Re: [PATCH v4 8/8] drm/xe: convert PCI barrier mmap to use xe_mmio_gem

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The migration of the PCI barrier mmap to use `xe_mmio_gem` removed the `VM_READ` restriction, allowing userspace to map and read from the doorbell register.
--

commit 545a53278606e03a94bbfc5ae72975b8ad8c6cae
Author: Matthew Auld <matthew.auld@intel.com>

drm/xe: convert PCI barrier mmap to use xe_mmio_gem

This commit converts the PCI barrier mmap over to use xe_mmio_gem, simplifying
the codebase and replacing the hard coded fake offset design. It introduces the
first user of xe_mmio_gem for mapping the PCIe doorbell register.

> diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c
> --- a/drivers/gpu/drm/xe/xe_device.c
> +++ b/drivers/gpu/drm/xe/xe_device.c
[ ... ]
> -static int xe_pci_barrier_mmap(struct file *filp,
> -			       struct vm_area_struct *vma)
> -{
[ ... ]
> -	if (vma->vm_flags & (VM_READ | VM_EXEC))
> -		return -EINVAL;
> -
> -	vm_flags_clear(vma, VM_MAYREAD | VM_MAYEXEC);

[Severity: High]
Does removing this VM_READ restriction allow userspace to map the PCIe
doorbell register with read permissions?

The original xe_pci_barrier_mmap implementation explicitly restricted mappings
to write-only by rejecting VM_READ and clearing VM_MAYREAD. By migrating to
the generic xe_mmio_gem_mmap implementation in xe_mmio_gem.c, this read
restriction is dropped, as the generic code only restricts VM_EXEC:

drivers/gpu/drm/xe/xe_mmio_gem.c:xe_mmio_gem_mmap() {
        if (vma->vm_flags & VM_EXEC)
                return -EINVAL;

        vma->vm_page_prot = pgprot_noncached(vma_get_page_prot(vma));
        vm_flags_mod(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP |
                     VM_NORESERVE, VM_MAYEXEC);
}

Reading from write-only PCIe doorbell registers can trigger an Unsupported
Request or PCIe completion timeout, resulting in a Machine Check Exception
and a full system hang. Because this mapping is accessible to unprivileged
userspace, could this introduce a denial of service vulnerability?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908134955.1344429-10-matthew.auld@intel.com?part=8