From: Lucas Stach <l.stach@pengutronix.de>
To: Daniel Vetter <daniel@ffwll.ch>,
DRI Development <dri-devel@lists.freedesktop.org>
Cc: John Hubbard <jhubbard@nvidia.com>,
Daniel Vetter <daniel.vetter@ffwll.ch>,
etnaviv@lists.freedesktop.org, stable@vger.kernel.org,
Russell King <linux+etnaviv@armlinux.org.uk>,
Daniel Vetter <daniel.vetter@intel.com>
Subject: Re: [PATCH 1/2] drm/etnaviv: Use FOLL_FORCE for userptr
Date: Fri, 19 Mar 2021 20:13:06 +0100 [thread overview]
Message-ID: <693cbfa87ac025d84e1cd8d95c5bd68ec68a943b.camel@pengutronix.de> (raw)
In-Reply-To: <YFT3B9fRldXI470m@phenom.ffwll.local>
Am Freitag, dem 19.03.2021 um 20:09 +0100 schrieb Daniel Vetter:
> On Mon, Mar 01, 2021 at 10:52:53AM +0100, Daniel Vetter wrote:
> > Nothing checks userptr.ro except this call to pup_fast, which means
> > there's nothing actually preventing userspace from writing to this.
> > Which means you can just read-only mmap any file you want, userptr it
> > and then write to it with the gpu. Not good.
> >
> > The right way to handle this is FOLL_WRITE | FOLL_FORCE, which will
> > break any COW mappings and update tracking for MAY_WRITE mappings so
> > there's no exploit and the vm isn't confused about what's going on.
> > For any legit use case there's no difference from what userspace can
> > observe and do.
> >
> > Cc: stable@vger.kernel.org
> > Cc: John Hubbard <jhubbard@nvidia.com>
> > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> > Cc: Lucas Stach <l.stach@pengutronix.de>
> > Cc: Russell King <linux+etnaviv@armlinux.org.uk>
> > Cc: Christian Gmeiner <christian.gmeiner@gmail.com>
> > Cc: etnaviv@lists.freedesktop.org
>
> Can I please have an ack on this so I can apply it? It's stuck.
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
> Thanks, Daniel
>
> > ---
> > drivers/gpu/drm/etnaviv/etnaviv_gem.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
> > index 6d38c5c17f23..a9e696d05b33 100644
> > --- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
> > +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
> > @@ -689,7 +689,7 @@ static int etnaviv_gem_userptr_get_pages(struct etnaviv_gem_object *etnaviv_obj)
> > struct page **pages = pvec + pinned;
> >
> >
> >
> >
> > ret = pin_user_pages_fast(ptr, num_pages,
> > - !userptr->ro ? FOLL_WRITE : 0, pages);
> > + FOLL_WRITE | FOLL_FORCE, pages);
> > if (ret < 0) {
> > unpin_user_pages(pvec, pinned);
> > kvfree(pvec);
> > --
> > 2.30.0
> >
>
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
prev parent reply other threads:[~2021-03-19 19:13 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-01 9:52 [PATCH 1/2] drm/etnaviv: Use FOLL_FORCE for userptr Daniel Vetter
2021-03-01 9:52 ` [PATCH 2/2] drm/etnaviv: User FOLL_LONGTERM in userptr Daniel Vetter
2021-03-01 10:26 ` John Hubbard
2021-03-19 19:16 ` Daniel Vetter
2021-03-01 10:28 ` [PATCH 1/2] drm/etnaviv: Use FOLL_FORCE for userptr Lucas Stach
2021-03-01 13:50 ` Daniel Vetter
2021-03-19 19:09 ` Daniel Vetter
2021-03-19 19:13 ` Lucas Stach [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=693cbfa87ac025d84e1cd8d95c5bd68ec68a943b.camel@pengutronix.de \
--to=l.stach@pengutronix.de \
--cc=daniel.vetter@ffwll.ch \
--cc=daniel.vetter@intel.com \
--cc=daniel@ffwll.ch \
--cc=dri-devel@lists.freedesktop.org \
--cc=etnaviv@lists.freedesktop.org \
--cc=jhubbard@nvidia.com \
--cc=linux+etnaviv@armlinux.org.uk \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).