linux-kernel - Re: [PATCH v5 1/3] drm/shmem: add support for per object caching flags.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 27 Feb 2020 08:16:49 +0100
From:   Thomas Hellström (VMware) 
        <thomas_os@...pmail.org>
To:     Chia-I Wu <olvaffe@...il.com>
Cc:     Gerd Hoffmann <kraxel@...hat.com>,
        ML dri-devel <dri-devel@...ts.freedesktop.org>,
        Guillaume Gardet <Guillaume.Gardet@....com>,
        David Airlie <airlied@...ux.ie>,
        open list <linux-kernel@...r.kernel.org>,
        stable@...r.kernel.org,
        Gurchetan Singh <gurchetansingh@...omium.org>,
        tzimmermann@...e.de
Subject: Re: [PATCH v5 1/3] drm/shmem: add support for per object caching
 flags.

On 2/27/20 1:02 AM, Chia-I Wu wrote:
> On Wed, Feb 26, 2020 at 10:25 AM Thomas Hellström (VMware)
> <thomas_os@...pmail.org> wrote:
>> Hi, Gerd,
>>
>>
>>
>>    #define to_drm_gem_shmem_obj(obj) \
>> diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
>> index a421a2eed48a..aad9324dcf4f 100644
>> --- a/drivers/gpu/drm/drm_gem_shmem_helper.c
>> +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
>> @@ -254,11 +254,16 @@ static void *drm_gem_shmem_vmap_locked(struct drm_gem_shmem_object *shmem)
>>        if (ret)
>>                goto err_zero_use;
>>
>> -     if (obj->import_attach)
>> +     if (obj->import_attach) {
>>                shmem->vaddr = dma_buf_vmap(obj->import_attach->dmabuf);
>> -     else
>> +     } else {
>> +             pgprot_t prot = PAGE_KERNEL;
>> +
>> +             if (!shmem->map_cached)
>> +                     prot = pgprot_writecombine(prot);
>>                shmem->vaddr = vmap(shmem->pages, obj->size >> PAGE_SHIFT,
>> -                                 VM_MAP, pgprot_writecombine(PAGE_KERNEL));
>> +                                 VM_MAP, prot)
>>
>> Wouldn't a vmap with pgprot_writecombine() create conflicting mappings
>> with the linear kernel map which is not write-combined? Or do you change
>> the linear kernel map of the shmem pages somewhere? vmap bypassess at
>> least the x86 PAT core mapping consistency check and this could
>> potentially cause spuriously overwritten memory.
> Yeah, I think this creates a conflicting alias.  It seems a call to
> set_pages_array_wc here or changes elsewhere is needed..
>
> But this is a pre-existing issue in the shmem helper.  There is also
> no universal fix (e.g., set_pages_array_wc is x86 only)?  I would hope
> this series can be merged sooner to fix the regression first.

The problem is this isn't doable with shmem, since that would create 
interesting problems when pages are swapped out.

So I would argue that the correct fix is to revert commit 0be895893607f 
("drm/shmem: switch shmem helper to &drm_gem_object_funcs.mmap")

If some drivers can argue that in their particular environment it's safe 
to use writecombine in this way, then modifying the page protection 
should be moved out to those drivers documenting that assumption. Using 
pgprot_decrypted() in this way could never be safe.

But IMO this should never be part of generic helpers.

/Thomas