From patchwork Wed Nov 13 17:19:44 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Wilson X-Patchwork-Id: 11242357 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 70E9F138C for ; Wed, 13 Nov 2019 17:20:15 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 2B6BE206D5 for ; Wed, 13 Nov 2019 17:20:10 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 2B6BE206D5 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=chris-wilson.co.uk Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=intel-gfx-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 2C02F6EDBC; Wed, 13 Nov 2019 17:20:06 +0000 (UTC) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from fireflyinternet.com (mail.fireflyinternet.com [109.228.58.192]) by gabe.freedesktop.org (Postfix) with ESMTPS id 8291B6EDBC for ; Wed, 13 Nov 2019 17:20:04 +0000 (UTC) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=78.156.65.138; Received: from haswell.alporthouse.com (unverified [78.156.65.138]) by fireflyinternet.com (Firefly Internet (M1)) with ESMTP id 19190594-1500050 for multiple; Wed, 13 Nov 2019 17:19:46 +0000 From: Chris Wilson To: intel-gfx@lists.freedesktop.org Date: Wed, 13 Nov 2019 17:19:44 +0000 Message-Id: <20191113171944.19308-1-chris@chris-wilson.co.uk> X-Mailer: git-send-email 2.24.0 MIME-Version: 1.0 Subject: [Intel-gfx] [PATCH] drm/i915/fbdev: Hide smem_start from userspace X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Daniel Vetter Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" Do not leak our internal kernel address for random userspace to abuse. Daniel added the support to fbdev to filter out the physical addresses being exposed by fbdev, put that to use to protect ourselves. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112256 Fixes: 5f889b9a61dd ("drm/i915: Disregard drm_mode_config.fb_base") References: da6c7707caf3 ("fbdev: Add FBINFO_HIDE_SMEM_START flag") Signed-off-by: Chris Wilson Cc: Daniel Vetter Cc: Maarten Lankhorst --- drivers/gpu/drm/i915/display/intel_fbdev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c index 3d1061470e76..bff311561597 100644 --- a/drivers/gpu/drm/i915/display/intel_fbdev.c +++ b/drivers/gpu/drm/i915/display/intel_fbdev.c @@ -226,8 +226,8 @@ static int intelfb_create(struct drm_fb_helper *helper, goto out_unpin; } - ifbdev->helper.fb = &ifbdev->fb->base; - + /* don't leak any physical addresses to userspace */ + info->flags |= FBINFO_HIDE_SMEM_START; info->fbops = &intelfb_ops; /* setup aperture base/size for vesafb takeover */ @@ -247,6 +247,7 @@ static int intelfb_create(struct drm_fb_helper *helper, info->fix.smem_start = (unsigned long)info->screen_base; info->fix.smem_len = info->screen_size; + ifbdev->helper.fb = &ifbdev->fb->base; drm_fb_helper_fill_info(info, &ifbdev->helper, sizes); /* If the object is shmemfs backed, it will have given us zeroed pages.