On Mon, Jan 18, 2010 at 1:01 PM, Jerome Glisse wrote:> This patch workaround a possible security issue which can allow> user to abuse drm on r6xx/r7xx hw to access any system ram memory.[...]> diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c> index 44060b9..edafc7b 100644> --- a/drivers/gpu/drm/radeon/r600_cs.c> +++ b/drivers/gpu/drm/radeon/r600_cs.c> @@ -503,9 +531,61 @@ static int r600_packet3_check(struct radeon_cs_parser *p,>                for (i = 0; i < pkt->count; i++) {>                        reg = start_reg + (4 * i);>                        switch (reg) {> +                       /* This register were added late, there is userspace> +                        * which does provide relocation for those but set> +                        * 0 offset. In order to avoid breaking old userspace> +                        * we detect this and set address to point to last> +                        * CB_COLOR0_BASE, note that if userspace doesn't set> +                        * CB_COLOR0_BASE before this register we will report> +                        * error. Old userspace always set CB_COLOR0_BASE> +                        * before any of this.> +                        */> +                       case R_0280E0_CB_COLOR0_FRAG:> +                       case R_0280E4_CB_COLOR1_FRAG:> +                       case R_0280E8_CB_COLOR2_FRAG:> +                       case R_0280EC_CB_COLOR3_FRAG:> +                       case R_0280F0_CB_COLOR4_FRAG:> +                       case R_0280F4_CB_COLOR5_FRAG:> +                       case R_0280F8_CB_COLOR6_FRAG:> +                       case R_0280FC_CB_COLOR7_FRAG:> +                       case R_0280C0_CB_COLOR0_TILE:> +                       case R_0280C4_CB_COLOR1_TILE:> +                       case R_0280C8_CB_COLOR2_TILE:> +                       case R_0280CC_CB_COLOR3_TILE:> +                       case R_0280D0_CB_COLOR4_TILE:> +                       case R_0280D4_CB_COLOR5_TILE:> +                       case R_0280D8_CB_COLOR6_TILE:> +                       case R_0280DC_CB_COLOR7_TILE:> +                               if (!r600_cs_packet_next_is_pkt3_nop(p)) {> +                                       if (!track->cb_color0_base_last) {> +                                               dev_err(p->dev, "Broken old userspace ? no cb_color0_base supplied"> +                                                       "before trying to write 0x%08X\n", reg); Cosmetic issue: a space is missing between "supplied" and "before". Luca{.n++%ݶw{.n+{G{ayʇڙ,jfhz_(階ݢj"mG?&~iOzv^m ?I