patch Reviewer