raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

drm/panthor: Restrict high priorities on group_create

Browse Source 
We were allowing any users to create a high priority group without any
permission checks. As a result, this was allowing possible denial of
service.

We now only allow the DRM master or users with the CAP_SYS_NICE
capability to set higher priorities than PANTHOR_GROUP_PRIORITY_MEDIUM.

As the sole user of that uAPI lives in Mesa and hardcode a value of
MEDIUM [1], this should be safe to do.

Additionally, as those checks are performed at the ioctl level,
panthor_group_create now only check for priority level validity.

[1]f390835074/src/gallium/drivers/panfrost/pan_csf.c (L1038)

Signed-off-by: Mary Guillemard <mary.guillemard@collabora.com>
Fixes: de85488138 ("drm/panthor: Add the scheduler logical block")
Cc: stable@vger.kernel.org
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240903144955.144278-2-mary.guillemard@collabora.com
This commit is contained in:
Mary Guillemard
2024-09-03 16:49:55 +02:00
committed by Boris Brezillon
parent 9a71cf8b6f
commit 5f7762042f
3 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
drivers/gpu/drm/panthor/panthor_drv.c
View File

@@ -10,6 +10,7 @@
#include <linux/platform_device.h> #include <linux/platform_device.h>
#include <linux/pm_runtime.h> #include <linux/pm_runtime.h>
#include <drm/drm_auth.h>
#include <drm/drm_debugfs.h> #include <drm/drm_debugfs.h>
#include <drm/drm_drv.h> #include <drm/drm_drv.h>
#include <drm/drm_exec.h> #include <drm/drm_exec.h>
@@ -996,6 +997,24 @@ static int panthor_ioctl_group_destroy(struct drm_device *ddev, void *data,
return panthor_group_destroy(pfile, args->group_handle); return panthor_group_destroy(pfile, args->group_handle);
} }
static int group_priority_permit(struct drm_file *file,
u8 priority)
{
/* Ensure that priority is valid */
if (priority > PANTHOR_GROUP_PRIORITY_HIGH)
return -EINVAL;
/* Medium priority and below are always allowed */
if (priority <= PANTHOR_GROUP_PRIORITY_MEDIUM)
return 0;
/* Higher priorities require CAP_SYS_NICE or DRM_MASTER */
if (capable(CAP_SYS_NICE) || drm_is_current_master(file))
return 0;
return -EACCES;
}
static int panthor_ioctl_group_create(struct drm_device *ddev, void *data, static int panthor_ioctl_group_create(struct drm_device *ddev, void *data,
struct drm_file *file) struct drm_file *file)
{ {
@@ -1011,6 +1030,10 @@ static int panthor_ioctl_group_create(struct drm_device *ddev, void *data,
if (ret) if (ret)
return ret; return ret;
ret = group_priority_permit(file, args->priority);
if (ret)
return ret;
ret = panthor_group_create(pfile, args, queue_args); ret = panthor_group_create(pfile, args, queue_args);
if (ret >= 0) { if (ret >= 0) {
args->group_handle = ret; args->group_handle = ret;

2
drivers/gpu/drm/panthor/panthor_sched.c
View File

@@ -3092,7 +3092,7 @@ int panthor_group_create(struct panthor_file *pfile,
if (group_args->pad) if (group_args->pad)
return -EINVAL; return -EINVAL;
if (group_args->priority > PANTHOR_CSG_PRIORITY_HIGH) if (group_args->priority >= PANTHOR_CSG_PRIORITY_COUNT)
return -EINVAL; return -EINVAL;
if ((group_args->compute_core_mask & ~ptdev->gpu_info.shader_present) || if ((group_args->compute_core_mask & ~ptdev->gpu_info.shader_present) ||

6
include/uapi/drm/panthor_drm.h
View File

@@ -692,7 +692,11 @@ enum drm_panthor_group_priority {
/** @PANTHOR_GROUP_PRIORITY_MEDIUM: Medium priority group. */ /** @PANTHOR_GROUP_PRIORITY_MEDIUM: Medium priority group. */
PANTHOR_GROUP_PRIORITY_MEDIUM, PANTHOR_GROUP_PRIORITY_MEDIUM,
/** @PANTHOR_GROUP_PRIORITY_HIGH: High priority group. */ /**
* @PANTHOR_GROUP_PRIORITY_HIGH: High priority group.
*
* Requires CAP_SYS_NICE or DRM_MASTER.
*/
PANTHOR_GROUP_PRIORITY_HIGH, PANTHOR_GROUP_PRIORITY_HIGH,
}; };