* [PATCH] drm/msm: protect against faults from copy_from_user() in submit ioctl
@ 2016-09-15 14:39 Rob Clark
2016-09-15 17:18 ` Greg KH
0 siblings, 1 reply; 3+ messages in thread
From: Rob Clark @ 2016-09-15 14:39 UTC (permalink / raw)
To: stable; +Cc: Rob Clark
commit d78d383ab354b0b9e1d23404ae0d9fbdeb9aa035 upstream.
An evil userspace could try to cause deadlock by passing an unfaulted-in
GEM bo as submit->bos (or submit->cmds) table. Which will trigger
msm_gem_fault() while we already hold struct_mutex. See:
https://github.com/freedreno/msmtest/blob/master/evilsubmittest.c
Cc: stable@vger.kernel.org
Signed-off-by: Rob Clark <robdclark@gmail.com>
---
drivers/gpu/drm/msm/msm_drv.h | 6 ++++++
drivers/gpu/drm/msm/msm_gem.c | 9 +++++++++
drivers/gpu/drm/msm/msm_gem_submit.c | 2 ++
3 files changed, 17 insertions(+)
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 5b2963f..16ae246 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -148,6 +148,12 @@ struct msm_drm_private {
} vram;
struct msm_vblank_ctrl vblank_ctrl;
+
+ /* task holding struct_mutex.. currently only used in submit path
+ * to detect and reject faults from copy_from_user() for submit
+ * ioctl.
+ */
+ struct task_struct *struct_mutex_task;
};
struct msm_format {
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 69836f5..46ffcbf 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -196,11 +196,20 @@ int msm_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
{
struct drm_gem_object *obj = vma->vm_private_data;
struct drm_device *dev = obj->dev;
+ struct msm_drm_private *priv = dev->dev_private;
struct page **pages;
unsigned long pfn;
pgoff_t pgoff;
int ret;
+ /* This should only happen if userspace tries to pass a mmap'd
+ * but unfaulted gem bo vaddr into submit ioctl, triggering
+ * a page fault while struct_mutex is already held. This is
+ * not a valid use-case so just bail.
+ */
+ if (priv->struct_mutex_task == current)
+ return VM_FAULT_SIGBUS;
+
/* Make sure we don't parallel update on a fault, nor move or remove
* something from beneath our feet
*/
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index eb515f0..c1889d7 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -394,6 +394,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
return -ENOMEM;
mutex_lock(&dev->struct_mutex);
+ priv->struct_mutex_task = current;
ret = submit_lookup_objects(submit, args, file);
if (ret)
@@ -479,6 +480,7 @@ out:
submit_cleanup(submit);
if (ret)
msm_gem_submit_free(submit);
+ priv->struct_mutex_task = NULL;
mutex_unlock(&dev->struct_mutex);
return ret;
}
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] drm/msm: protect against faults from copy_from_user() in submit ioctl
2016-09-15 14:39 [PATCH] drm/msm: protect against faults from copy_from_user() in submit ioctl Rob Clark
@ 2016-09-15 17:18 ` Greg KH
2016-09-15 18:05 ` Rob Clark
0 siblings, 1 reply; 3+ messages in thread
From: Greg KH @ 2016-09-15 17:18 UTC (permalink / raw)
To: Rob Clark; +Cc: stable
On Thu, Sep 15, 2016 at 10:39:57AM -0400, Rob Clark wrote:
> commit d78d383ab354b0b9e1d23404ae0d9fbdeb9aa035 upstream.
>
> An evil userspace could try to cause deadlock by passing an unfaulted-in
> GEM bo as submit->bos (or submit->cmds) table. Which will trigger
> msm_gem_fault() while we already hold struct_mutex. See:
>
> https://github.com/freedreno/msmtest/blob/master/evilsubmittest.c
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Rob Clark <robdclark@gmail.com>
> ---
> drivers/gpu/drm/msm/msm_drv.h | 6 ++++++
> drivers/gpu/drm/msm/msm_gem.c | 9 +++++++++
> drivers/gpu/drm/msm/msm_gem_submit.c | 2 ++
> 3 files changed, 17 insertions(+)
What stable kernel(s) do you want this applied to?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] drm/msm: protect against faults from copy_from_user() in submit ioctl
2016-09-15 17:18 ` Greg KH
@ 2016-09-15 18:05 ` Rob Clark
0 siblings, 0 replies; 3+ messages in thread
From: Rob Clark @ 2016-09-15 18:05 UTC (permalink / raw)
To: Greg KH; +Cc: stable
On Thu, Sep 15, 2016 at 1:18 PM, Greg KH <gregkh@linuxfoundation.org> wrote:
> On Thu, Sep 15, 2016 at 10:39:57AM -0400, Rob Clark wrote:
>> commit d78d383ab354b0b9e1d23404ae0d9fbdeb9aa035 upstream.
>>
>> An evil userspace could try to cause deadlock by passing an unfaulted-in
>> GEM bo as submit->bos (or submit->cmds) table. Which will trigger
>> msm_gem_fault() while we already hold struct_mutex. See:
>>
>> https://github.com/freedreno/msmtest/blob/master/evilsubmittest.c
>>
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Rob Clark <robdclark@gmail.com>
>> ---
>> drivers/gpu/drm/msm/msm_drv.h | 6 ++++++
>> drivers/gpu/drm/msm/msm_gem.c | 9 +++++++++
>> drivers/gpu/drm/msm/msm_gem_submit.c | 2 ++
>> 3 files changed, 17 insertions(+)
>
> What stable kernel(s) do you want this applied to?
Oh, sorry, this was rebased back to 4.7 (since I got an email that it
did not apply there). And I expect it should apply cleanly in this
form going back a few more kernel versions from there.
BR,
-R
> thanks,
>
> greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-09-15 18:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-15 14:39 [PATCH] drm/msm: protect against faults from copy_from_user() in submit ioctl Rob Clark
2016-09-15 17:18 ` Greg KH
2016-09-15 18:05 ` Rob Clark
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.