From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp-outbound-2.vmware.com ([208.91.2.13]:44174 "EHLO smtp-outbound-2.vmware.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751299AbbLBRZQ (ORCPT ); Wed, 2 Dec 2015 12:25:16 -0500 From: Thomas Hellstrom To: , CC: , Thomas Hellstrom , Subject: [PATCH] drm: Fix an unwanted master inheritance v2 Date: Wed, 2 Dec 2015 09:24:46 -0800 Message-ID: <1449077086-3125-1-git-send-email-thellstrom@vmware.com> MIME-Version: 1.0 Content-Type: text/plain Sender: stable-owner@vger.kernel.org List-ID: A client calling drmSetMaster() using a file descriptor that was opened when another client was master would inherit the latter client's master object and all its authenticated clients. This is unwanted behaviour, and when this happens, instead allocate a brand new master object for the client calling drmSetMaster(). Fixes a BUG() throw in vmw_master_set(). Cc: Signed-off-by: Thomas Hellstrom --- drivers/gpu/drm/drm_drv.c | 5 +++ drivers/gpu/drm/drm_fops.c | 84 ++++++++++++++++++++++++++++++---------------- include/drm/drmP.h | 6 ++++ 3 files changed, 67 insertions(+), 28 deletions(-) diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index 9362609..7dd6728 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -160,6 +160,11 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data, goto out_unlock; } + if (!file_priv->allowed_master) { + ret = drm_new_set_master(dev, file_priv); + goto out_unlock; + } + file_priv->minor->master = drm_master_get(file_priv->master); file_priv->is_master = 1; if (dev->driver->master_set) { diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c index c59ce4d..6b5625e 100644 --- a/drivers/gpu/drm/drm_fops.c +++ b/drivers/gpu/drm/drm_fops.c @@ -126,6 +126,60 @@ static int drm_cpu_valid(void) } /** + * drm_new_set_master - Allocate a new master object and become master for the + * associated master realm. + * + * @dev: The associated device. + * @fpriv: File private identifying the client. + * + * This function must be called with dev::struct_mutex held. + * Returns negative error code on failure. Zero on success. + */ +int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv) +{ + struct drm_master *old_master; + int ret; + + lockdep_assert_held_once(&dev->master_mutex); + + /* create a new master */ + fpriv->minor->master = drm_master_create(fpriv->minor); + if (!fpriv->minor->master) + return -ENOMEM; + + /* take another reference for the copy in the local file priv */ + old_master = fpriv->master; + fpriv->master = drm_master_get(fpriv->minor->master); + + if (dev->driver->master_create) { + ret = dev->driver->master_create(dev, fpriv->master); + if (ret) + goto out_err; + } + if (dev->driver->master_set) { + ret = dev->driver->master_set(dev, fpriv, true); + if (ret) + goto out_err; + } + + fpriv->is_master = 1; + fpriv->allowed_master = 1; + fpriv->authenticated = 1; + if (old_master) + drm_master_put(&old_master); + + return 0; + +out_err: + /* drop both references and restore old master on failure */ + drm_master_put(&fpriv->minor->master); + drm_master_put(&fpriv->master); + fpriv->master = old_master; + + return ret; +} + +/** * Called whenever a process opens /dev/drm. * * \param filp file pointer. @@ -189,35 +243,9 @@ static int drm_open_helper(struct file *filp, struct drm_minor *minor) mutex_lock(&dev->master_mutex); if (drm_is_primary_client(priv) && !priv->minor->master) { /* create a new master */ - priv->minor->master = drm_master_create(priv->minor); - if (!priv->minor->master) { - ret = -ENOMEM; + ret = drm_new_set_master(dev, priv); + if (ret) goto out_close; - } - - priv->is_master = 1; - /* take another reference for the copy in the local file priv */ - priv->master = drm_master_get(priv->minor->master); - priv->authenticated = 1; - - if (dev->driver->master_create) { - ret = dev->driver->master_create(dev, priv->master); - if (ret) { - /* drop both references if this fails */ - drm_master_put(&priv->minor->master); - drm_master_put(&priv->master); - goto out_close; - } - } - if (dev->driver->master_set) { - ret = dev->driver->master_set(dev, priv, true); - if (ret) { - /* drop both references if this fails */ - drm_master_put(&priv->minor->master); - drm_master_put(&priv->master); - goto out_close; - } - } } else if (drm_is_primary_client(priv)) { /* get a reference to the master */ priv->master = drm_master_get(priv->minor->master); diff --git a/include/drm/drmP.h b/include/drm/drmP.h index 0b921ae..441b26e 100644 --- a/include/drm/drmP.h +++ b/include/drm/drmP.h @@ -309,6 +309,11 @@ struct drm_file { unsigned universal_planes:1; /* true if client understands atomic properties */ unsigned atomic:1; + /* + * This client is allowed to gain master privileges for @master. + * Protected by struct drm_device::master_mutex. + */ + unsigned allowed_master:1; struct pid *pid; kuid_t uid; @@ -910,6 +915,7 @@ extern int drm_open(struct inode *inode, struct file *filp); extern ssize_t drm_read(struct file *filp, char __user *buffer, size_t count, loff_t *offset); extern int drm_release(struct inode *inode, struct file *filp); +extern int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv); /* Mapping support (drm_vm.h) */ extern unsigned int drm_poll(struct file *filp, struct poll_table_struct *wait); -- 2.5.0 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Hellstrom Subject: [PATCH] drm: Fix an unwanted master inheritance v2 Date: Wed, 2 Dec 2015 09:24:46 -0800 Message-ID: <1449077086-3125-1-git-send-email-thellstrom@vmware.