From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.1 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CCBFFC10F26 for ; Thu, 2 Apr 2020 07:59:45 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 8B5F92078B for ; Thu, 2 Apr 2020 07:59:45 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=c-s.fr header.i=@c-s.fr header.b="K2qSbeVr" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8B5F92078B Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=c-s.fr Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 31D458E0008; Thu, 2 Apr 2020 03:59:45 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 2CDF68E0007; Thu, 2 Apr 2020 03:59:45 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1BC628E0008; Thu, 2 Apr 2020 03:59:45 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0183.hostedemail.com [216.40.44.183]) by kanga.kvack.org (Postfix) with ESMTP id 01B608E0007 for ; Thu, 2 Apr 2020 03:59:44 -0400 (EDT) Received: from smtpin20.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id BDCB54DD6 for ; Thu, 2 Apr 2020 07:59:44 +0000 (UTC) X-FDA: 76662165888.20.wax61_37e9d2f82c82b X-HE-Tag: wax61_37e9d2f82c82b X-Filterd-Recvd-Size: 5662 Received: from pegase1.c-s.fr (pegase1.c-s.fr [93.17.236.30]) by imf30.hostedemail.com (Postfix) with ESMTP for ; Thu, 2 Apr 2020 07:59:44 +0000 (UTC) Received: from localhost (mailhub1-int [192.168.12.234]) by localhost (Postfix) with ESMTP id 48tFpP4VCTz9txn7; Thu, 2 Apr 2020 09:59:41 +0200 (CEST) Authentication-Results: localhost; dkim=pass reason="1024-bit key; insecure key" header.d=c-s.fr header.i=@c-s.fr header.b=K2qSbeVr; dkim-adsp=pass; dkim-atps=neutral X-Virus-Scanned: Debian amavisd-new at c-s.fr Received: from pegase1.c-s.fr ([192.168.12.234]) by localhost (pegase1.c-s.fr [192.168.12.234]) (amavisd-new, port 10024) with ESMTP id tbdPKUFxzZ1c; Thu, 2 Apr 2020 09:59:41 +0200 (CEST) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase1.c-s.fr (Postfix) with ESMTP id 48tFpP32Vdz9txn5; Thu, 2 Apr 2020 09:59:41 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=c-s.fr; s=mail; t=1585814381; bh=43GKGI0k75m1jMuar17d+4+DhdGR59q9yzVFw5zV0xg=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=K2qSbeVrPsfu8z1CMpXAlEYM1yWe37c7NfFevmx7ryqhDzQfVQRDRs32WIX5yp+TZ ywtDBo55GNAC5LEHXK38csaNzIV+L8t0pry8KwAfr0f5yZHSbG5+18iTKc2PfJjSN8 A62kH9kShZs4OS9xtLYqVd9modYuFioAzsIKVvQM= Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 582B18B776; Thu, 2 Apr 2020 09:59:42 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id Y1pqTqStopDu; Thu, 2 Apr 2020 09:59:42 +0200 (CEST) Received: from [192.168.4.90] (unknown [192.168.4.90]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 076088B75E; Thu, 2 Apr 2020 09:59:39 +0200 (CEST) Subject: Re: [PATCH RESEND 3/4] drm/i915/gem: Replace user_access_begin by user_write_access_begin To: Kees Cook Cc: Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , airlied@linux.ie, daniel@ffwll.ch, torvalds@linux-foundation.org, viro@zeniv.linux.org.uk, akpm@linux-foundation.org, hpa@zytor.com, linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-mm@kvack.org, linux-arch@vger.kernel.org References: <27106d62fdbd4ffb47796236050e418131cb837f.1585811416.git.christophe.leroy@c-s.fr> <6da6fa391c0d6344cc9ff99a69fcaa65666f3947.1585811416.git.christophe.leroy@c-s.fr> <202004020051.649C6B8@keescook> From: Christophe Leroy Message-ID: Date: Thu, 2 Apr 2020 09:59:36 +0200 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.6.0 MIME-Version: 1.0 In-Reply-To: <202004020051.649C6B8@keescook> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: fr Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Le 02/04/2020 =C3=A0 09:52, Kees Cook a =C3=A9crit=C2=A0: > On Thu, Apr 02, 2020 at 07:34:18AM +0000, Christophe Leroy wrote: >> When i915_gem_execbuffer2_ioctl() is using user_access_begin(), >> that's only to perform unsafe_put_user() so use >> user_write_access_begin() in order to only open write access. >> >> Signed-off-by: Christophe Leroy >=20 > Why is this split from the other conversions? I split it from the other because this one is in drivers while other=20 ones are in core part of the kernel. Is it better to squash it in the previous patch ? Christophe >=20 > Reviewed-by: Kees Cook >=20 >=20 >> --- >> drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 11 ++++++----- >> 1 file changed, 6 insertions(+), 5 deletions(-) >> >> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/= gpu/drm/i915/gem/i915_gem_execbuffer.c >> index 7643a30ba4cd..4be8205a70b6 100644 >> --- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c >> +++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c >> @@ -1611,14 +1611,14 @@ static int eb_copy_relocations(const struct i9= 15_execbuffer *eb) >> * happened we would make the mistake of assuming that the >> * relocations were valid. >> */ >> - if (!user_access_begin(urelocs, size)) >> + if (!user_write_access_begin(urelocs, size)) >> goto end; >> =20 >> for (copied =3D 0; copied < nreloc; copied++) >> unsafe_put_user(-1, >> &urelocs[copied].presumed_offset, >> end_user); >> - user_access_end(); >> + user_write_access_end(); >> =20 >> eb->exec[i].relocs_ptr =3D (uintptr_t)relocs; >> } >> @@ -1626,7 +1626,7 @@ static int eb_copy_relocations(const struct i915= _execbuffer *eb) >> return 0; >> =20 >> end_user: >> - user_access_end(); >> + user_write_access_end(); >> end: >> kvfree(relocs); >> err =3D -EFAULT; >> @@ -2991,7 +2991,8 @@ i915_gem_execbuffer2_ioctl(struct drm_device *de= v, void *data, >> * And this range already got effectively checked earlier >> * when we did the "copy_from_user()" above. >> */ >> - if (!user_access_begin(user_exec_list, count * sizeof(*user_exec_li= st))) >> + if (!user_write_access_begin(user_exec_list, >> + count * sizeof(*user_exec_list))) >> goto end; >> =20 >> for (i =3D 0; i < args->buffer_count; i++) { >> @@ -3005,7 +3006,7 @@ i915_gem_execbuffer2_ioctl(struct drm_device *de= v, void *data, >> end_user); >> } >> end_user: >> - user_access_end(); >> + user_write_access_end(); >> end:; >> } >> =20 >> --=20 >> 2.25.0 >> >=20