From patchwork Mon Mar 1 09:52:53 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Vetter X-Patchwork-Id: 12109363 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC251C433DB for ; Mon, 1 Mar 2021 09:53:05 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 31D666146D for ; Mon, 1 Mar 2021 09:53:05 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 31D666146D Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=ffwll.ch Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 7DFF46E55C; Mon, 1 Mar 2021 09:53:04 +0000 (UTC) Received: from mail-wm1-x335.google.com (mail-wm1-x335.google.com [IPv6:2a00:1450:4864:20::335]) by gabe.freedesktop.org (Postfix) with ESMTPS id 212196E550 for ; Mon, 1 Mar 2021 09:53:03 +0000 (UTC) Received: by mail-wm1-x335.google.com with SMTP id u11so7660322wmq.5 for ; Mon, 01 Mar 2021 01:53:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=gCxNwSmtosKjBOsP3oJostPTdxL4pw1j5WTp0Gs5jN4=; b=aT/lpsg3hVIo/j/sXTbm1YQnEo2Mhu8qNhuBG1++3ci9SmJZnTW1ScmMGSFirtKKo+ 6p/wq16Ys3GaxMJGktYpmGy9yfrOinrwYQg8YIxDxaODMfAeY07P6X6DxvfKufZ+/jKz jcvC1b842TLcrMDiduAHx5Mt88Yg6pXG8VfZE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=gCxNwSmtosKjBOsP3oJostPTdxL4pw1j5WTp0Gs5jN4=; b=MX9UKAEefNClOs3qNLNTcCwI3haPPuqIqadcMaBA+B3PH16K/FamzPQ4eAxH1vpFlB 4XX298q3i9EKwcw8gQSPiPpK3YXDXKhYkJcAzEUZACfoQPDhsh94wbVN27M9Upc4VPcV zuaEMW+nrAlWPXdKhdAPKmAZwgHKitMtzwlH0NHhfMX+5+MsL/ZCSgK9WEl9IwZkfhY1 y8cc03i6fYMX7WeKsljn+SDygOecaMFcy7OZ29rHcRRKKIKISnmJIoITYCKAs0lh4IPa bKmzL6sUJnbC7d7TTUFNw+ujLeM7KGDOhwShHYBoQTlWegwvePNPGXv9G5ZnZFQ52zC5 Y9lQ== X-Gm-Message-State: AOAM533NSdu9jmxoNwvnChwXriupIW1Lpk3bn/SWoTMxh7alyUmLKXih S2LN6duhm/wgEOnIKWvgRzNFbe+MfB7yiA== X-Google-Smtp-Source: ABdhPJzS9tzgwkxeKN9NVWheGzS19gf3IPi0FqJ1+eBzNy1c7Bj1uTvARfgNW1EOExC3AnAg0STfPw== X-Received: by 2002:a7b:c242:: with SMTP id b2mr13089760wmj.119.1614592381781; Mon, 01 Mar 2021 01:53:01 -0800 (PST) Received: from phenom.ffwll.local ([2a02:168:57f4:0:efd0:b9e5:5ae6:c2fa]) by smtp.gmail.com with ESMTPSA id c9sm21770155wmb.33.2021.03.01.01.53.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Mar 2021 01:53:00 -0800 (PST) From: Daniel Vetter To: DRI Development Subject: [PATCH 1/2] drm/etnaviv: Use FOLL_FORCE for userptr Date: Mon, 1 Mar 2021 10:52:53 +0100 Message-Id: <20210301095254.1946084-1-daniel.vetter@ffwll.ch> X-Mailer: git-send-email 2.30.0 MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: John Hubbard , Daniel Vetter , etnaviv@lists.freedesktop.org, stable@vger.kernel.org, Russell King , Daniel Vetter Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Nothing checks userptr.ro except this call to pup_fast, which means there's nothing actually preventing userspace from writing to this. Which means you can just read-only mmap any file you want, userptr it and then write to it with the gpu. Not good. The right way to handle this is FOLL_WRITE | FOLL_FORCE, which will break any COW mappings and update tracking for MAY_WRITE mappings so there's no exploit and the vm isn't confused about what's going on. For any legit use case there's no difference from what userspace can observe and do. Cc: stable@vger.kernel.org Cc: John Hubbard Signed-off-by: Daniel Vetter Cc: Lucas Stach Cc: Russell King Cc: Christian Gmeiner Cc: etnaviv@lists.freedesktop.org Reviewed-by: Lucas Stach --- drivers/gpu/drm/etnaviv/etnaviv_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c index 6d38c5c17f23..a9e696d05b33 100644 --- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c @@ -689,7 +689,7 @@ static int etnaviv_gem_userptr_get_pages(struct etnaviv_gem_object *etnaviv_obj) struct page **pages = pvec + pinned; ret = pin_user_pages_fast(ptr, num_pages, - !userptr->ro ? FOLL_WRITE : 0, pages); + FOLL_WRITE | FOLL_FORCE, pages); if (ret < 