From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf0-f173.google.com ([209.85.192.173]:34287 "EHLO mail-pf0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751196AbdAMV2J (ORCPT ); Fri, 13 Jan 2017 16:28:09 -0500 Received: by mail-pf0-f173.google.com with SMTP id 127so36266388pfg.1 for ; Fri, 13 Jan 2017 13:28:04 -0800 (PST) Date: Fri, 13 Jan 2017 13:27:51 -0800 From: Chad Versace To: Gustavo Padovan Cc: dri-devel@lists.freedesktop.org, Gustavo Padovan , stable@vger.kernel.org, Laurent Pinchart Subject: Re: [PATCH] drm/fence: fix memory overwrite when setting out_fence fd Message-ID: <20170113212751.GA27683@chadversary.pdx.corp.google.com> References: <1484317329-9293-1-git-send-email-gustavo@padovan.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1484317329-9293-1-git-send-email-gustavo@padovan.org> Sender: stable-owner@vger.kernel.org List-ID: On Fri 13 Jan 2017, Gustavo Padovan wrote: > From: Gustavo Padovan > > Currently if the userspace declares a int variable to store the out_fence > fd and pass it to OUT_FENCE_PTR the kernel will overwrite the 32 bits > above the int variable on 64 bits systems. > > Fix this by making the internal storage of out_fence in the kernel a s32 > pointer. > > Reported-by: Chad Versace > Signed-off-by: Gustavo Padovan > Cc: Daniel Vetter > Cc: Rafael Antognolli > Cc: Laurent Pinchart > Cc: stable@vger.kernel.org Reviewed-and-Tested-by: Chad Versace I applied this to my kernel branch, updated kmscube, and the spinning cube still looks good. For reference, here are the tags I tested with: mesa: http://git.kiwitree.net/cgit/~chadv/mesa/tag/?h=chadv/review/i965-exec-fence-v03 libdrm: http://git.kiwitree.net/cgit/~chadv/libdrm/tag/?h=chadv/review/intel-exec-fence-v01 linux: http://git.kiwitree.net/cgit/~chadv/linux/tag/?h=chadv/test/i915-exec-fence-v04 kmscube: http://git.kiwitree.net/cgit/~chadv/kmscube/tag/?h=chadv/test/fences-v03