drm_auth.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423
  1. /*
  2. * Created: Tue Feb 2 08:37:54 1999 by faith@valinux.com
  3. *
  4. * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
  5. * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
  6. * All Rights Reserved.
  7. *
  8. * Author Rickard E. (Rik) Faith <faith@valinux.com>
  9. * Author Gareth Hughes <gareth@valinux.com>
  10. *
  11. * Permission is hereby granted, free of charge, to any person obtaining a
  12. * copy of this software and associated documentation files (the "Software"),
  13. * to deal in the Software without restriction, including without limitation
  14. * the rights to use, copy, modify, merge, publish, distribute, sublicense,
  15. * and/or sell copies of the Software, and to permit persons to whom the
  16. * Software is furnished to do so, subject to the following conditions:
  17. *
  18. * The above copyright notice and this permission notice (including the next
  19. * paragraph) shall be included in all copies or substantial portions of the
  20. * Software.
  21. *
  22. * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  23. * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  24. * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  25. * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
  26. * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
  27. * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
  28. * OTHER DEALINGS IN THE SOFTWARE.
  29. */
  30. #include <linux/slab.h>
  31. #include <drm/drm_auth.h>
  32. #include <drm/drm_drv.h>
  33. #include <drm/drm_file.h>
  34. #include <drm/drm_lease.h>
  35. #include <drm/drm_print.h>
  36. #include "drm_internal.h"
  37. #include "drm_legacy.h"
  38. /**
  39. * DOC: master and authentication
  40. *
  41. * &struct drm_master is used to track groups of clients with open
  42. * primary/legacy device nodes. For every &struct drm_file which has had at
  43. * least once successfully became the device master (either through the
  44. * SET_MASTER IOCTL, or implicitly through opening the primary device node when
  45. * no one else is the current master that time) there exists one &drm_master.
  46. * This is noted in &drm_file.is_master. All other clients have just a pointer
  47. * to the &drm_master they are associated with.
  48. *
  49. * In addition only one &drm_master can be the current master for a &drm_device.
  50. * It can be switched through the DROP_MASTER and SET_MASTER IOCTL, or
  51. * implicitly through closing/openeing the primary device node. See also
  52. * drm_is_current_master().
  53. *
  54. * Clients can authenticate against the current master (if it matches their own)
  55. * using the GETMAGIC and AUTHMAGIC IOCTLs. Together with exchanging masters,
  56. * this allows controlled access to the device for an entire group of mutually
  57. * trusted clients.
  58. */
  59. int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
  60. {
  61. struct drm_auth *auth = data;
  62. int ret = 0;
  63. mutex_lock(&dev->master_mutex);
  64. if (!file_priv->magic) {
  65. ret = idr_alloc(&file_priv->master->magic_map, file_priv,
  66. 1, 0, GFP_KERNEL);
  67. if (ret >= 0)
  68. file_priv->magic = ret;
  69. }
  70. auth->magic = file_priv->magic;
  71. mutex_unlock(&dev->master_mutex);
  72. DRM_DEBUG("%u\n", auth->magic);
  73. return ret < 0 ? ret : 0;
  74. }
  75. int drm_authmagic(struct drm_device *dev, void *data,
  76. struct drm_file *file_priv)
  77. {
  78. struct drm_auth *auth = data;
  79. struct drm_file *file;
  80. DRM_DEBUG("%u\n", auth->magic);
  81. mutex_lock(&dev->master_mutex);
  82. file = idr_find(&file_priv->master->magic_map, auth->magic);
  83. if (file) {
  84. file->authenticated = 1;
  85. idr_replace(&file_priv->master->magic_map, NULL, auth->magic);
  86. }
  87. mutex_unlock(&dev->master_mutex);
  88. return file ? 0 : -EINVAL;
  89. }
  90. struct drm_master *drm_master_create(struct drm_device *dev)
  91. {
  92. struct drm_master *master;
  93. master = kzalloc(sizeof(*master), GFP_KERNEL);
  94. if (!master)
  95. return NULL;
  96. kref_init(&master->refcount);
  97. drm_master_legacy_init(master);
  98. idr_init(&master->magic_map);
  99. master->dev = dev;
  100. /* initialize the tree of output resource lessees */
  101. INIT_LIST_HEAD(&master->lessees);
  102. INIT_LIST_HEAD(&master->lessee_list);
  103. idr_init(&master->leases);
  104. idr_init(&master->lessee_idr);
  105. return master;
  106. }
  107. static void drm_set_master(struct drm_device *dev, struct drm_file *fpriv,
  108. bool new_master)
  109. {
  110. dev->master = drm_master_get(fpriv->master);
  111. if (dev->driver->master_set)
  112. dev->driver->master_set(dev, fpriv, new_master);
  113. fpriv->was_master = true;
  114. }
  115. static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv)
  116. {
  117. struct drm_master *old_master;
  118. lockdep_assert_held_once(&dev->master_mutex);
  119. WARN_ON(fpriv->is_master);
  120. old_master = fpriv->master;
  121. fpriv->master = drm_master_create(dev);
  122. if (!fpriv->master) {
  123. fpriv->master = old_master;
  124. return -ENOMEM;
  125. }
  126. fpriv->is_master = 1;
  127. fpriv->authenticated = 1;
  128. drm_set_master(dev, fpriv, true);
  129. if (old_master)
  130. drm_master_put(&old_master);
  131. return 0;
  132. }
  133. /*
  134. * In the olden days the SET/DROP_MASTER ioctls used to return EACCES when
  135. * CAP_SYS_ADMIN was not set. This was used to prevent rogue applications
  136. * from becoming master and/or failing to release it.
