From: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
To: Daniel Vetter <daniel@ffwll.ch>, Chris Wilson <chris@chris-wilson.co.uk>
Cc: intel-gfx <intel-gfx@lists.freedesktop.org>,
Akash Goel <akash.goel@intel.com>
Subject: Re: [PATCH] drm/i915: Introduce mapping of user pages into video memory (userptr) ioctl
Date: Mon, 03 Feb 2014 15:28:37 +0000 [thread overview]
Message-ID: <52EFB5A5.3080502@linux.intel.com> (raw)
In-Reply-To: <CAKMK7uGFBWUmgFzo=a9iU7ZT+acZ02zjCRCxkoYg9DFhceaEcQ@mail.gmail.com>
On 01/29/2014 08:34 PM, Daniel Vetter wrote:
> Actually I've found something else to complain about:
>
> On Tue, Jan 28, 2014 at 2:16 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
>> +#define I915_USERPTR_READ_ONLY 0x1
>
> This smells like an insta-root-exploit:
> 1. mmap /lib/ld-linux.so as read-only
> 2. userptr bind that mmap'ed area as READ_ONLY
> 3. blit exploit code over it
> 4. profit
>
> I also don't see a way we could fix this, at least without the
> hardware providing read-only modes in the ptes. Which also requires us
> to actually trust it to follow them, even when they exists ...
Would disallowing mapping of shared pages help and be acceptable
considering intended use cases?
Tvrtko
next prev parent reply other threads:[~2014-02-03 15:29 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-01-28 10:34 New API for creating bo from user pages Chris Wilson
2014-01-28 10:34 ` [PATCH 1/3] lib: Export interval_tree Chris Wilson
2014-01-28 10:34 ` [PATCH 2/3] drm/i915: Do not call retire_requests from wait_for_rendering Chris Wilson
2014-01-28 10:34 ` [PATCH 3/3] drm/i915: Introduce mapping of user pages into video memory (userptr) ioctl Chris Wilson
2014-01-28 13:16 ` [PATCH] " Chris Wilson
2014-01-29 20:25 ` Daniel Vetter
2014-01-29 21:53 ` Chris Wilson
2014-01-29 21:58 ` Daniel Vetter
2014-01-30 11:06 ` Chris Wilson
2014-02-03 15:13 ` Tvrtko Ursulin
2014-01-29 20:34 ` Daniel Vetter
2014-01-29 21:52 ` Chris Wilson
2014-02-03 15:28 ` Tvrtko Ursulin [this message]
2014-02-04 10:56 ` Daniel Vetter
2014-02-05 15:55 ` Jesse Barnes
-- strict thread matches above, loose matches on Subject: below --
2014-05-16 13:22 Chris Wilson
2014-05-16 15:34 ` Volkin, Bradley D
2014-05-16 16:39 ` Daniel Vetter
2014-01-21 15:07 [PATCH 3/3] " Chris Wilson
2014-01-22 9:46 ` [PATCH] " Chris Wilson
2014-01-24 9:00 ` Chris Wilson
2014-01-27 17:56 ` Volkin, Bradley D
2014-01-27 18:09 ` Chris Wilson
2014-01-15 11:10 Chris Wilson
2013-08-14 10:59 Chris Wilson
2013-02-12 14:17 Chris Wilson
2013-02-13 22:24 ` Reese, Armin C
2013-02-13 23:20 ` Chris Wilson
2013-04-08 17:18 ` Daniel Vetter
2013-04-08 17:40 ` Chris Wilson
2013-04-08 19:24 ` Daniel Vetter
2013-04-08 21:48 ` Chris Wilson
2013-04-15 18:37 ` Daniel Vetter
2013-04-08 22:06 ` Eric Anholt
2013-06-24 21:36 ` Jesse Barnes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52EFB5A5.3080502@linux.intel.com \
--to=tvrtko.ursulin@linux.intel.com \
--cc=akash.goel@intel.com \
--cc=chris@chris-wilson.co.uk \
--cc=daniel@ffwll.ch \
--cc=intel-gfx@lists.freedesktop.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.