linux-kernel - Re: [PATCH v5 12/12] drm/drm_ioctl.c: Break ioctl when drm device not registered

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 7 Apr 2017 20:34:30 +0200
From:   Daniel Vetter <daniel@...ll.ch>
To:     jeffy <jeffy.chen@...k-chips.com>
Cc:     linux-kernel@...r.kernel.org, briannorris@...omium.org,
        dianders@...omium.org, tfiga@...omium.org,
        dri-devel@...ts.freedesktop.org, zyw@...k-chips.com,
        Daniel Vetter <daniel.vetter@...el.com>
Subject: Re: [PATCH v5 12/12] drm/drm_ioctl.c: Break ioctl when drm device
 not registered

On Fri, Apr 07, 2017 at 05:24:59PM +0800, jeffy wrote:
> Hi Daniel,
> 
> On 04/07/2017 03:16 PM, Daniel Vetter wrote:
> > On Thu, Apr 06, 2017 at 08:31:25PM +0800, Jeffy Chen wrote:
> > > After unbinding drm, the user space may still owns the drm dev fd,
> > > and may still be able to call drm ioctl.
> > > 
> > > Add a sanity check here to prevent that from happening.
> > > 
> > > Signed-off-by: Jeffy Chen <jeffy.chen@...k-chips.com>
> > > ---
> > > 
> > > Changes in v5: None
> > > Changes in v4: None
> > > Changes in v3: None
> > > Changes in v2: None
> > > 
> > >   drivers/gpu/drm/drm_ioctl.c | 2 +-
> > >   1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
> > > index 7d6deaa..15beb11 100644
> > > --- a/drivers/gpu/drm/drm_ioctl.c
> > > +++ b/drivers/gpu/drm/drm_ioctl.c
> > > @@ -674,7 +674,7 @@ long drm_ioctl(struct file *filp,
> > > 
> > >   	dev = file_priv->minor->dev;
> > > 
> > > -	if (drm_device_is_unplugged(dev))
> > > +	if (drm_device_is_unplugged(dev) || !dev->registered)
> > 
> > Shouldn't we instead automatically unplug the device in
> > drm_dev_unregister, instead of sprinkling tons of drm_device_is_unplugged
> > || !registered all over the place?
> > 
> it looks like the drm_unplug_dev would call drm_dev_unregister...
> maybe we can:
> 1/ replace the dev_unplug_dev in udl_drv.c to drm_dev_unregister
> 2/ call dev_unplug_dev in drm_dev_unregister, and remove drm_dev_unregister
> in dev_unplug_dev
> 3/ add a drm_plug_dev or drm_device_set_plugged, and call it in
> drm_dev_register

Yeah, sounds like a reasonable plan. I didn't review the full implications
of this because Fri evening :-) So pls double-check before you rewrite the
world ...

Cheers, Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch