Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Critical] drm/virtio: PRIME export of RDONLY userptr allows writable DMA mapping --
commit 5d368a790c7066062061e9164c64d6e00b653f96 Author: Honglei Huang <[email protected]> Subject: drm/virtio: wire blob ioctl creation to userptr objects This commit integrates userptr support into the virtio GPU blob resource creation ioctl. It adds userptr flags to the allowed mask, handles userptr verification, and calls virtio_gpu_userptr_create() when requested. > diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c > b/drivers/gpu/drm/virtio/virtgpu_ioctl.c > index 3d8e4ccdb7c1f..6d38483f5fd61 100644 > --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c > +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c > @@ -36,7 +36,9 @@ > > #define VIRTGPU_BLOB_FLAG_USE_MASK (VIRTGPU_BLOB_FLAG_USE_MAPPABLE | \ > VIRTGPU_BLOB_FLAG_USE_SHAREABLE | \ > - VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE) > + VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE | \ > + VIRTGPU_BLOB_FLAG_USE_USERPTR | \ > + VIRTGPU_BLOB_FLAG_USERPTR_RDONLY) [Severity: Critical] By exposing VIRTGPU_BLOB_FLAG_USERPTR_RDONLY to userspace, does this allow an unprivileged local user to bypass write protection on read-only pages via PRIME export? Looking at virtio_gpu_userptr_funcs in drivers/gpu/drm/virtio/virtgpu_userptr.c, .export is exposed for userptr objects: drivers/gpu/drm/virtio/virtgpu_userptr.c: static const struct drm_gem_object_funcs virtio_gpu_userptr_funcs = { .open = virtio_gpu_gem_object_open, .close = virtio_gpu_gem_object_close, .free = virtio_gpu_userptr_free, .export = virtgpu_gem_prime_export, .get_sg_table = virtio_gpu_userptr_get_sg_table, }; And in virtio_gpu_userptr_get_pages() within the same file, it only pins with FOLL_WRITE if read-only is not set: drivers/gpu/drm/virtio/virtgpu_userptr.c:virtio_gpu_userptr_get_pages() if (!(userptr->flags & VIRTGPU_BLOB_FLAG_USERPTR_RDONLY)) flag |= FOLL_WRITE; If a user maps a read-only file into memory, creates a virtgpu blob resource using VIRTGPU_BLOB_FLAG_USE_USERPTR and VIRTGPU_BLOB_FLAG_USERPTR_RDONLY, and then exports it via DRM_IOCTL_PRIME_HANDLE_TO_FD while requesting DRM_RDWR, does this allow the user to import this dma-buf into another device and perform DMA writes to it? This appears to circumvent the read-only pinning constraints when the resulting sg_table is shared via PRIME and modified by an unaware importer, potentially leading to arbitrary code execution or local privilege escalation. [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