0) { unpin_user_pages(pvec, pinned); kvfree(pvec); From patchwork Mon Mar 1 09:52:54 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Vetter X-Patchwork-Id: 12109365 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7919BC433E9 for ; Mon, 1 Mar 2021 09:53:10 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B090B64E40 for ; Mon, 1 Mar 2021 09:53:09 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B090B64E40 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=ffwll.ch Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id D01A26E560; Mon, 1 Mar 2021 09:53:04 +0000 (UTC) Received: from mail-wm1-x32b.google.com (mail-wm1-x32b.google.com [IPv6:2a00:1450:4864:20::32b]) by gabe.freedesktop.org (Postfix) with ESMTPS id F05286E55C for ; Mon, 1 Mar 2021 09:53:03 +0000 (UTC) Received: by mail-wm1-x32b.google.com with SMTP id m1so13823150wml.2 for ; Mon, 01 Mar 2021 01:53:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=EeI5BVtXyBefOOJ/+aIoV3DIZyRdktgzKXSwldp6gq0=; b=QXspYk7DS04z5eUBW9cQsUAIwrzMNOLHNcC+SckHflj62WDbMbFuafwPwdu5J8j8ek B6/2FbH0e6z/iVAwNipbgWFZzKFk2iHwHyoTvAjrY/X10dQTQAwMX4L9Iis/6LeGCXGx xN4KyoCcDQoyJcsvinRXAow9txmNXBA86E+1c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=EeI5BVtXyBefOOJ/+aIoV3DIZyRdktgzKXSwldp6gq0=; b=N0oB0M2ctr2MRCqiw2Asrhh1qGvJcu4T+5L3mqYFusSfMNfx2XnW7xoNj3qr8ELxUf exWpIMEOBOsiuRNuQq6BOwvaqMmH+ePLji0LL2tRFTnAEXeccMqHPqDA3dd1SqprwGFx 77zcdYC7TfTkT4fQK0/lLMYcoQsPcICuchjsxdj0kVQWOarKMYhMEDMTDHpkgSXq1To8 k8Rqf7kyfeLH0VZQVOSrV+vK5esZuoHbjJ9COU1tp0UrT/1L12/3Kr67DQBFeqQsu0Er vy8Jj6R2IdNuT2SbVExbymtllXaeBb40Gv5H23Ep+kBlAorKSqG1gwR+tSi27Ciaf0xS Pgxg== X-Gm-Message-State: AOAM533A9RMoZcVdF3hCncgEIyaiwGmMHq4HbPwXkiWIRomvoALQx30e 1TR+fQXkWZ1nmgh7rj72dyaPCri2CYPZDQ== X-Google-Smtp-Source: ABdhPJzAT/HGgrD0jcr9hGqgkHEqI6mRUy3x2si+8Fm43GhWylSKXhSbuAtccfHgZVQUYP86vSCPzw== X-Received: by 2002:a05:600c:410e:: with SMTP id j14mr15446043wmi.36.1614592382589; Mon, 01 Mar 2021 01:53:02 -0800 (PST) Received: from phenom.ffwll.local ([2a02:168:57f4:0:efd0:b9e5:5ae6:c2fa]) by smtp.gmail.com with ESMTPSA id c9sm21770155wmb.33.2021.03.01.01.53.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Mar 2021 01:53:02 -0800 (PST) From: Daniel Vetter To: DRI Development Subject: [PATCH 2/2] drm/etnaviv: User FOLL_LONGTERM in userptr Date: Mon, 1 Mar 2021 10:52:54 +0100 Message-Id: <20210301095254.1946084-2-daniel.vetter@ffwll.ch> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210301095254.1946084-1-daniel.vetter@ffwll.ch> References: <20210301095254.1946084-1-daniel.vetter@ffwll.ch> MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: John Hubbard , Daniel Vetter , etnaviv@lists.freedesktop.org, Russell King , Daniel Vetter Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" There's no mmu notifier or anything like that, releasing this pin is entirely up to userspace. Hence FOLL_LONGTERM. No cc: stable for this patch since a lot of the infrastructure around FOLL_LONGETRM (like not allowing it for pages currently sitting in ZONE_MOVEABLE before they're migrated) is still being worked on. So not big benefits yet. Cc: John Hubbard Signed-off-by: Daniel Vetter Cc: Lucas Stach Cc: Russell King Cc: Christian Gmeiner Cc: etnaviv@lists.freedesktop.org Reviewed-by: John Hubbard --- drivers/gpu/drm/etnaviv/etnaviv_gem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c index a9e696d05b33..db69f19ab5bc 100644 --- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c @@ -689,7 +689,8 @@ static int etnaviv_gem_userptr_get_pages(struct etnaviv_gem_object *etnaviv_obj) struct page **pages = pvec + pinned; ret = pin_user_pages_fast(ptr, num_pages, - FOLL_WRITE | FOLL_FORCE, pages); + FOLL_WRITE | FOLL_FORCE | FOLL_LONGTERM, + pages); if (ret < 0) { unpin_user_pages(pvec, pinned); kvfree(pvec);