Daniel Vetter f771b2b3eb drm/etnaviv: Use FOLL_FORCE for userptr ...

commit cd5297b0855f17c8b4e3ef1d20c6a3656209c7b3 upstream.

Nothing checks userptr.ro except this call to pup_fast, which means
there's nothing actually preventing userspace from writing to this.
Which means you can just read-only mmap any file you want, userptr it
and then write to it with the gpu. Not good.

The right way to handle this is FOLL_WRITE | FOLL_FORCE, which will
break any COW mappings and update tracking for MAY_WRITE mappings so
there's no exploit and the vm isn't confused about what's going on.
For any legit use case there's no difference from what userspace can
observe and do.

Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
Cc: stable@vger.kernel.org
Cc: John Hubbard <jhubbard@nvidia.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: Russell King <linux+etnaviv@armlinux.org.uk>
Cc: Christian Gmeiner <christian.gmeiner@gmail.com>
Cc: etnaviv@lists.freedesktop.org
Link: https://patchwork.freedesktop.org/patch/msgid/20210301095254.1946084-1-daniel.vetter@ffwll.ch
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-03-30 14:31:55 +02:00

..

cmdstream.xml.h

…

common.xml.h

drm/etnaviv: update hardware headers from rnndb

2018-03-09 12:22:36 +01:00

etnaviv_buffer.c

drm/etnaviv: fix TS cache flushing on GPUs with BLT engine

2020-03-20 18:40:44 +01:00

etnaviv_cmd_parser.c

drm/etnaviv: replace license text with SPDX tags

2018-05-18 15:27:56 +02:00

etnaviv_cmdbuf.c

drm/etnaviv: implement softpin

2019-08-15 12:07:47 +02:00

etnaviv_cmdbuf.h

drm/etnaviv: rework MMU handling

2019-08-15 10:56:45 +02:00

etnaviv_drv.c

Merge tag 'drm-misc-next-2020-06-19' of git://anongit.freedesktop.org/drm/drm-misc into drm-next

2020-06-24 15:45:51 +10:00

etnaviv_drv.h

drm/etnaviv: request pages from DMA32 zone when needed

2020-03-20 18:40:44 +01:00

etnaviv_dump.c

mm: remove the pgprot argument to __vmalloc

2020-06-02 10:59:11 -07:00

etnaviv_dump.h

drm/etnaviv: pass mmu pointer to etnaviv_core_dump_mmu

2019-08-15 10:53:31 +02:00

etnaviv_gem_prime.c

drm: allow limiting the scatter list size.

2020-09-09 07:58:56 +02:00

etnaviv_gem_submit.c

Merge tag 'drm-misc-next-2020-06-19' of git://anongit.freedesktop.org/drm/drm-misc into drm-next

2020-06-24 15:45:51 +10:00

etnaviv_gem.c

drm/etnaviv: Use FOLL_FORCE for userptr

2021-03-30 14:31:55 +02:00

etnaviv_gem.h

drm/etnaviv: Replace zero-length array with flexible-array member

2020-03-05 12:15:46 +01:00

etnaviv_gpu.c

drm/etnaviv: fix external abort seen on GC600 rev 0x19

2020-08-24 17:20:39 +02:00

etnaviv_gpu.h

drm/etnaviv: determine product, customer and eco id

2020-02-26 16:20:04 +01:00

etnaviv_hwdb.c

drm/etnaviv: add hwdb entry for gc400 found in STM32

2020-02-26 16:20:04 +01:00

etnaviv_iommu_v2.c

drm/etnaviv: fix dumping of iommuv2

2019-10-29 18:12:24 +01:00

etnaviv_iommu.c

drm/etnaviv: fix missing unlock on error in etnaviv_iommuv1_context_alloc()

2019-09-02 12:48:55 +02:00

etnaviv_mmu.c

drm: etnaviv: fix common struct sg_table related issues

2020-09-10 08:18:35 +02:00

etnaviv_mmu.h

drm/etnaviv: allow to request specific virtual address for gem mapping

2019-08-15 11:58:59 +02:00

etnaviv_perfmon.c

drm/etnaviv: fix perfmon domain interation

2020-05-19 11:18:59 +02:00

etnaviv_perfmon.h

drm/etnaviv: replace license text with SPDX tags

2018-05-18 15:27:56 +02:00

etnaviv_sched.c

drm/etnaviv: always start/stop scheduler in timeout processing

2020-08-24 17:21:21 +02:00

etnaviv_sched.h

drm/etnaviv: replace license text with SPDX tags

2018-05-18 15:27:56 +02:00

Kconfig

treewide: Add SPDX license identifier - Makefile/Kconfig

2019-05-21 10:50:46 +02:00

Makefile

drm/etnaviv: add hardware database

2018-03-09 12:22:37 +01:00

state_3d.xml.h

drm/etnaviv: update hardware headers from rnndb

2018-03-09 12:22:36 +01:00

state_blt.xml.h

drm/etnaviv: fix TS cache flushing on GPUs with BLT engine

2020-03-20 18:40:44 +01:00

state_hi.xml.h

drm/etnaviv: Update idle bits

2020-03-03 10:58:57 +01:00

state.xml.h

drm/etnaviv: update hardware headers from rnndb

2018-03-09 12:22:36 +01:00