linux-kernel - Re: [PATCH] Revert "drm/nouveau: check ioctl command codes better"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <DBILKMS2C1HI.QDSXTIXBVWV2@kernel.org>
Date: Tue, 22 Jul 2025 14:53:52 +0200
From: "Danilo Krummrich" <dakr@...nel.org>
To: "Arnd Bergmann" <arnd@...nel.org>
Cc: "Lyude Paul" <lyude@...hat.com>, "David Airlie" <airlied@...il.com>,
 "Simona Vetter" <simona@...ll.ch>, "Arnd Bergmann" <arnd@...db.de>,
 "Satadru Pramanik" <satadru@...il.com>, "Chris Bainbridge"
 <chris.bainbridge@...il.com>, "Ben Skeggs" <bskeggs@...dia.com>, "Timur
 Tabi" <ttabi@...dia.com>, "Dave Airlie" <airlied@...hat.com>, "Thomas
 Zimmermann" <tzimmermann@...e.de>, <dri-devel@...ts.freedesktop.org>,
 <nouveau@...ts.freedesktop.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] Revert "drm/nouveau: check ioctl command codes better"

On Tue Jul 22, 2025 at 1:58 PM CEST, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@...db.de>
>
> My previous patch ended up causing a regression for the
> DRM_IOCTL_NOUVEAU_NVIF ioctl. The intention of my patch was to only
> pass ioctl commands that have the correct dir/type/nr bits into the
> nouveau_abi16_ioctl() function.
>
> This turned out to be too strict, as userspace does use at least
> write-only and write-read direction settings. Checking for both of these
> still did not fix the issue, so the best we can do for the 6.16 release
> is to revert back to what we've had since linux-3.16.
>
> This version is still fragile, but at least it is known to work with
> existing userspace. Fixing this properly requires a better understanding
> of what commands are being passed from userspace in practice, and how
> that relies on the undocumented (mis)behavior in nouveau_drm_ioctl().
>
> Fixes: e5478166dffb ("drm/nouveau: check ioctl command codes better")
> Link: https://lore.kernel.org/dri-devel/CAFrh3J85tsZRpOHQtKgNHUVnn=EG=QKBnZTRtWS8eWSc1K1xkA@mail.gmail.com/
> Reported-by: Satadru Pramanik <satadru@...il.com>
> Reported-by: Chris Bainbridge <chris.bainbridge@...il.com>
> Signed-off-by: Arnd Bergmann <arnd@...db.de>

Applied to drm-misc-fixes, thanks!

  [ Add Closes: tags, fix minor typo in commit message. - Danilo ]