[Nouveau] [RFC PATCH 2/5] HACK don't verify route == owner in nvkm ioctl

Konsta Hölttä kholtta at nvidia.com
Wed Aug 5 04:27:50 PDT 2015


FIXME!! Some objects we need to access from userspace are created in
kernel. Only the ..V0_NEW ioctl on kernel objects appears to be freely
usable from userspace at this point, and also accessing objects that are
created from userspace in the first place. The channel object is created
in kernel in nouveau_chan.c, I suppose.

Signed-off-by: Konsta Hölttä <kholtta at nvidia.com>
---
 drm/nouveau/nvkm/core/ioctl.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drm/nouveau/nvkm/core/ioctl.c b/drm/nouveau/nvkm/core/ioctl.c
index 4459ff5..44b0f1d 100644
--- a/drm/nouveau/nvkm/core/ioctl.c
+++ b/drm/nouveau/nvkm/core/ioctl.c
@@ -474,18 +474,19 @@ nvkm_ioctl_path(struct nvkm_handle *parent, u32 type, u32 nr, u32 *path,
 			nv_debug(object, "handle 0x%08x not found\n", path[nr]);
 			return -ENOENT;
 		}
 		nvkm_namedb_put(handle);
 		parent = handle;
 	}
 
 	if (owner != NVIF_IOCTL_V0_OWNER_ANY && owner != handle->route) {
-		nv_ioctl(object, "object route != owner\n");
-		return -EACCES;
+		nv_ioctl(object, "object route != owner: rou %x ow %x\n", handle->route, owner);
+		nv_ioctl(object, "HACK!! still continuing\n");
+		//return -EACCES;
 	}
 	*route = handle->route;
 	*token = handle->token;
 
 	if (ret = -EINVAL, type < ARRAY_SIZE(nvkm_ioctl_v0)) {
 		if (nvkm_ioctl_v0[type].version == 0)
 			ret = nvkm_ioctl_v0[type].func(handle, data, size);
 	}
-- 
2.1.4



More information about the Nouveau mailing list