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from smtp-outbound-2.vmware.com (smtp-outbound-2.vmware.com [208.91.2.13]) by gabe.freedesktop.org (Postfix) with ESMTPS id 15B8C6EA1C for ; Wed, 2 Dec 2015 09:25:16 -0800 (PST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org, linux-graphics-maintainer@vmware.com Cc: pv-drivers@vmware.com, Thomas Hellstrom , stable@vger.kernel.org List-Id: dri-devel@lists.freedesktop.org QSBjbGllbnQgY2FsbGluZyBkcm1TZXRNYXN0ZXIoKSB1c2luZyBhIGZpbGUgZGVzY3JpcHRvciB0 aGF0IHdhcyBvcGVuZWQKd2hlbiBhbm90aGVyIGNsaWVudCB3YXMgbWFzdGVyIHdvdWxkIGluaGVy aXQgdGhlIGxhdHRlciBjbGllbnQncyBtYXN0ZXIKb2JqZWN0IGFuZCBhbGwgaXRzIGF1dGhlbnRp Y2F0ZWQgY2xpZW50cy4KClRoaXMgaXMgdW53YW50ZWQgYmVoYXZpb3VyLCBhbmQgd2hlbiB0aGlz IGhhcHBlbnMsIGluc3RlYWQgYWxsb2NhdGUgYQpicmFuZCBuZXcgbWFzdGVyIG9iamVjdCBmb3Ig dGhlIGNsaWVudCBjYWxsaW5nIGRybVNldE1hc3RlcigpLgoKRml4ZXMgYSBCVUcoKSB0aHJvdyBp biB2bXdfbWFzdGVyX3NldCgpLgoKQ2M6IDxzdGFibGVAdmdlci5rZXJuZWwub3JnPgpTaWduZWQt b2ZmLWJ5OiBUaG9tYXMgSGVsbHN0cm9tIDx0aGVsbHN0cm9tQHZtd2FyZS5jb20+Ci0tLQogZHJp dmVycy9ncHUvZHJtL2RybV9kcnYuYyAgfCAgNSArKysKIGRyaXZlcnMvZ3B1L2RybS9kcm1fZm9w cy5jIHwgODQgKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrLS0tLS0tLS0tLS0tLS0tLQog aW5jbHVkZS9kcm0vZHJtUC5oICAgICAgICAgfCAgNiArKysrCiAzIGZpbGVzIGNoYW5nZWQsIDY3 IGluc2VydGlvbnMoKyksIDI4IGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL2RyaXZlcnMvZ3B1 L2RybS9kcm1fZHJ2LmMgYi9kcml2ZXJzL2dwdS9kcm0vZHJtX2Rydi5jCmluZGV4IDkzNjI2MDku LjdkZDY3MjggMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvZ3B1L2RybS9kcm1fZHJ2LmMKKysrIGIvZHJp dmVycy9ncHUvZHJtL2RybV9kcnYuYwpAQCAtMTYwLDYgKzE2MCwxMSBAQCBpbnQgZHJtX3NldG1h c3Rlcl9pb2N0bChzdHJ1Y3QgZHJtX2RldmljZSAqZGV2LCB2b2lkICpkYXRhLAogCQlnb3RvIG91 dF91bmxvY2s7CiAJfQogCisJaWYgKCFmaWxlX3ByaXYtPmFsbG93ZWRfbWFzdGVyKSB7CisJCXJl dCA9IGRybV9uZXdfc2V0X21hc3RlcihkZXYsIGZpbGVfcHJpdik7CisJCWdvdG8gb3V0X3VubG9j azsKKwl9CisKIAlmaWxlX3ByaXYtPm1pbm9yLT5tYXN0ZXIgPSBkcm1fbWFzdGVyX2dldChmaWxl X3ByaXYtPm1hc3Rlcik7CiAJZmlsZV9wcml2LT5pc19tYXN0ZXIgPSAxOwogCWlmIChkZXYtPmRy aXZlci0+bWFzdGVyX3NldCkgewpkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL2RybV9mb3Bz LmMgYi9kcml2ZXJzL2dwdS9kcm0vZHJtX2ZvcHMuYwppbmRleCBjNTljZTRkLi42YjU2MjVlIDEw MDY0NAotLS0gYS9kcml2ZXJzL2dwdS9kcm0vZHJtX2ZvcHMuYworKysgYi9kcml2ZXJzL2dwdS9k