linux-kernel - Re: [PATCH v6,03/24] v4l2: verify restricted dmabufs are used in restricted queue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 12 Jun 2024 13:31:22 +0900
From: Tomasz Figa <tfiga@...omium.org>
To: Yunfei Dong <yunfei.dong@...iatek.com>
Cc: Jeffrey Kardatzke <jkardatzke@...gle.com>, 
	Nícolas F . R . A . Prado <nfraprado@...labora.com>, Nathan Hebert <nhebert@...omium.org>, 
	Nicolas Dufresne <nicolas.dufresne@...labora.com>, Hans Verkuil <hverkuil-cisco@...all.nl>, 
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>, Benjamin Gaignard <benjamin.gaignard@...labora.com>, 
	Sebastian Fricke <sebastian.fricke@...labora.com>, Mauro Carvalho Chehab <mchehab@...nel.org>, 
	Marek Szyprowski <m.szyprowski@...sung.com>, Chen-Yu Tsai <wenst@...omium.org>, 
	Yong Wu <yong.wu@...iatek.com>, Hsin-Yi Wang <hsinyi@...omium.org>, 
	Fritz Koenig <frkoenig@...omium.org>, Daniel Vetter <daniel@...ll.ch>, 
	Steve Cho <stevecho@...omium.org>, Sumit Semwal <sumit.semwal@...aro.org>, 
	Brian Starkey <Brian.Starkey@....com>, John Stultz <jstultz@...gle.com>, 
	"T . J . Mercier" <tjmercier@...gle.com>, Christian König <christian.koenig@....com>, 
	Matthias Brugger <matthias.bgg@...il.com>, linux-media@...r.kernel.org, dri-devel@...ts.freedesktop.org, 
	linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org, 
	linux-mediatek@...ts.infradead.org, Project_Global_Chrome_Upstream_Group@...iatek.com
Subject: Re: [PATCH v6,03/24] v4l2: verify restricted dmabufs are used in
 restricted queue

On Thu, May 16, 2024 at 08:20:41PM +0800, Yunfei Dong wrote:
> From: Jeffrey Kardatzke <jkardatzke@...gle.com>
> 
> Verfies in the dmabuf implementations that if the restricted memory
> flag is set for a queue that the dmabuf submitted to the queue is
> unmappable.
> 
> Signed-off-by: Jeffrey Kardatzke <jkardatzke@...gle.com>
> Signed-off-by: Yunfei Dong <yunfei.dong@...iatek.com>
> ---
>  drivers/media/common/videobuf2/videobuf2-dma-contig.c | 8 ++++++++
>  drivers/media/common/videobuf2/videobuf2-dma-sg.c     | 8 ++++++++
>  2 files changed, 16 insertions(+)
> 
> diff --git a/drivers/media/common/videobuf2/videobuf2-dma-contig.c b/drivers/media/common/videobuf2/videobuf2-dma-contig.c
> index 3d4fd4ef5310..35a3c1c01eae 100644
> --- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c
> +++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c
> @@ -710,6 +710,14 @@ static int vb2_dc_map_dmabuf(void *mem_priv)
>  		return -EINVAL;
>  	}
>  
> +	/* Verify the dmabuf is restricted if we are in restricted mode, this is done
> +	 * by validating there is no page entry for the dmabuf.
> +	 */

Kernel coding style [1] defines multi-line comments to start with an empty
line.

[1] https://www.kernel.org/doc/html/latest/process/coding-style.html#commenting

> +	if (buf->vb->vb2_queue->restricted_mem && !sg_dma_is_restricted(sgt->sgl)) {
> +		pr_err("restricted queue requires restricted dma_buf");
> +		return -EINVAL;

This would leak the mapping. We need to unmap the attachment here.

> +	}
> +
>  	/* checking if dmabuf is big enough to store contiguous chunk */
>  	contig_size = vb2_dc_get_contiguous_size(sgt);
>  	if (contig_size < buf->size) {
> diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
> index 6975a71d740f..2399a9c074ba 100644
> --- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
> +++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
> @@ -570,6 +570,14 @@ static int vb2_dma_sg_map_dmabuf(void *mem_priv)
>  		return -EINVAL;
>  	}
>  
> +	/* Verify the dmabuf is restricted if we are in restricted mode, this is done
> +	 * by validating there is no page entry for the dmabuf.
> +	 */

Ditto.

> +	if (buf->vb->vb2_queue->restricted_mem && !sg_dma_is_restricted(sgt->sgl)) {
> +		pr_err("restricted queue requires restricted dma_buf");
> +		return -EINVAL;

Ditto.

Best regards,
Tomasz

> +	}
> +
>  	buf->dma_sgt = sgt;
>  	buf->vaddr = NULL;
>  
> -- 
> 2.25.1
>