Re: [PATCH v4 8/8] drm/xe: convert PCI barrier mmap to use xe_mmio_gem

[Matthew Auld <matthew.auld@intel.com>]

On 08/09/2026 15:09, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] The migration of the PCI barrier mmap to use `xe_mmio_gem` removed the `VM_READ` restriction, allowing userspace to map and read from the doorbell register.
> --
> 
> commit 545a53278606e03a94bbfc5ae72975b8ad8c6cae
> Author: Matthew Auld <matthew.auld@intel.com>
> 
> drm/xe: convert PCI barrier mmap to use xe_mmio_gem
> 
> This commit converts the PCI barrier mmap over to use xe_mmio_gem, simplifying
> the codebase and replacing the hard coded fake offset design. It introduces the
> first user of xe_mmio_gem for mapping the PCIe doorbell register.
> 
>> diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c
>> --- a/drivers/gpu/drm/xe/xe_device.c
>> +++ b/drivers/gpu/drm/xe/xe_device.c
> [ ... ]
>> -static int xe_pci_barrier_mmap(struct file *filp,
>> -			       struct vm_area_struct *vma)
>> -{
> [ ... ]
>> -	if (vma->vm_flags & (VM_READ | VM_EXEC))
>> -		return -EINVAL;
>> -
>> -	vm_flags_clear(vma, VM_MAYREAD | VM_MAYEXEC);
> 
> [Severity: High]
> Does removing this VM_READ restriction allow userspace to map the PCIe
> doorbell register with read permissions?
> 
> The original xe_pci_barrier_mmap implementation explicitly restricted mappings
> to write-only by rejecting VM_READ and clearing VM_MAYREAD. By migrating to
> the generic xe_mmio_gem_mmap implementation in xe_mmio_gem.c, this read
> restriction is dropped, as the generic code only restricts VM_EXEC:
> 
> drivers/gpu/drm/xe/xe_mmio_gem.c:xe_mmio_gem_mmap() {
>          if (vma->vm_flags & VM_EXEC)
>                  return -EINVAL;
> 
>          vma->vm_page_prot = pgprot_noncached(vma_get_page_prot(vma));
>          vm_flags_mod(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP |
>                       VM_NORESERVE, VM_MAYEXEC);
> }
> 
> Reading from write-only PCIe doorbell registers can trigger an Unsupported
> Request or PCIe completion timeout, resulting in a Machine Check Exception
> and a full system hang. Because this mapping is accessible to unprivileged
> userspace, could this introduce a denial of service vulnerability?

I think you could anyway do that with write + fault and then do a read 
to get past it. At least on x86 where there is no 
write-only/read-disable bit in the PTE. So no way to actually prevent 
it. Also, for upcoming usecase I want read support for mmio_gem, so 
figured just drop this so I don't have to special case it later.

>