* [PATCH 1/2] rust: uaccess: add UserSliceWriter::clear()
2026-10-15 1:02 [PATCH 0/2] drm/tyr: allow mismatched buffers for dev_query Deborah Brouwer
@ 2026-10-15 1:02 ` Deborah Brouwer
2026-10-15 1:08 ` sashiko-bot
2026-10-15 1:02 ` [PATCH 2/2] drm/tyr: allow userspace buffers to be mismatched Deborah Brouwer
1 sibling, 1 reply; 4+ messages in thread
From: Deborah Brouwer @ 2026-10-15 1:02 UTC (permalink / raw)
To: Miguel Ojeda, Boqun Feng, Gary Guo, Björn Roy Baron,
Benno Lossin, Andreas Hindborg, Alice Ryhl, Trevor Gross,
Danilo Krummrich, Daniel Almeida, Tamir Duberstein,
Alexandre Courbot, Onur Özkan, David Airlie, Simona Vetter
Cc: rust-for-linux, linux-kernel, dri-devel, Deborah Brouwer
Add a method to zero the remaining bytes in a UserSliceWriter.
If userspace provides a buffer that is larger than necessary, provide
a method to zero out the remaining UserSliceWriter buffer. This avoids
userspace consuming potentially uninitialized memory and/or mistaking it
for data intentionally provided by the kernel.
Since clear_user() is architecturally defined and may be a macro or inline
function, add a rust helper to make clear_user() callable from rust.
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
rust/helpers/uaccess.c | 6 ++++++
rust/kernel/uaccess.rs | 23 +++++++++++++++++++++++
2 files changed, 29 insertions(+)
diff --git a/rust/helpers/uaccess.c b/rust/helpers/uaccess.c
index 6e59cc9c665c..e799d9ac9804 100644
--- a/rust/helpers/uaccess.c
+++ b/rust/helpers/uaccess.c
@@ -27,3 +27,9 @@ unsigned long rust_helper__copy_to_user(void __user *to, const void *from, unsig
return _inline_copy_to_user(to, from, n);
}
#endif
+
+__rust_helper unsigned long
+rust_helper_clear_user(void __user *to, unsigned long n)
+{
+ return clear_user(to, n);
+}
diff --git a/rust/kernel/uaccess.rs b/rust/kernel/uaccess.rs
index f1aecda7a90c..6838e7f90abb 100644
--- a/rust/kernel/uaccess.rs
+++ b/rust/kernel/uaccess.rs
@@ -638,6 +638,29 @@ pub fn write<T: AsBytes>(&mut self, value: &T) -> Result {
pub fn write_truncated<T: AsBytes>(&mut self, value: &T) -> Result<usize> {
self.write_slice_partial(value.as_bytes(), 0)
}
+
+ /// Zeros remaining bytes in the userspace buffer.
+ ///
+ /// Fails with [`EFAULT`] if the userspace memory cannot be cleared.
+ pub fn clear(&mut self) -> Result {
+ let len = self.length;
+
+ if len == 0 {
+ return Ok(());
+ }
+ // SAFETY: `clear_user` checks the userspace address and range and handles
+ // faults when accessing userspace memory
+ let res = unsafe { bindings::clear_user(self.ptr.as_mut_ptr(), len) };
+
+ if res != 0 {
+ return Err(EFAULT);
+ }
+
+ self.ptr = self.ptr.wrapping_byte_add(len);
+ self.length = 0;
+
+ Ok(())
+ }
}
/// Reads a nul-terminated string into `dst` and returns the length.
--
2.56.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH 2/2] drm/tyr: allow userspace buffers to be mismatched
2026-10-15 1:02 [PATCH 0/2] drm/tyr: allow mismatched buffers for dev_query Deborah Brouwer
2026-10-15 1:02 ` [PATCH 1/2] rust: uaccess: add UserSliceWriter::clear() Deborah Brouwer
@ 2026-10-15 1:02 ` Deborah Brouwer
1 sibling, 0 replies; 4+ messages in thread
From: Deborah Brouwer @ 2026-10-15 1:02 UTC (permalink / raw)
To: Miguel Ojeda, Boqun Feng, Gary Guo, Björn Roy Baron,
Benno Lossin, Andreas Hindborg, Alice Ryhl, Trevor Gross,
Danilo Krummrich, Daniel Almeida, Tamir Duberstein,
Alexandre Courbot, Onur Özkan, David Airlie, Simona Vetter
Cc: rust-for-linux, linux-kernel, dri-devel, Deborah Brouwer
Allow userspace to provide a buffer that is smaller or larger than the
object that the kernel expects to write into it.
Set a minimum buffer size to match those in PANTHOR_UOBJ_MIN_SIZE. If
userspace provides at least the minimum buffer size, then simply write
until the buffer is full.
If userspace provides a larger buffer than necessary, then zero out the
remaining buffer.
This ensures UAPI compatibility with Panthor.
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
drivers/gpu/drm/tyr/file.rs | 45 +++++++++++++++++++++++++++++++++++++--------
1 file changed, 37 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/tyr/file.rs b/drivers/gpu/drm/tyr/file.rs
index 9f60a90d4948..a5f96abe4d2e 100644
--- a/drivers/gpu/drm/tyr/file.rs
+++ b/drivers/gpu/drm/tyr/file.rs
@@ -1,11 +1,17 @@
// SPDX-License-Identifier: GPL-2.0 or MIT
+use core::mem::{
+ offset_of,
+ size_of_val, //
+};
+
use kernel::{
drm::{
self,
Registered, //
},
prelude::*,
+ transmute::AsBytes,
uaccess::UserSlice,
uapi, //
};
@@ -16,6 +22,31 @@
TyrDrmRegistrationData, //
};
+trait UobjMinSize {
+ fn min_size(&self) -> usize;
+}
+
+impl UobjMinSize for uapi::drm_panthor_gpu_info {
+ fn min_size(&self) -> usize {
+ offset_of!(Self, tiler_present) + size_of_val(&self.tiler_present)
+ }
+}
+
+// If the user buffer is at least the minimum required size, then
+// copy as much of the kernel object as will fit into the user buffer.
+// Don't fail if the user buffer is smaller than the kernel object.
+// If the user buffer is bigger than needed, zero out the remainder.
+fn set_uobj<T: AsBytes>(usr_dst: u64, size: u32, min_size: usize, src_obj: &T) -> Result {
+ if (size as usize) < min_size {
+ return Err(EINVAL);
+ }
+
+ let mut writer = UserSlice::new(UserPtr::from_addr(usr_dst as usize), size as usize).writer();
+ writer.write_truncated(src_obj)?;
+ writer.clear()?;
+ Ok(())
+}
+
#[pin_data]
pub(crate) struct TyrDrmFileData {}
@@ -48,14 +79,12 @@ pub(crate) fn dev_query(
} else {
match devquery.type_ {
uapi::drm_panthor_dev_query_type_DRM_PANTHOR_DEV_QUERY_GPU_INFO => {
- let mut writer = UserSlice::new(
- UserPtr::from_addr(devquery.pointer as usize),
- devquery.size as usize,
- )
- .writer();
-
- writer.write(®_data.gpu_info)?;
-
+ set_uobj(
+ devquery.pointer,
+ devquery.size,
+ reg_data.gpu_info.min_size(),
+ ®_data.gpu_info,
+ )?;
Ok(0)
}
_ => Err(EINVAL),
--
2.56.0
^ permalink raw reply related [flat|nested] 4+ messages in thread