All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
To: Chris Wilson <chris@chris-wilson.co.uk>
Cc: dri-devel@lists.freedesktop.org, Dave Airlie <airlied@redhat.com>,
	stable@vger.kernel.org
Subject: Re: [PATCH] drm: Pad drm_mode_get_connector to 64-bit boundary
Date: Wed, 16 Oct 2013 13:09:36 +0300	[thread overview]
Message-ID: <20131016100936.GU13047@intel.com> (raw)
In-Reply-To: <1381913342-17634-1-git-send-email-chris@chris-wilson.co.uk>

On Wed, Oct 16, 2013 at 09:49:02AM +0100, Chris Wilson wrote:
> Pavel Roskin reported that DRM_IOCTL_MODE_GETCONNECTOR was overwritting
> the 4 bytes beyond the end of its structure with a 32-bit userspace
> running on a 64-bit kernel. This is due to the padding gcc inserts as
> the drm_mode_get_connector struct includes a u64 and its size is not a
> natural multiple of u64s.
> 
> 64-bit kernel:
> 
> sizeof(drm_mode_get_connector)=80, alignof=8
> sizeof(drm_mode_get_encoder)=20, alignof=4
> sizeof(drm_mode_modeinfo)=68, alignof=4
> 
> 32-bit userspace:
> 
> sizeof(drm_mode_get_connector)=76, alignof=4
> sizeof(drm_mode_get_encoder)=20, alignof=4
> sizeof(drm_mode_modeinfo)=68, alignof=4
> 
> Fortuituously we can insert explicit padding to the tail of our
> structures without breaking ABI.
> 
> Reported-by: Pavel Roskin <proski@gnu.org>
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Dave Airlie <airlied@redhat.com>
> Cc: dri-devel@lists.freedesktop.org
> Cc: stable@vger.kernel.org

Hmm. But that only fixes things if you recompile the 32bit userland
code.

We could also fix old 32bit userland by adopting the same kind of size
handling that we use for driver specific ioctls. The code is already
there, we just need to set asize and usize appropriately.

> ---
>  include/uapi/drm/drm_mode.h | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/include/uapi/drm/drm_mode.h b/include/uapi/drm/drm_mode.h
> index 550811712f78..28acbaf4a81e 100644
> --- a/include/uapi/drm/drm_mode.h
> +++ b/include/uapi/drm/drm_mode.h
> @@ -223,6 +223,8 @@ struct drm_mode_get_connector {
>  	__u32 connection;
>  	__u32 mm_width, mm_height; /**< HxW in millimeters */
>  	__u32 subpixel;
> +
> +	__u32 pad;
>  };
>  
>  #define DRM_MODE_PROP_PENDING	(1<<0)
> -- 
> 1.8.4.rc3
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Ville Syrjälä
Intel OTC

  reply	other threads:[~2013-10-16 10:09 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-10-16  8:49 [PATCH] drm: Pad drm_mode_get_connector to 64-bit boundary Chris Wilson
2013-10-16 10:09 ` Ville Syrjälä [this message]
2013-10-17 13:37   ` Ben Hutchings
2013-10-16 10:14 ` Jani Nikula
2013-10-16 10:24   ` Chris Wilson
2013-10-16 10:54     ` Jani Nikula
2013-10-16 10:22 ` [PATCH] drm: Prevent overwriting from userspace underallocating core ioctl structs Chris Wilson
2013-10-16 10:38   ` Ville Syrjälä

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20131016100936.GU13047@intel.com \
    --to=ville.syrjala@linux.intel.com \
    --cc=airlied@redhat.com \
    --cc=chris@chris-wilson.co.uk \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.