Re: [PATCH v7 4/4] drm/virtio: wire blob ioctl creation to userptr objects

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] drm/virtio: PRIME export of RDONLY userptr allows writable DMA mapping
--

commit 5d368a790c7066062061e9164c64d6e00b653f96
Author: Honglei Huang <honghuan@amd.com>
Subject: drm/virtio: wire blob ioctl creation to userptr objects

This commit integrates userptr support into the virtio GPU blob resource
creation ioctl. It adds userptr flags to the allowed mask, handles userptr
verification, and calls virtio_gpu_userptr_create() when requested.

> diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
> index 3d8e4ccdb7c1f..6d38483f5fd61 100644
> --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
> +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
> @@ -36,7 +36,9 @@
>  
>  #define VIRTGPU_BLOB_FLAG_USE_MASK (VIRTGPU_BLOB_FLAG_USE_MAPPABLE | \
>  				    VIRTGPU_BLOB_FLAG_USE_SHAREABLE | \
> -				    VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE)
> +				    VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE | \
> +				    VIRTGPU_BLOB_FLAG_USE_USERPTR | \
> +				    VIRTGPU_BLOB_FLAG_USERPTR_RDONLY)

[Severity: Critical]
By exposing VIRTGPU_BLOB_FLAG_USERPTR_RDONLY to userspace, does this allow an
unprivileged local user to bypass write protection on read-only pages via
PRIME export?

Looking at virtio_gpu_userptr_funcs in
drivers/gpu/drm/virtio/virtgpu_userptr.c, .export is exposed for userptr
objects:

drivers/gpu/drm/virtio/virtgpu_userptr.c:
static const struct drm_gem_object_funcs virtio_gpu_userptr_funcs = {
	.open = virtio_gpu_gem_object_open,
	.close = virtio_gpu_gem_object_close,
	.free = virtio_gpu_userptr_free,
	.export = virtgpu_gem_prime_export,
	.get_sg_table = virtio_gpu_userptr_get_sg_table,
};

And in virtio_gpu_userptr_get_pages() within the same file, it only pins with
FOLL_WRITE if read-only is not set:

drivers/gpu/drm/virtio/virtgpu_userptr.c:virtio_gpu_userptr_get_pages()
	if (!(userptr->flags & VIRTGPU_BLOB_FLAG_USERPTR_RDONLY))
		flag |= FOLL_WRITE;

If a user maps a read-only file into memory, creates a virtgpu blob resource
using VIRTGPU_BLOB_FLAG_USE_USERPTR and VIRTGPU_BLOB_FLAG_USERPTR_RDONLY, and
then exports it via DRM_IOCTL_PRIME_HANDLE_TO_FD while requesting DRM_RDWR,
does this allow the user to import this dma-buf into another device and
perform DMA writes to it?

This appears to circumvent the read-only pinning constraints when the resulting
sg_table is shared via PRIME and modified by an unaware importer, potentially
leading to arbitrary code execution or local privilege escalation.

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918021154.1432154-1-honghuan@amd.com?part=4