[PATCH 0/2] Fix purging buffers in the shmem helpers
Steven Price
steven.price at arm.com
Fri Mar 5 10:22:30 UTC 2021
On 23/02/2021 15:51, Neil Roberts wrote:
> These two patches fix a problem with the madvise purging code for the
> shmem helpers where the mmaping for a purged buffer wouldn't get
> invalidated correctly. This presumably ends up as a security hole
> where the mapping can be accessed from user-space to read and write
> random pages from other buffers. This is currently affecting Panfrost.
> The second patch is a v2 from a patch that was sent standalone.
>
> There is a WIP IGT test for Panfrost which demonstrates the bug here:
>
> https://gitlab.freedesktop.org/nroberts/igt-gpu-tools/-/commits/panfrost-purgemap/
>
> Neil Roberts (2):
> drm/shmem-helper: Check for purged buffers in fault handler
> drm/shmem-helper: Don't remove the offset in vm_area_struct pgoff
>
> drivers/gpu/drm/drm_gem_shmem_helper.c | 25 ++++++++++++++++++-------
> 1 file changed, 18 insertions(+), 7 deletions(-)
>
Pushed to drm-misc-fixes
Thanks,
Steve
More information about the dri-devel
mailing list