cm0vZHJtX2ZvcHMuYwpAQCAtMTI2LDYgKzEyNiw2MCBAQCBzdGF0aWMgaW50IGRybV9jcHVfdmFs aWQodm9pZCkKIH0KIAogLyoqCisgKiBkcm1fbmV3X3NldF9tYXN0ZXIgLSBBbGxvY2F0ZSBhIG5l dyBtYXN0ZXIgb2JqZWN0IGFuZCBiZWNvbWUgbWFzdGVyIGZvciB0aGUKKyAqIGFzc29jaWF0ZWQg bWFzdGVyIHJlYWxtLgorICoKKyAqIEBkZXY6IFRoZSBhc3NvY2lhdGVkIGRldmljZS4KKyAqIEBm cHJpdjogRmlsZSBwcml2YXRlIGlkZW50aWZ5aW5nIHRoZSBjbGllbnQuCisgKgorICogVGhpcyBm dW5jdGlvbiBtdXN0IGJlIGNhbGxlZCB3aXRoIGRldjo6c3RydWN0X211dGV4IGhlbGQuCisgKiBS ZXR1cm5zIG5lZ2F0aXZlIGVycm9yIGNvZGUgb24gZmFpbHVyZS4gWmVybyBvbiBzdWNjZXNzLgor ICovCitpbnQgZHJtX25ld19zZXRfbWFzdGVyKHN0cnVjdCBkcm1fZGV2aWNlICpkZXYsIHN0cnVj dCBkcm1fZmlsZSAqZnByaXYpCit7CisJc3RydWN0IGRybV9tYXN0ZXIgKm9sZF9tYXN0ZXI7CisJ aW50IHJldDsKKworCWxvY2tkZXBfYXNzZXJ0X2hlbGRfb25jZSgmZGV2LT5tYXN0ZXJfbXV0ZXgp OworCisJLyogY3JlYXRlIGEgbmV3IG1hc3RlciAqLworCWZwcml2LT5taW5vci0+bWFzdGVyID0g ZHJtX21hc3Rlcl9jcmVhdGUoZnByaXYtPm1pbm9yKTsKKwlpZiAoIWZwcml2LT5taW5vci0+bWFz dGVyKQorCQlyZXR1cm4gLUVOT01FTTsKKworCS8qIHRha2UgYW5vdGhlciByZWZlcmVuY2UgZm9y IHRoZSBjb3B5IGluIHRoZSBsb2NhbCBmaWxlIHByaXYgKi8KKwlvbGRfbWFzdGVyID0gZnByaXYt Pm1hc3RlcjsKKwlmcHJpdi0+bWFzdGVyID0gZHJtX21hc3Rlcl9nZXQoZnByaXYtPm1pbm9yLT5t YXN0ZXIpOworCisJaWYgKGRldi0+ZHJpdmVyLT5tYXN0ZXJfY3JlYXRlKSB7CisJCXJldCA9IGRl di0+ZHJpdmVyLT5tYXN0ZXJfY3JlYXRlKGRldiwgZnByaXYtPm1hc3Rlcik7CisJCWlmIChyZXQp CisJCQlnb3RvIG91dF9lcnI7CisJfQorCWlmIChkZXYtPmRyaXZlci0+bWFzdGVyX3NldCkgewor CQlyZXQgPSBkZXYtPmRyaXZlci0+bWFzdGVyX3NldChkZXYsIGZwcml2LCB0cnVlKTsKKwkJaWYg KHJldCkKKwkJCWdvdG8gb3V0X2VycjsKKwl9CisKKwlmcHJpdi0+aXNfbWFzdGVyID0gMTsKKwlm cHJpdi0+YWxsb3dlZF9tYXN0ZXIgPSAxOworCWZwcml2LT5hdXRoZW50aWNhdGVkID0gMTsKKwlp ZiAob2xkX21hc3RlcikKKwkJZHJtX21hc3Rlcl9wdXQoJm9sZF9tYXN0ZXIpOworCisJcmV0dXJu IDA7CisKK291dF9lcnI6CisJLyogZHJvcCBib3RoIHJlZmVyZW5jZXMgYW5kIHJlc3RvcmUgb2xk IG1hc3RlciBvbiBmYWlsdXJlICovCisJZHJtX21hc3Rlcl9wdXQoJmZwcml2LT5taW5vci0+bWFz dGVyKTsKKwlkcm1fbWFzdGVyX3B1dCgmZnByaXYtPm1hc3Rlcik7CisJZnByaXYtPm1hc3RlciA9 IG9sZF9tYXN0ZXI7CisKKwlyZXR1cm4gcmV0OworfQorCisvKioKICAqIENhbGxlZCB3aGVuZXZl ciBhIHByb2Nlc3Mgb3BlbnMgL2Rldi9kcm0uCiAgKgogICogXHBhcmFtIGZpbHAgZmlsZSBwb2lu dGVyLgpAQCAtMTg5LDM1ICsyNDMsOSBAQCBzdGF0aWMgaW50IGRybV9vcGVuX2hlbHBlcihzdHJ1 Y3QgZmlsZSAqZmlscCwgc3RydWN0IGRybV9taW5vciAqbWlub3IpCiAJbXV0ZXhfbG9jaygmZGV2 LT5tYXN0ZXJfbXV0ZXgpOwogCWlmIChkcm1faXNfcHJpbWFyeV9jbGllbnQocHJpdikgJiYgIXBy aXYtPm1pbm9yLT5tYXN0ZXIpIHsKIAkJLyogY3JlYXRlIGEgbmV3IG1hc3RlciAqLwotCQlwcml2 LT5taW5vci0+bWFzdGVyID0gZHJtX21hc3Rlcl9jcmVhdGUocHJpdi0+bWlub3IpOwotCQlpZiAo IXByaXYtPm1pbm9yLT5tYXN0ZXIpIHsKLQkJCXJldCA9IC1FTk9NRU07CisJCXJldCA9IGRybV9u ZXdfc2V0X21hc3RlcihkZXYsIHByaXYpOworCQlpZiAocmV0KQogCQkJZ290byBvdXRfY2xvc2U7 