From mboxrd@z Thu Jan  1 00:00:00 1970
From: Gustavo Padovan <gustavo@padovan.org>
Subject: Re: [PATCH] drm/fence: fix memory overwrite when setting out_fence fd
Date: Fri, 13 Jan 2017 14:56:39 -0200
Message-ID: <20170113165639.GE16017@joana>
References: <1484317329-9293-1-git-send-email-gustavo@padovan.org>
 <2003560.ZPyAhlVHHW@avalon>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Return-path: <stable-owner@vger.kernel.org>
Content-Disposition: inline
In-Reply-To: <2003560.ZPyAhlVHHW@avalon>
Sender: stable-owner@vger.kernel.org
To: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: dri-devel@lists.freedesktop.org, Gustavo Padovan <gustavo.padovan@collabora.com>, Daniel Vetter <daniel@ffwll.ch>, Rafael Antognolli <rafael.antognolli@intel.com>, stable@vger.kernel.org
List-Id: dri-devel@lists.freedesktop.org

2017-01-13 Laurent Pinchart <laurent.pinchart@ideasonboard.com>:

> Hi Gustavo,
> 
> Thank you for the patch.
> 
> On Friday 13 Jan 2017 12:22:09 Gustavo Padovan wrote:
> > From: Gustavo Padovan <gustavo.padovan@collabora.com>
> > 
> > Currently if the userspace declares a int variable to store the out_fence
> > fd and pass it to OUT_FENCE_PTR the kernel will overwrite the 32 bits
> > above the int variable on 64 bits systems.
> > 
> > Fix this by making the internal storage of out_fence in the kernel a s32
> > pointer.
> > 
> > Reported-by: Chad Versace <chadversary@chromium.org>
> > Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.com>
> > Cc: Daniel Vetter <daniel@ffwll.ch>
> > Cc: Rafael Antognolli <rafael.antognolli@intel.com>
> > Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> 
> Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> 
> > Cc: stable@vger.kernel.org
> 
> I don't think this is needed, given that the code was merged in v4.10-rc1, and 
> this patch should be merged as a v4.10-rc fix.

Hmm, yeah. I got confused.

Gustavo