Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Critical] drm/virtio: privilege escalation via HINT_USERPTR_RDONLY --
commit 20ea6ca5af258a43b1dc12cab535283738613d35 Author: Honglei Huang <[email protected]> Subject: drm/virtio: implement userptr support for zero-copy memory access This commit adds userptr blob object support to virtio-gpu, allowing the guest kernel to pin existing userspace mappings and use them as CREATE_BLOB backing entries. It handles page pinning, DMA mapping if required, and syncing the scatterlist for the device. > diff --git a/drivers/gpu/drm/virtio/virtgpu_userptr.c > b/drivers/gpu/drm/virtio/virtgpu_userptr.c > new file mode 100644 > --- /dev/null > +++ b/drivers/gpu/drm/virtio/virtgpu_userptr.c [ ... ] > +static int > +virtio_gpu_userptr_get_pages(struct virtio_gpu_object_userptr *userptr) > +{ > + unsigned int flag = FOLL_LONGTERM; > + unsigned int num_pages, pinned = 0; > + int ret = 0; [ ... ] > + if (!(userptr->flags & DRM_VIRTGPU_BLOB_FLAG_HINT_USERPTR_RDONLY)) > + flag |= FOLL_WRITE; > + > + do { > + num_pages = userptr->npages - pinned; > + > + ret = pin_user_pages_fast(userptr->start + pinned * PAGE_SIZE, > + num_pages, flag, > + userptr->pages + pinned); [Severity: Critical] Does this allow unprivileged userspace to bypass guest page protections? If a malicious guest userspace maps read-only memory (such as executable pages like libc.so) and passes it with DRM_VIRTGPU_BLOB_FLAG_HINT_USERPTR_RDONLY, the code omits FOLL_WRITE when calling pin_user_pages_fast. The pinned physical addresses are then sent to the host. If the guest has no vIOMMU (where virtio_gpu_use_dma_api() is false), these addresses are passed directly to the host without DMA_TO_DEVICE IOMMU protection. The userspace process could then submit a command stream via VIRTGPU_EXECBUFFER instructing the host GPU to write to this resource, causing the host hypervisor to write directly into the guest's read-only physical memory. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=3