Ci0JCX0KLQotCQlwcml2LT5pc19tYXN0ZXIgPSAxOwotCQkvKiB0YWtlIGFub3RoZXIgcmVmZXJl bmNlIGZvciB0aGUgY29weSBpbiB0aGUgbG9jYWwgZmlsZSBwcml2ICovCi0JCXByaXYtPm1hc3Rl ciA9IGRybV9tYXN0ZXJfZ2V0KHByaXYtPm1pbm9yLT5tYXN0ZXIpOwotCQlwcml2LT5hdXRoZW50 aWNhdGVkID0gMTsKLQotCQlpZiAoZGV2LT5kcml2ZXItPm1hc3Rlcl9jcmVhdGUpIHsKLQkJCXJl dCA9IGRldi0+ZHJpdmVyLT5tYXN0ZXJfY3JlYXRlKGRldiwgcHJpdi0+bWFzdGVyKTsKLQkJCWlm IChyZXQpIHsKLQkJCQkvKiBkcm9wIGJvdGggcmVmZXJlbmNlcyBpZiB0aGlzIGZhaWxzICovCi0J CQkJZHJtX21hc3Rlcl9wdXQoJnByaXYtPm1pbm9yLT5tYXN0ZXIpOwotCQkJCWRybV9tYXN0ZXJf cHV0KCZwcml2LT5tYXN0ZXIpOwotCQkJCWdvdG8gb3V0X2Nsb3NlOwotCQkJfQotCQl9Ci0JCWlm IChkZXYtPmRyaXZlci0+bWFzdGVyX3NldCkgewotCQkJcmV0ID0gZGV2LT5kcml2ZXItPm1hc3Rl cl9zZXQoZGV2LCBwcml2LCB0cnVlKTsKLQkJCWlmIChyZXQpIHsKLQkJCQkvKiBkcm9wIGJvdGgg cmVmZXJlbmNlcyBpZiB0aGlzIGZhaWxzICovCi0JCQkJZHJtX21hc3Rlcl9wdXQoJnByaXYtPm1p bm9yLT5tYXN0ZXIpOwotCQkJCWRybV9tYXN0ZXJfcHV0KCZwcml2LT5tYXN0ZXIpOwotCQkJCWdv dG8gb3V0X2Nsb3NlOwotCQkJfQotCQl9CiAJfSBlbHNlIGlmIChkcm1faXNfcHJpbWFyeV9jbGll bnQocHJpdikpIHsKIAkJLyogZ2V0IGEgcmVmZXJlbmNlIHRvIHRoZSBtYXN0ZXIgKi8KIAkJcHJp di0+bWFzdGVyID0gZHJtX21hc3Rlcl9nZXQocHJpdi0+bWlub3ItPm1hc3Rlcik7CmRpZmYgLS1n aXQgYS9pbmNsdWRlL2RybS9kcm1QLmggYi9pbmNsdWRlL2RybS9kcm1QLmgKaW5kZXggMGI5MjFh ZS4uNDQxYjI2ZSAxMDA2NDQKLS0tIGEvaW5jbHVkZS9kcm0vZHJtUC5oCisrKyBiL2luY2x1ZGUv ZHJtL2RybVAuaApAQCAtMzA5LDYgKzMwOSwxMSBAQCBzdHJ1Y3QgZHJtX2ZpbGUgewogCXVuc2ln bmVkIHVuaXZlcnNhbF9wbGFuZXM6MTsKIAkvKiB0cnVlIGlmIGNsaWVudCB1bmRlcnN0YW5kcyBh dG9taWMgcHJvcGVydGllcyAqLwogCXVuc2lnbmVkIGF0b21pYzoxOworCS8qCisJICogVGhpcyBj bGllbnQgaXMgYWxsb3dlZCB0byBnYWluIG1hc3RlciBwcml2aWxlZ2VzIGZvciBAbWFzdGVyLgor CSAqIFByb3RlY3RlZCBieSBzdHJ1Y3QgZHJtX2RldmljZTo6bWFzdGVyX211dGV4LgorCSAqLwor CXVuc2lnbmVkIGFsbG93ZWRfbWFzdGVyOjE7CiAKIAlzdHJ1Y3QgcGlkICpwaWQ7CiAJa3VpZF90 IHVpZDsKQEAgLTkxMCw2ICs5MTUsNyBAQCBleHRlcm4gaW50IGRybV9vcGVuKHN0cnVjdCBpbm9k ZSAqaW5vZGUsIHN0cnVjdCBmaWxlICpmaWxwKTsKIGV4dGVybiBzc2l6ZV90IGRybV9yZWFkKHN0 cnVjdCBmaWxlICpmaWxwLCBjaGFyIF9fdXNlciAqYnVmZmVyLAogCQkJc2l6ZV90IGNvdW50LCBs b2ZmX3QgKm9mZnNldCk7CiBleHRlcm4gaW50IGRybV9yZWxlYXNlKHN0cnVjdCBpbm9kZSAqaW5v ZGUsIHN0cnVjdCBmaWxlICpmaWxwKTsKK2V4dGVybiBpbnQgZHJtX25ld19zZXRfbWFzdGVyKHN0 cnVjdCBkcm1fZGV2aWNlICpkZXYsIHN0cnVjdCBkcm1fZmlsZSAqZnByaXYpOwogCiAJCQkJLyog TWFwcGluZyBzdXBwb3J0IChkcm1fdm0uaCkgKi8KIGV4dGVybiB1bnNpZ25lZCBpbnQgZHJtX3Bv bGwoc3RydWN0IGZpbGUgKmZpbHAsIHN0cnVjdCBwb2xsX3RhYmxlX3N0cnVjdCAqd2FpdCk7Ci0t IAoyLjUuMAoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K ZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0 dHA6Ly9saXN0cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2ZWwK