Re: [PATCH] drm/radeon: r6xx/r7xx possible security issue, system ram access

mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed

From: Luca Tettamanti <kronos.it@gmail.com>
To: Jerome Glisse <jglisse@redhat.com>
Cc: airlied@gmail.com, linux-kernel@vger.kernel.org, dri-devel@lists.sf.net
Subject: Re: [PATCH] drm/radeon: r6xx/r7xx possible security issue, system ram  access
Date: Mon, 18 Jan 2010 13:54:17 +0100	[thread overview]
Message-ID: <68676e01001180454v20b15325oab4c4229e3ca1dbf@mail.gmail.com> (raw)
In-Reply-To: <1263816096-22310-1-git-send-email-jglisse@redhat.com>

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 3124 bytes --]

On Mon, Jan 18, 2010 at 1:01 PM, Jerome Glisse <jglisse@redhat.com> wrote:> This patch workaround a possible security issue which can allow> user to abuse drm on r6xx/r7xx hw to access any system ram memory.[...]> diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c> index 44060b9..edafc7b 100644> --- a/drivers/gpu/drm/radeon/r600_cs.c> +++ b/drivers/gpu/drm/radeon/r600_cs.c> @@ -503,9 +531,61 @@ static int r600_packet3_check(struct radeon_cs_parser *p,> Â  Â  Â  Â  Â  Â  Â  Â for (i = 0; i < pkt->count; i++) {> Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â reg = start_reg + (4 * i);> Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â switch (reg) {> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  /* This register were added late, there is userspace> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â * which does provide relocation for those but set> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â * 0 offset. In order to avoid breaking old userspace> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â * we detect this and set address to point to last> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â * CB_COLOR0_BASE, note that if userspace doesn't set> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â * CB_COLOR0_BASE before this register we will report> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â * error. Old userspace always set CB_COLOR0_BASE> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â * before any of this.> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â */> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280E0_CB_COLOR0_FRAG:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280E4_CB_COLOR1_FRAG:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280E8_CB_COLOR2_FRAG:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280EC_CB_COLOR3_FRAG:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280F0_CB_COLOR4_FRAG:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280F4_CB_COLOR5_FRAG:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280F8_CB_COLOR6_FRAG:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280FC_CB_COLOR7_FRAG:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280C0_CB_COLOR0_TILE:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280C4_CB_COLOR1_TILE:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280C8_CB_COLOR2_TILE:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280CC_CB_COLOR3_TILE:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280D0_CB_COLOR4_TILE:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280D4_CB_COLOR5_TILE:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280D8_CB_COLOR6_TILE:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  case R_0280DC_CB_COLOR7_TILE:> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  if (!r600_cs_packet_next_is_pkt3_nop(p)) {> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  if (!track->cb_color0_base_last) {> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  dev_err(p->dev, "Broken old userspace ? no cb_color0_base supplied"> + Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  "before trying to write 0x%08X\n", reg);
Cosmetic issue: a space is missing between "supplied" and "before".
Lucaÿôèº{.nÇ+‰·Ÿ®‰†+%ŠËÿ±éÝ¶\x17¥Šwÿº{.nÇ+‰·¥Š{±þG«éÿŠ{ayº\x1dÊ‡Ú™ë,j\a¢f£¢·hšïêÿ‘êçz_è®\x03(éšŽŠÝ¢j"ú\x1a¶^[m§ÿÿ¾\a«þG«éÿ¢¸?™¨èÚ&£ø§~á¶iO•æ¬z·švØ^\x14\x04\x1a¶^[m§ÿÿÃ\fÿ¶ìÿ¢¸?–I¥

     prev parent reply	other threads:[~2010-01-18 12:54 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-01-18 12:01 Jerome Glisse
2010-01-18 12:54 ` Luca Tettamanti [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=68676e01001180454v20b15325oab4c4229e3ca1dbf@mail.gmail.com \
    --to=kronos.it@gmail.com \
    --cc=airlied@gmail.com \
    --cc=dri-devel@lists.sf.net \
    --cc=jglisse@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®