[PATCH 4/5] drm/panfrost: remove DRM_AUTH and respective comment

[Steven Price]

On 08/11/2019 13:10, Emil Velikov wrote:
> On Fri, 1 Nov 2019 at 13:34, Steven Price <steven.price at arm.com> wrote:
>>
>> On 01/11/2019 13:03, Emil Velikov wrote:
>>> From: Emil Velikov <emil.velikov at collabora.com>
>>>
>>> As of earlier commit we have address space separation. Yet we forgot to
>>> remove the respective comment and DRM_AUTH in the ioctl declaration.
>>>
>>> Cc: Tomeu Vizoso <tomeu.vizoso at collabora.com>
>>> Cc: David Airlie <airlied at linux.ie>
>>> Cc: Daniel Vetter <daniel at ffwll.ch>
>>> Cc: Robin Murphy <robin.murphy at arm.com>
>>> Cc: Steven Price <steven.price at arm.com>
>>> Fixes: 7282f7645d06 ("drm/panfrost: Implement per FD address spaces")
>>> Signed-off-by: Emil Velikov <emil.velikov at collabora.com>
>>
>> Reviewed-by: Steven Price <steven.price at arm.com>
>>
>> I'm not sure DRM_AUTH provided us with much in the first place (because
>> render nodes could snoop/affect the primary node), but since we have
>> address space separation it's clearly not required now.
>>
> Thanks Steve. This is exactly the reason why I removed it from most
> other drivers.
> There are equivalent vmwgfx changes and a DRM core patch in this series.
> 
> Do you think you'll have some time to check those over? Would be
> amazing if I can apply the lot in one go to drm-misc.

I'm afraid I don't know enough about the security model of vmwgfx to
meaningfully comment on those changes. On the surface they look fine,
but it really needs someone who understands whether this exposes an
attack surface.

The DRM core patch concerns me slightly (although again I'm not
completely up to speed on the security mode here). For a device which
doesn't have address space separation (and doesn't support render
nodes), is there anything stopping a process which hasn't authenticated
converting another process's handle to a prime fd? (or injecting dmabufs
into the address space used by the authenticated process - which might
cause address space exhaustion). If that's not a concern then I'm not
sure why the ioctls were originally added with DRM_AUTH...

Steve