Re: [PATCH v8 4/4] drm/virtio: wire blob ioctl creation to userptr objects

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] drm/virtio: privilege escalation via unnegotiated VIRTGPU_BLOB_FLAG_USE_READONLY
--

commit b371f8bf32b2c925d61457787ca19851334b0963
Author: Honglei Huang <honghuan@amd.com>
drm/virtio: wire blob ioctl creation to userptr objects

This commit integrates userptr into the blob resource creation ioctl.
It selects virtio_gpu_userptr_create for non-zero userptrs and
accepts the VIRTGPU_BLOB_FLAG_USE_READONLY flag.

> diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
> index 3d8e4ccdb7c1f..d42ca3898d4ed 100644
> --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
> +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
> @@ -36,7 +36,10 @@
>  
>  #define VIRTGPU_BLOB_FLAG_USE_MASK (VIRTGPU_BLOB_FLAG_USE_MAPPABLE | \
>  				    VIRTGPU_BLOB_FLAG_USE_SHAREABLE | \
> -				    VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE)
> +				    VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE | \
> +				    VIRTGPU_BLOB_FLAG_USE_READONLY)
> +
> +#define VIRTGPU_BLOB_HINT_MASK DRM_VIRTGPU_BLOB_FLAG_HINT_DEFER_MAPPING

[ ... ]

> @@ -453,11 +459,18 @@ static int verify_blob(struct virtio_gpu_device *vgdev,
>  	if (rc_blob->blob_flags & ~VIRTGPU_BLOB_FLAG_USE_MASK)
>  		return -EINVAL;

[Severity: Critical]
Does verify_blob() unconditionally allow VIRTGPU_BLOB_FLAG_USE_READONLY 
without verifying if the host emulator actually supports enforcing it?

Other flags, such as VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE, have explicit host 
capability checks (such as vgdev->has_resource_assign_uuid) further down in 
this function. 

If a guest userspace calls DRM_IOCTL_VIRTGPU_RESOURCE_CREATE_BLOB with 
VIRTGPU_BLOB_FLAG_USE_READONLY set and a user pointer to read-only memory, 
the guest pins the memory without FOLL_WRITE. If the hypervisor does not 
understand the READONLY flag, it might ignore it and map the memory as 
read-write. 

Could this allow unprivileged guest users to submit virtio-gpu rendering 
commands that write to the buffer, bypassing the guest's page protections 
and modifying arbitrary read-only memory in the guest?

> +	if (rc_blob->blob_hints & ~VIRTGPU_BLOB_HINT_MASK)
> +		return -EINVAL;
> +
>  	if (rc_blob->blob_flags & VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE) {
>  		if (!vgdev->has_resource_assign_uuid)
>  			return -EINVAL;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918065653.2170828-1-honghuan@amd.com?part=4