All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
To: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>, intel-gfx@lists.freedesktop.org
Subject: Re: [PATCH] drm/i915/fbdev: Hide smem_start from userspace
Date: Thu, 14 Nov 2019 12:53:11 +0200	[thread overview]
Message-ID: <20191114105311.GW1208@intel.com> (raw)
In-Reply-To: <20191113171944.19308-1-chris@chris-wilson.co.uk>

On Wed, Nov 13, 2019 at 05:19:44PM +0000, Chris Wilson wrote:
> Do not leak our internal kernel address for random userspace to abuse.
> Daniel added the support to fbdev to filter out the physical addresses
> being exposed by fbdev, put that to use to protect ourselves.
> 
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112256
> Fixes: 5f889b9a61dd ("drm/i915: Disregard drm_mode_config.fb_base")
> References: da6c7707caf3 ("fbdev: Add FBINFO_HIDE_SMEM_START flag")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> ---
>  drivers/gpu/drm/i915/display/intel_fbdev.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c
> index 3d1061470e76..bff311561597 100644
> --- a/drivers/gpu/drm/i915/display/intel_fbdev.c
> +++ b/drivers/gpu/drm/i915/display/intel_fbdev.c
> @@ -226,8 +226,8 @@ static int intelfb_create(struct drm_fb_helper *helper,
>  		goto out_unpin;
>  	}
>  
> -	ifbdev->helper.fb = &ifbdev->fb->base;
> -
> +	/* don't leak any physical addresses to userspace */
> +	info->flags |= FBINFO_HIDE_SMEM_START;

Doesn't the fb helper already do this?

Looks like it tries. Though I have no idea why it does
it in initial_config() instead of fill_fb_info().

>  	info->fbops = &intelfb_ops;
>  
>  	/* setup aperture base/size for vesafb takeover */
> @@ -247,6 +247,7 @@ static int intelfb_create(struct drm_fb_helper *helper,
>  	info->fix.smem_start = (unsigned long)info->screen_base;

Isn't screen_base the virtual address? Why do we put that into
smem_start?

>  	info->fix.smem_len = info->screen_size;
>  
> +	ifbdev->helper.fb = &ifbdev->fb->base;
>  	drm_fb_helper_fill_info(info, &ifbdev->helper, sizes);
>  
>  	/* If the object is shmemfs backed, it will have given us zeroed pages.
> -- 
> 2.24.0
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Ville Syrjälä
Intel
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

WARNING: multiple messages have this Message-ID (diff)
From: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
To: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>, intel-gfx@lists.freedesktop.org
Subject: Re: [Intel-gfx] [PATCH] drm/i915/fbdev: Hide smem_start from userspace
Date: Thu, 14 Nov 2019 12:53:11 +0200	[thread overview]
Message-ID: <20191114105311.GW1208@intel.com> (raw)
Message-ID: <20191114105311.EAyqDiUJsf9GIrEyAPCZ3f8Hq8y83UcPIuVEdsUpM5A@z> (raw)
In-Reply-To: <20191113171944.19308-1-chris@chris-wilson.co.uk>

On Wed, Nov 13, 2019 at 05:19:44PM +0000, Chris Wilson wrote:
> Do not leak our internal kernel address for random userspace to abuse.
> Daniel added the support to fbdev to filter out the physical addresses
> being exposed by fbdev, put that to use to protect ourselves.
> 
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112256
> Fixes: 5f889b9a61dd ("drm/i915: Disregard drm_mode_config.fb_base")
> References: da6c7707caf3 ("fbdev: Add FBINFO_HIDE_SMEM_START flag")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
> ---
>  drivers/gpu/drm/i915/display/intel_fbdev.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c
> index 3d1061470e76..bff311561597 100644
> --- a/drivers/gpu/drm/i915/display/intel_fbdev.c
> +++ b/drivers/gpu/drm/i915/display/intel_fbdev.c
> @@ -226,8 +226,8 @@ static int intelfb_create(struct drm_fb_helper *helper,
>  		goto out_unpin;
>  	}
>  
> -	ifbdev->helper.fb = &ifbdev->fb->base;
> -
> +	/* don't leak any physical addresses to userspace */
> +	info->flags |= FBINFO_HIDE_SMEM_START;

Doesn't the fb helper already do this?

Looks like it tries. Though I have no idea why it does
it in initial_config() instead of fill_fb_info().

>  	info->fbops = &intelfb_ops;
>  
>  	/* setup aperture base/size for vesafb takeover */
> @@ -247,6 +247,7 @@ static int intelfb_create(struct drm_fb_helper *helper,
>  	info->fix.smem_start = (unsigned long)info->screen_base;

Isn't screen_base the virtual address? Why do we put that into
smem_start?

>  	info->fix.smem_len = info->screen_size;
>  
> +	ifbdev->helper.fb = &ifbdev->fb->base;
>  	drm_fb_helper_fill_info(info, &ifbdev->helper, sizes);
>  
>  	/* If the object is shmemfs backed, it will have given us zeroed pages.
> -- 
> 2.24.0
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Ville Syrjälä
Intel
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

  parent reply	other threads:[~2019-11-14 10:53 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-11-13 17:19 [PATCH] drm/i915/fbdev: Hide smem_start from userspace Chris Wilson
2019-11-13 17:19 ` [Intel-gfx] " Chris Wilson
2019-11-13 17:45 ` ✗ Fi.CI.CHECKPATCH: warning for " Patchwork
2019-11-13 17:45   ` [Intel-gfx] " Patchwork
2019-11-13 18:22 ` ✓ Fi.CI.BAT: success " Patchwork
2019-11-13 18:22   ` [Intel-gfx] " Patchwork
2019-11-14  9:42 ` ✓ Fi.CI.IGT: " Patchwork
2019-11-14  9:42   ` [Intel-gfx] " Patchwork
2019-11-14 10:53 ` Ville Syrjälä [this message]
2019-11-14 10:53   ` [Intel-gfx] [PATCH] " Ville Syrjälä
2019-11-14 10:57   ` Chris Wilson
2019-11-14 10:57     ` [Intel-gfx] " Chris Wilson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191114105311.GW1208@intel.com \
    --to=ville.syrjala@linux.intel.com \
    --cc=chris@chris-wilson.co.uk \
    --cc=daniel.vetter@ffwll.ch \
    --cc=intel-gfx@lists.freedesktop.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.