linux-kernel - Re: [PATCH] drm/prime: Ensure mmap offset is initialized

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 30 May 2022 09:26:13 +0200
From:   Thomas Zimmermann <tzimmermann@...e.de>
To:     Rob Clark <robdclark@...il.com>, dri-devel@...ts.freedesktop.org
Cc:     Rob Clark <robdclark@...omium.org>,
        David Airlie <airlied@...ux.ie>, linux-arm-msm@...r.kernel.org,
        open list <linux-kernel@...r.kernel.org>,
        Gerd Hoffmann <kraxel@...hat.com>,
        freedreno@...ts.freedesktop.org
Subject: Re: [PATCH] drm/prime: Ensure mmap offset is initialized

Hi

Am 29.05.22 um 18:29 schrieb Rob Clark:
> From: Rob Clark <robdclark@...omium.org>
> 
> If a GEM object is allocated, and then exported as a dma-buf fd which is
> mmap'd before or without the GEM buffer being directly mmap'd, the
> vma_node could be unitialized.  This leads to a situation where the CPU
> mapping is not correctly torn down in drm_vma_node_unmap().

Which drivers are affected by this problem?

I checked several drivers and most appear to be initializing the offset 
during object construction, such as GEM SHMEM. [1] TTM-based drivers 
also seem unaffected. [2]

 From a quick grep, only etnaviv, msm and omapdrm appear to be affected? 
They only seem to run drm_gem_create_mmap_offset() from their 
ioctl-handling code.

If so, I'd say it's preferable to fix these drivers and put a 
drm_WARN_ONCE() into drm_gem_prime_mmap().

Best regards
Thomas

[1] 
https://elixir.bootlin.com/linux/v5.18/source/drivers/gpu/drm/drm_gem_shmem_helper.c#L85
[2] 
https://elixir.bootlin.com/linux/v5.18/source/drivers/gpu/drm/ttm/ttm_bo.c#L1002

> 
> Fixes: e5516553999f ("drm: call drm_gem_object_funcs.mmap with fake offset")
> Signed-off-by: Rob Clark <robdclark@...omium.org>
> ---
> Note, it's possible the issue existed in some related form prior to the
> commit tagged with Fixes.
> 
>   drivers/gpu/drm/drm_prime.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
> index e3f09f18110c..849eea154dfc 100644
> --- a/drivers/gpu/drm/drm_prime.c
> +++ b/drivers/gpu/drm/drm_prime.c
> @@ -716,6 +716,11 @@ int drm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma)
>   	struct file *fil;
>   	int ret;
>   
> +	/* Ensure that the vma_node is initialized: */
> +	ret = drm_gem_create_mmap_offset(obj);
> +	if (ret)
> +		return ret;
> +
>   	/* Add the fake offset */
>   	vma->vm_pgoff += drm_vma_node_start(&obj->vma_node);
>   

-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)