virtio_gpu_resource_create_blob_ioctl() -> verify_blob() validates blob flags, memory type, context and alignment, but never checks VIRTGPU_BLOB_FLAG_USE_MAPPABLE against vgdev->has_host_visible. For blob_mem == VIRTGPU_BLOB_MEM_HOST3D the blob is created via virtio_gpu_vram_create(), and on a device without host-visible memory (plain virtio-gpu-pci,blob=on with no hostmem) the failure comes too late: the GEM object has been allocated, a host resource id taken and the create_blob command issued when virtio_gpu_vram_map() returns -EINVAL, and the cleanup calls virtio_gpu_vram_free(), which is a no-op while bo->created is still false (the host response has not been processed yet). Every such blob creation permanently leaks the vram object and its resource id; /dev/dri/renderD* is reachable by unprivileged users. Guest-backed blobs (VIRTGPU_BLOB_MEM_GUEST and VIRTGPU_BLOB_MEM_HOST3D_GUEST) mmap through the shmem path and do not need host-visible memory, so only the HOST3D case is rejected. Commit 036d28db1818a ("drm/virtio: release the GEM object on virtio_gpu_vram_create() errors") fixed the sibling error paths but missed this one. Reject the impossible combination at ioctl entry, making the failure mode unreachable. This issue was discovered by Tencent CodeBuddy Security. Cc: stable@vger.kernel.org Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram object") Signed-off-by: Henry Martin --- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c index 81e70a12b3569..e3edade4a62dd 100644 --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c @@ -533,6 +533,11 @@ static int verify_blob(struct virtio_gpu_device *vgdev, return -EINVAL; } + if ((rc_blob->blob_flags & VIRTGPU_BLOB_FLAG_USE_MAPPABLE) && + rc_blob->blob_mem == VIRTGPU_BLOB_MEM_HOST3D && + !vgdev->has_host_visible) + return -EINVAL; + params->blob_mem = rc_blob->blob_mem; params->size = rc_blob->size; params->blob = true; -- 2.43.7