Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Critical] drm/virtio: privilege escalation via unnegotiated VIRTGPU_BLOB_FLAG_USE_READONLY --
commit b371f8bf32b2c925d61457787ca19851334b0963 Author: Honglei Huang <[email protected]> drm/virtio: wire blob ioctl creation to userptr objects This commit integrates userptr into the blob resource creation ioctl. It selects virtio_gpu_userptr_create for non-zero userptrs and accepts the VIRTGPU_BLOB_FLAG_USE_READONLY flag. > diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c > b/drivers/gpu/drm/virtio/virtgpu_ioctl.c > index 3d8e4ccdb7c1f..d42ca3898d4ed 100644 > --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c > +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c > @@ -36,7 +36,10 @@ > > #define VIRTGPU_BLOB_FLAG_USE_MASK (VIRTGPU_BLOB_FLAG_USE_MAPPABLE | \ > VIRTGPU_BLOB_FLAG_USE_SHAREABLE | \ > - VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE) > + VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE | \ > + VIRTGPU_BLOB_FLAG_USE_READONLY) > + > +#define VIRTGPU_BLOB_HINT_MASK DRM_VIRTGPU_BLOB_FLAG_HINT_DEFER_MAPPING [ ... ] > @@ -453,11 +459,18 @@ static int verify_blob(struct virtio_gpu_device *vgdev, > if (rc_blob->blob_flags & ~VIRTGPU_BLOB_FLAG_USE_MASK) > return -EINVAL; [Severity: Critical] Does verify_blob() unconditionally allow VIRTGPU_BLOB_FLAG_USE_READONLY without verifying if the host emulator actually supports enforcing it? Other flags, such as VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE, have explicit host capability checks (such as vgdev->has_resource_assign_uuid) further down in this function. If a guest userspace calls DRM_IOCTL_VIRTGPU_RESOURCE_CREATE_BLOB with VIRTGPU_BLOB_FLAG_USE_READONLY set and a user pointer to read-only memory, the guest pins the memory without FOLL_WRITE. If the hypervisor does not understand the READONLY flag, it might ignore it and map the memory as read-write. Could this allow unprivileged guest users to submit virtio-gpu rendering commands that write to the buffer, bypassing the guest's page protections and modifying arbitrary read-only memory in the guest? > + if (rc_blob->blob_hints & ~VIRTGPU_BLOB_HINT_MASK) > + return -EINVAL; > + > if (rc_blob->blob_flags & VIRTGPU_BLOB_FLAG_USE_CROSS_DEVICE) { > if (!vgdev->has_resource_assign_uuid) > return -EINVAL; > } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
