Skip to contentSkip to conversation

FAILED: patch "[PATCH] drm/msm: protect against faults from copy_from_user() in" failed to apply to 4.7-stable tree

PATCH [email protected] 1 participant 1 message Sep 9, 2016

Subsystems (3)
Stable branch DRM drivers DRM driver for Qualcomm display hardware
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.7-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

Quoted 1 line

From d78d383ab354b0b9e1d23404ae0d9fbdeb9aa035 Mon Sep 17 00:00:00 2001

From: Rob Clark <[email protected]>
Date: Mon, 22 Aug 2016 15:28:38 -0400
Subject: [PATCH] drm/msm: protect against faults from copy_from_user() in
submit ioctl

An evil userspace could try to cause deadlock by passing an unfaulted-in GEM bo as submit->bos (or submit->cmds) table. Which will trigger msm_gem_fault() while we already hold struct_mutex. See:

https://github.com/freedreno/msmtest/blob/master/evilsubmittest.c

Cc [email protected]
Signed-off-by Rob Clark <[email protected]>
drivers/gpu/drm/msm/msm_drv.h +6 -0
index b4bc7f1ef717..d0da52f2a806 100644
@@ -157,6 +157,12 @@ struct msm_drm_private {
 	struct shrinker shrinker;
 
 	struct msm_vblank_ctrl vblank_ctrl;
+
+	/* task holding struct_mutex.. currently only used in submit path
+	 * to detect and reject faults from copy_from_user() for submit
+	 * ioctl.
+	 */
+	struct task_struct *struct_mutex_task;
 };
 
 struct msm_format {
drivers/gpu/drm/msm/msm_gem.c +9 -0
index 6cd4af443139..85f3047e05ae 100644
@@ -196,11 +196,20 @@ int msm_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
 	struct drm_gem_object *obj = vma->vm_private_data;
 	struct drm_device *dev = obj->dev;
+	struct msm_drm_private *priv = dev->dev_private;
 	struct page **pages;
 	unsigned long pfn;
 	pgoff_t pgoff;
 	int ret;
 
+	/* This should only happen if userspace tries to pass a mmap'd
+	 * but unfaulted gem bo vaddr into submit ioctl, triggering
+	 * a page fault while struct_mutex is already held.  This is
+	 * not a valid use-case so just bail.
+	 */
+	if (priv->struct_mutex_task == current)
+		return VM_FAULT_SIGBUS;
+
 	/* Make sure we don't parallel update on a fault, nor move or remove
 	 * something from beneath our feet
 	 */
drivers/gpu/drm/msm/msm_gem_submit.c +3 -0
index 408da409a216..880d6a9af7c8 100644
@@ -394,6 +394,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
 	if (ret)
 		return ret;
 
+	priv->struct_mutex_task = current;
+
 	submit = submit_create(dev, gpu, args->nr_bos, args->nr_cmds);
 	if (!submit) {
 		ret = -ENOMEM;

@@ -485,6 +487,7 @@ out:
 	if (ret)
 		msm_gem_submit_free(submit);
 out_unlock:
+	priv->struct_mutex_task = NULL;
 	mutex_unlock(&dev->struct_mutex);
 	return ret;
 }