  137. *
  138. * At the same time, the first client (for a given VT) is _always_ master.
  139. * Thus in order for the ioctls to succeed, one had to _explicitly_ run the
  140. * application as root or flip the setuid bit.
  141. *
  142. * If the CAP_SYS_ADMIN was missing, no other client could become master...
  143. * EVER :-( Leading to a) the graphics session dying badly or b) a completely
  144. * locked session.
  145. *
  146. *
  147. * As some point systemd-logind was introduced to orchestrate and delegate
  148. * master as applicable. It does so by opening the fd and passing it to users
  149. * while in itself logind a) does the set/drop master per users' request and
  150. * b) * implicitly drops master on VT switch.
  151. *
  152. * Even though logind looks like the future, there are a few issues:
  153. * - some platforms don't have equivalent (Android, CrOS, some BSDs) so
  154. * root is required _solely_ for SET/DROP MASTER.
  155. * - applications may not be updated to use it,
  156. * - any client which fails to drop master* can DoS the application using
  157. * logind, to a varying degree.
  158. *
  159. * * Either due missing CAP_SYS_ADMIN or simply not calling DROP_MASTER.
  160. *
  161. *
  162. * Here we implement the next best thing:
  163. * - ensure the logind style of fd passing works unchanged, and
  164. * - allow a client to drop/set master, iff it is/was master at a given point
  165. * in time.
  166. *
  167. * Note: DROP_MASTER cannot be free for all, as an arbitrator user could:
  168. * - DoS/crash the arbitrator - details would be implementation specific
  169. * - open the node, become master implicitly and cause issues
  170. *
  171. * As a result this fixes the following when using root-less build w/o logind
  172. * - startx
  173. * - weston
  174. * - various compositors based on wlroots
  175. */
  176. static int
  177. drm_master_check_perm(struct drm_device *dev, struct drm_file *file_priv)
  178. {
  179. if (file_priv->pid == task_pid(current) && file_priv->was_master)
  180. return 0;
  181. if (!capable(CAP_SYS_ADMIN))
  182. return -EACCES;
  183. return 0;
  184. }
  185. int drm_setmaster_ioctl(struct drm_device *dev, void *data,
  186. struct drm_file *file_priv)
  187. {
  188. int ret;
  189. mutex_lock(&dev->master_mutex);
  190. ret = drm_master_check_perm(dev, file_priv);
  191. if (ret)
  192. goto out_unlock;
  193. if (drm_is_current_master(file_priv))
  194. goto out_unlock;
  195. if (dev->master) {
  196. ret = -EBUSY;
  197. goto out_unlock;
  198. }
  199. if (!file_priv->master) {
  200. ret = -EINVAL;
  201. goto out_unlock;
  202. }
  203. if (!file_priv->is_master) {
  204. ret = drm_new_set_master(dev, file_priv);
  205. goto out_unlock;
  206. }
  207. if (file_priv->master->lessor != NULL) {
  208. DRM_DEBUG_LEASE("Attempt to set lessee %d as master\n", file_priv->master->lessee_id);
  209. ret = -EINVAL;
  210. goto out_unlock;
  211. }
  212. drm_set_master(dev, file_priv, false);
  213. out_unlock:
  214. mutex_unlock(&dev->master_mutex);
  215. return ret;
  216. }
  217. static void drm_drop_master(struct drm_device *dev,
  218. struct drm_file *fpriv)
  219. {
  220. if (dev->driver->master_drop)
  221. dev->driver->master_drop(dev, fpriv);
  222. drm_master_put(&dev->master);
  223. }
  224. int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
  225. struct drm_file *file_priv)
  226. {
  227. int ret;
  228. mutex_lock(&dev->master_mutex);
  229. ret = drm_master_check_perm(dev, file_priv);
  230. if (ret)
  231. goto out_unlock;
  232. if (!drm_is_current_master(file_priv)) {
  233. ret = -EINVAL;
  234. goto out_unlock;
  235. }
  236. if (!dev->master) {
  237. ret = -EINVAL;
  238. goto out_unlock;
  239. }
  240. if (file_priv->master->lessor != NULL) {
  241. DRM_DEBUG_LEASE("Attempt to drop lessee %d as master\n", file_priv->master->lessee_id);
  242. ret = -EINVAL;
  243. goto out_unlock;
  244. }
  245. drm_drop_master(dev, file_priv);
  246. out_unlock:
  247. mutex_unlock(&dev->master_mutex);
