From mboxrd@z Thu Jan  1 00:00:00 1970
From: Daniel Vetter <daniel@ffwll.ch>
Subject: Re: [PATCH] drm/i915: Introduce mapping of user pages
 into video memory (userptr) ioctl
Date: Tue, 4 Feb 2014 11:56:47 +0100
Message-ID: <20140204105647.GG17001@phenom.ffwll.local>
References: <1390905261-5410-4-git-send-email-chris@chris-wilson.co.uk>
	<1390915006-16007-1-git-send-email-chris@chris-wilson.co.uk>
	<CAKMK7uGFBWUmgFzo=a9iU7ZT+acZ02zjCRCxkoYg9DFhceaEcQ@mail.gmail.com>
	<52EFB5A5.3080502@linux.intel.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <intel-gfx-bounces@lists.freedesktop.org>
Received: from mail-la0-f47.google.com (mail-la0-f47.google.com
	[209.85.215.47])
	by gabe.freedesktop.org (Postfix) with ESMTP id 9BAD61057DF
	for <intel-gfx@lists.freedesktop.org>;
	Tue,  4 Feb 2014 02:56:53 -0800 (PST)
Received: by mail-la0-f47.google.com with SMTP id hr17so6271792lab.20
	for <intel-gfx@lists.freedesktop.org>;
	Tue, 04 Feb 2014 02:56:51 -0800 (PST)
Content-Disposition: inline
In-Reply-To: <52EFB5A5.3080502@linux.intel.com>
List-Unsubscribe: <http://lists.freedesktop.org/mailman/options/intel-gfx>,
	<mailto:intel-gfx-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <http://lists.freedesktop.org/archives/intel-gfx>
List-Post: <mailto:intel-gfx@lists.freedesktop.org>
List-Help: <mailto:intel-gfx-request@lists.freedesktop.org?subject=help>
List-Subscribe: <http://lists.freedesktop.org/mailman/listinfo/intel-gfx>,
	<mailto:intel-gfx-request@lists.freedesktop.org?subject=subscribe>
Sender: intel-gfx-bounces@lists.freedesktop.org
Errors-To: intel-gfx-bounces@lists.freedesktop.org
To: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Cc: intel-gfx <intel-gfx@lists.freedesktop.org>, Akash Goel <akash.goel@intel.com>
List-Id: intel-gfx@lists.freedesktop.org

On Mon, Feb 03, 2014 at 03:28:37PM +0000, Tvrtko Ursulin wrote:
> 
> On 01/29/2014 08:34 PM, Daniel Vetter wrote:
> >Actually I've found something else to complain about:
> >
> >On Tue, Jan 28, 2014 at 2:16 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
> >>+#define I915_USERPTR_READ_ONLY 0x1
> >
> >This smells like an insta-root-exploit:
> >1. mmap /lib/ld-linux.so as read-only
> >2. userptr bind that mmap'ed area as READ_ONLY
> >3. blit exploit code over it
> >4. profit
> >
> >I also don't see a way we could fix this, at least without the
> >hardware providing read-only modes in the ptes. Which also requires us
> >to actually trust it to follow them, even when they exists ...
> 
> Would disallowing mapping of shared pages help and be acceptable
> considering intended use cases?

The above exploit is the simplest one I could come up with, but I expect
the vm in general won't be too happy if we write to pages it never expects
are written to. We could do fun stuff like corrupt pagecache or swap
cache. Which in conjunction with stable kernel pages (which some I/O paths
needed) is rather likely to result in havoc.

Essentially I'm no vm expert, and this definitely needs a full vm audit
even before considering it at all. So I'd like to drop support for it in
the initial version ...
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch