linux-kernel - Re: [PATCH RFC] drm/amdgpu: Block userspace mapping of IO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <241a9bbb-6d59-4c24-8e18-a0acebc6f536@amd.com>
Date: Wed, 16 Apr 2025 09:51:02 +0200
From: Christian König <christian.koenig@....com>
To: Ujwal Kundur <ujwal.kundur@...il.com>, alexander.deucher@....com
Cc: airlied@...il.com, simona@...ll.ch, lijo.lazar@....com,
 sunil.khatri@....com, Hawking.Zhang@....com, Jun.Ma2@....com,
 Yunxiang.Li@....com, amd-gfx@...ts.freedesktop.org,
 dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH RFC] drm/amdgpu: Block userspace mapping of IO

Am 16.04.25 um 09:28 schrieb Ujwal Kundur:
> This is a RFC patch for blocking userspace mapping of IO register(s)
> before ioremap() calls are made. Out of the available IRQ sources, CRTC
> seemed the most appropriate for this task, however I'm not quite sure
> about that as well as the type, which I've set to 0.

Hui what? Why do you think that grabbing a reference to an interrupt would block userspace mapping of IO registers?

Christian.

>
> If I understand correctly, we actually want to block certain ioctls from
> userspace that can interfere with ioremap but I don't see a dedicated
> source for that.
>
> Signed-off-by: Ujwal Kundur <ujwal.kundur@...il.com>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> index a30111d2c3ea..365af52af6e5 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> @@ -47,6 +47,7 @@
>  #include <linux/vga_switcheroo.h>
>  #include <linux/efi.h>
>  #include "amdgpu.h"
> +#include "amdgpu_irq.h"
>  #include "amdgpu_trace.h"
>  #include "amdgpu_i2c.h"
>  #include "atom.h"
> @@ -4367,7 +4368,9 @@ int amdgpu_device_init(struct amdgpu_device *adev,
>  	ratelimit_set_flags(&adev->throttling_logging_rs, RATELIMIT_MSG_ON_RELEASE);
>  
>  	/* Registers mapping */
> -	/* TODO: block userspace mapping of io register */
> +	/* Block userspace mapping of io register */
> +	amdgpu_irq_put(adev, &adev->crtc_irq, 0);
> +
>  	if (adev->asic_type >= CHIP_BONAIRE) {
>  		adev->rmmio_base = pci_resource_start(adev->pdev, 5);
>  		adev->rmmio_size = pci_resource_len(adev->pdev, 5);
> @@ -4380,6 +4383,9 @@ int amdgpu_device_init(struct amdgpu_device *adev,
>  		atomic_set(&adev->pm.pwr_state[i], POWER_STATE_UNKNOWN);
>  
>  	adev->rmmio = ioremap(adev->rmmio_base, adev->rmmio_size);
> +
> +	amdgpu_irq_get(adev, &adev->crtc_irq, 0);
> +
>  	if (!adev->rmmio)
>  		return -ENOMEM;
>