  248. return ret;
  249. }
  250. int drm_master_open(struct drm_file *file_priv)
  251. {
  252. struct drm_device *dev = file_priv->minor->dev;
  253. int ret = 0;
  254. /* if there is no current master make this fd it, but do not create
  255. * any master object for render clients */
  256. mutex_lock(&dev->master_mutex);
  257. if (!dev->master)
  258. ret = drm_new_set_master(dev, file_priv);
  259. else
  260. file_priv->master = drm_master_get(dev->master);
  261. mutex_unlock(&dev->master_mutex);
  262. return ret;
  263. }
  264. void drm_master_release(struct drm_file *file_priv)
  265. {
  266. struct drm_device *dev = file_priv->minor->dev;
  267. struct drm_master *master;
  268. mutex_lock(&dev->master_mutex);
  269. master = file_priv->master;
  270. if (file_priv->magic)
  271. idr_remove(&file_priv->master->magic_map, file_priv->magic);
  272. if (!drm_is_current_master(file_priv))
  273. goto out;
  274. drm_legacy_lock_master_cleanup(dev, master);
  275. if (dev->master == file_priv->master)
  276. drm_drop_master(dev, file_priv);
  277. out:
  278. if (drm_core_check_feature(dev, DRIVER_MODESET) && file_priv->is_master) {
  279. /* Revoke any leases held by this or lessees, but only if
  280. * this is the "real" master
  281. */
  282. drm_lease_revoke(master);
  283. }
  284. /* drop the master reference held by the file priv */
  285. if (file_priv->master)
  286. drm_master_put(&file_priv->master);
  287. mutex_unlock(&dev->master_mutex);
  288. }
  289. /**
  290. * drm_is_current_master - checks whether @priv is the current master
  291. * @fpriv: DRM file private
  292. *
  293. * Checks whether @fpriv is current master on its device. This decides whether a
  294. * client is allowed to run DRM_MASTER IOCTLs.
  295. *
  296. * Most of the modern IOCTL which require DRM_MASTER are for kernel modesetting
  297. * - the current master is assumed to own the non-shareable display hardware.
  298. */
  299. bool drm_is_current_master(struct drm_file *fpriv)
  300. {
  301. return fpriv->is_master && drm_lease_owner(fpriv->master) == fpriv->minor->dev->master;
  302. }
  303. EXPORT_SYMBOL(drm_is_current_master);
  304. /**
  305. * drm_master_get - reference a master pointer
  306. * @master: &struct drm_master
  307. *
  308. * Increments the reference count of @master and returns a pointer to @master.
  309. */
  310. struct drm_master *drm_master_get(struct drm_master *master)
  311. {
  312. kref_get(&master->refcount);
  313. return master;
  314. }
  315. EXPORT_SYMBOL(drm_master_get);
  316. static void drm_master_destroy(struct kref *kref)
  317. {
  318. struct drm_master *master = container_of(kref, struct drm_master, refcount);
  319. struct drm_device *dev = master->dev;
  320. if (drm_core_check_feature(dev, DRIVER_MODESET))
  321. drm_lease_destroy(master);
  322. drm_legacy_master_rmmaps(dev, master);
  323. idr_destroy(&master->magic_map);
  324. idr_destroy(&master->leases);
  325. idr_destroy(&master->lessee_idr);
  326. kfree(master->unique);
  327. kfree(master);
  328. }
  329. /**
  330. * drm_master_put - unreference and clear a master pointer
  331. * @master: pointer to a pointer of &struct drm_master
  332. *
  333. * This decrements the &drm_master behind @master and sets it to NULL.
  334. */
  335. void drm_master_put(struct drm_master **master)
  336. {
  337. kref_put(&(*master)->refcount, drm_master_destroy);
  338. *master = NULL;
  339. }
  340. EXPORT_SYMBOL(drm_master_put);
  341. /* Used by drm_client and drm_fb_helper */
  342. bool drm_master_internal_acquire(struct drm_device *dev)
  343. {
  344. mutex_lock(&dev->master_mutex);
  345. if (dev->master) {
  346. mutex_unlock(&dev->master_mutex);
  347. return false;
  348. }
  349. return true;
  350. }
  351. EXPORT_SYMBOL(drm_master_internal_acquire);
  352. /* Used by drm_client and drm_fb_helper */
  353. void drm_master_internal_release(struct drm_device *dev)
  354. {
  355. mutex_unlock(&dev->master_mutex);
  356. }
  357. EXPORT_SYMBOL(drm_master_internal_release);