linux-kernel - Re: [PATCH 3/4] fbdev: Add FBINFO_HIDE_SMEM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 Sep 2018 18:48:47 +0200
From:   Daniel Vetter <daniel@...ll.ch>
To:     DRI Development <dri-devel@...ts.freedesktop.org>
Cc:     Intel Graphics Development <intel-gfx@...ts.freedesktop.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Daniel Vetter <daniel.vetter@...ll.ch>,
        Bartlomiej Zolnierkiewicz <b.zolnierkie@...sung.com>,
        Kees Cook <keescook@...omium.org>, linux-fbdev@...r.kernel.org,
        Daniel Vetter <daniel.vetter@...el.com>
Subject: Re: [PATCH 3/4] fbdev: Add FBINFO_HIDE_SMEM_START flag

On Wed, Aug 22, 2018 at 10:54:04AM +0200, Daniel Vetter wrote:
> DRM drivers really, really, really don't want random userspace to
> share buffer behind it's back, bypassing the dma-buf buffer sharing
> machanism. For that reason we've ruthlessly rejected any IOCTL
> exposing the physical address of any graphics buffer.
> 
> Unfortunately fbdev comes with that built-in. We could just set
> smem_start to 0, but that means we'd have to hand-roll our own fb_mmap
> implementation. For good reasons many drivers do that, but
> smem_start/length is still super convenient.
> 
> Hence instead just stop the leak in the ioctl, to keep fb mmap working
> as-is. A second patch will set this flag for all drm drivers.
> 
> Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@...sung.com>
> Cc: Kees Cook <keescook@...omium.org>
> Cc: Daniel Vetter <daniel.vetter@...ll.ch>
> Cc: linux-fbdev@...r.kernel.org
> Signed-off-by: Daniel Vetter <daniel.vetter@...el.com>

Any comments from the fbdev side on this?
-Daniel

> ---
>  drivers/video/fbdev/core/fbmem.c | 4 ++++
>  include/linux/fb.h               | 7 +++++++
>  2 files changed, 11 insertions(+)
> 
> diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
> index 609438d2465b..549d0f86fcf3 100644
> --- a/drivers/video/fbdev/core/fbmem.c
> +++ b/drivers/video/fbdev/core/fbmem.c
> @@ -1116,6 +1116,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
>  		if (!lock_fb_info(info))
>  			return -ENODEV;
>  		fix = info->fix;
> +		if (info->flags & FBINFO_HIDE_SMEM_START)
> +			fix.smem_start = 0;
>  		unlock_fb_info(info);
>  
>  		ret = copy_to_user(argp, &fix, sizeof(fix)) ? -EFAULT : 0;
> @@ -1326,6 +1328,8 @@ static int fb_get_fscreeninfo(struct fb_info *info, unsigned int cmd,
>  	if (!lock_fb_info(info))
>  		return -ENODEV;
>  	fix = info->fix;
> +	if (info->flags & FBINFO_HIDE_SMEM_START)
> +		fix.smem_start = 0;
>  	unlock_fb_info(info);
>  	return do_fscreeninfo_to_user(&fix, compat_ptr(arg));
>  }
> diff --git a/include/linux/fb.h b/include/linux/fb.h
> index fa8c6f9c9c3a..f42b09ca71f8 100644
> --- a/include/linux/fb.h
> +++ b/include/linux/fb.h
> @@ -456,6 +456,13 @@ struct fb_tile_ops {
>   * and host endianness. Drivers should not use this flag.
>   */
>  #define FBINFO_BE_MATH  0x100000
> +/*
> + * Hide smem_start in the FBIOGET_FSCREENINFO IOCTL. This is used by modern DRM
> + * drivers to stop userspace from trying to share buffers behind the kernel's
> + * back. Instead dma-buf based buffer sharing should be used.
> + */
> +#define FBINFO_HIDE_SMEM_START  0x200000
> +
>  
>  struct fb_info {
>  	atomic_t count;
> -- 
> 2.18.0
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch