xf86-video-intel hits an assert when using dri and xorg is not suid root

xf86-video-intel hits an assert when using dri and xorg is not suid root

[Hans de Goede]

Hi,

When trying to run the latest xorg + intel drv, with dri3, with Xorg not
running as root, the followin assert in src/intel_device.c: authorise() :

assert(is_i915_gem(fd));

Triggers, this is caused by the DRM_IOCTL_I915_GETPARAM ioctl in
is_i915_gem() failing with -EACCESS in this case.

I thought that the use of rendernodes should work as normal user ?

Regards,

Hans

Re: xf86-video-intel hits an assert when using dri and xorg is not suid root

[Chris Wilson]

On Fri, Jun 13, 2014 at 02:08:06PM +0200, Hans de Goede wrote:
> Hi,
> 
> When trying to run the latest xorg + intel drv, with dri3, with Xorg not
> running as root, the followin assert in src/intel_device.c: authorise() :
> 
> assert(is_i915_gem(fd));
> 
> Triggers, this is caused by the DRM_IOCTL_I915_GETPARAM ioctl in
> is_i915_gem() failing with -EACCESS in this case.
> 
> I thought that the use of rendernodes should work as normal user ?

Hmm, I have

DRM_IOCTL_DEF_DRV(I915_GETPARAM, i915_getparam, DRM_AUTH|DRM_RENDER_ALLOW),

What path did find_render_node() choose? Was it right?
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre

Re: xf86-video-intel hits an assert when using dri and xorg is not suid root

[Hans de Goede]

Hi,

On 06/13/2014 02:36 PM, Chris Wilson wrote:
> On Fri, Jun 13, 2014 at 02:08:06PM +0200, Hans de Goede wrote:
>> Hi,
>>
>> When trying to run the latest xorg + intel drv, with dri3, with Xorg not
>> running as root, the followin assert in src/intel_device.c: authorise() :
>>
>> assert(is_i915_gem(fd));
>>
>> Triggers, this is caused by the DRM_IOCTL_I915_GETPARAM ioctl in
>> is_i915_gem() failing with -EACCESS in this case.
>>
>> I thought that the use of rendernodes should work as normal user ?
> 
> Hmm, I have
> 
> DRM_IOCTL_DEF_DRV(I915_GETPARAM, i915_getparam, DRM_AUTH|DRM_RENDER_ALLOW),
> 
> What path did find_render_node() choose? Was it right?

I don't have USE_RENDERNODE defined in config.h, so find_render_node()
is returning NULL, which makes dev->render_node point to dev->master_node,
and thus makes intel_get_client_fd open the /dev/dri/card0 node a second
time (when using non suid-root xorg the first time it was opened by
systemd-logind and the fd was passed from systemd-logind to xf86-video-intel
by the server).

Do we really want a second open in this case, maybe intel_get_client_fd
should detect that render_node == master_node and re-use the master fd
in that case ?

Regards,

Hans

Re: xf86-video-intel hits an assert when using dri and xorg is not suid root

[Chris Wilson]

On Fri, Jun 13, 2014 at 02:44:44PM +0200, Hans de Goede wrote:
> Hi,
> 
> On 06/13/2014 02:36 PM, Chris Wilson wrote:
> > On Fri, Jun 13, 2014 at 02:08:06PM +0200, Hans de Goede wrote:
> >> Hi,
> >>
> >> When trying to run the latest xorg + intel drv, with dri3, with Xorg not
> >> running as root, the followin assert in src/intel_device.c: authorise() :
> >>
> >> assert(is_i915_gem(fd));
> >>
> >> Triggers, this is caused by the DRM_IOCTL_I915_GETPARAM ioctl in
> >> is_i915_gem() failing with -EACCESS in this case.
> >>
> >> I thought that the use of rendernodes should work as normal user ?
> > 
> > Hmm, I have
> > 
> > DRM_IOCTL_DEF_DRV(I915_GETPARAM, i915_getparam, DRM_AUTH|DRM_RENDER_ALLOW),
> > 
> > What path did find_render_node() choose? Was it right?
> 
> I don't have USE_RENDERNODE defined in config.h, so find_render_node()
> is returning NULL, which makes dev->render_node point to dev->master_node,
> and thus makes intel_get_client_fd open the /dev/dri/card0 node a second
> time (when using non suid-root xorg the first time it was opened by
> systemd-logind and the fd was passed from systemd-logind to xf86-video-intel
> by the server).
> 
> Do we really want a second open in this case, maybe intel_get_client_fd
> should detect that render_node == master_node and re-use the master fd
> in that case ?

We can't just hand out the contents of X! So let's just move the
assertion to after we have a suitable fd.

committ 8322e3e5c6ed19e029f365d869c80388863c424d
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Jun 13 13:50:34 2014 +0100

    intel: Check that the fd points to i915 after authorising
    
    The call to GETPARAM requires either a rendernode or authorisation.
    Therefore we can only assert that the fd is a valid i915 handle after
    authorise() and not before.
    
    Reported-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Thanks,
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre

Re: xf86-video-intel hits an assert when using dri and xorg is not suid root

[Hans de Goede]

Hi,

On 06/13/2014 02:53 PM, Chris Wilson wrote:
> On Fri, Jun 13, 2014 at 02:44:44PM +0200, Hans de Goede wrote:
>> Hi,
>>
>> On 06/13/2014 02:36 PM, Chris Wilson wrote:
>>> On Fri, Jun 13, 2014 at 02:08:06PM +0200, Hans de Goede wrote:
>>>> Hi,
>>>>
>>>> When trying to run the latest xorg + intel drv, with dri3, with Xorg not
>>>> running as root, the followin assert in src/intel_device.c: authorise() :
>>>>
>>>> assert(is_i915_gem(fd));
>>>>
>>>> Triggers, this is caused by the DRM_IOCTL_I915_GETPARAM ioctl in
>>>> is_i915_gem() failing with -EACCESS in this case.
>>>>
>>>> I thought that the use of rendernodes should work as normal user ?
>>>
>>> Hmm, I have
>>>
>>> DRM_IOCTL_DEF_DRV(I915_GETPARAM, i915_getparam, DRM_AUTH|DRM_RENDER_ALLOW),
>>>
>>> What path did find_render_node() choose? Was it right?
>>
>> I don't have USE_RENDERNODE defined in config.h, so find_render_node()
>> is returning NULL, which makes dev->render_node point to dev->master_node,
>> and thus makes intel_get_client_fd open the /dev/dri/card0 node a second
>> time (when using non suid-root xorg the first time it was opened by
>> systemd-logind and the fd was passed from systemd-logind to xf86-video-intel
>> by the server).
>>
>> Do we really want a second open in this case, maybe intel_get_client_fd
>> should detect that render_node == master_node and re-use the master fd
>> in that case ?
> 
> We can't just hand out the contents of X! So let's just move the
> assertion to after we have a suitable fd.
> 
> committ 8322e3e5c6ed19e029f365d869c80388863c424d
> Author: Chris Wilson <chris@chris-wilson.co.uk>
> Date:   Fri Jun 13 13:50:34 2014 +0100
> 
>     intel: Check that the fd points to i915 after authorising
>     
>     The call to GETPARAM requires either a rendernode or authorisation.
>     Therefore we can only assert that the fd is a valid i915 handle after
>     authorise() and not before.
>     
>     Reported-by: Hans de Goede <hdegoede@redhat.com>
>     Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Thanks, I can confirm that this fixes things when the server is not
running as root (I now get the gnome-shell hang as I do when the server
is running as root).

Regards,

Hans