From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-owner@vger.kernel.org>
Received: from mail-ua0-f195.google.com ([209.85.217.195]:34268 "EHLO
        mail-ua0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1750865AbdAPWYY (ORCPT
        <rfc822;stable@vger.kernel.org>); Mon, 16 Jan 2017 17:24:24 -0500
Received: by mail-ua0-f195.google.com with SMTP id i68so10864546uad.1
        for <stable@vger.kernel.org>; Mon, 16 Jan 2017 14:24:24 -0800 (PST)
Date: Mon, 16 Jan 2017 20:24:19 -0200
From: Gustavo Padovan <gustavo@padovan.org>
To: Chad Versace <chadversary@chromium.org>,
        dri-devel@lists.freedesktop.org,
        Gustavo Padovan <gustavo.padovan@collabora.com>,
        stable@vger.kernel.org,
        Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Subject: Re: [PATCH] drm/fence: fix memory overwrite when setting out_fence fd
Message-ID: <20170116222419.GM16017@joana>
References: <1484317329-9293-1-git-send-email-gustavo@padovan.org>
 <20170113212751.GA27683@chadversary.pdx.corp.google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20170113212751.GA27683@chadversary.pdx.corp.google.com>
Sender: stable-owner@vger.kernel.org
List-ID: <stable.vger.kernel.org>

2017-01-13 Chad Versace <chadversary@chromium.org>:

> On Fri 13 Jan 2017, Gustavo Padovan wrote:
> > From: Gustavo Padovan <gustavo.padovan@collabora.com>
> > 
> > Currently if the userspace declares a int variable to store the out_fence
> > fd and pass it to OUT_FENCE_PTR the kernel will overwrite the 32 bits
> > above the int variable on 64 bits systems.
> > 
> > Fix this by making the internal storage of out_fence in the kernel a s32
> > pointer.
> > 
> > Reported-by: Chad Versace <chadversary@chromium.org>
> > Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.com>
> > Cc: Daniel Vetter <daniel@ffwll.ch>
> > Cc: Rafael Antognolli <rafael.antognolli@intel.com>
> > Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> > Cc: stable@vger.kernel.org
> 
> Reviewed-and-Tested-by: Chad Versace <chadversary@chromium.org>
> 
> I applied this to my kernel branch, updated kmscube, and the spinning cube still looks good.
> For reference, here are the tags I tested with:
> 
>     mesa: http://git.kiwitree.net/cgit/~chadv/mesa/tag/?h=chadv/review/i965-exec-fence-v03
>     libdrm: http://git.kiwitree.net/cgit/~chadv/libdrm/tag/?h=chadv/review/intel-exec-fence-v01
>     linux: http://git.kiwitree.net/cgit/~chadv/linux/tag/?h=chadv/test/i915-exec-fence-v04
>     kmscube: http://git.kiwitree.net/cgit/~chadv/kmscube/tag/?h=chadv/test/fences-v03

I pushed this patch to drm-misc-fixes. Thank you all.

Gustavo