Re: [PATCH] drm/fence: fix memory overwrite when setting out_fence fd

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri 13 Jan 2017, Gustavo Padovan wrote:
> From: Gustavo Padovan <gustavo.padovan@xxxxxxxxxxxxx>
> 
> Currently if the userspace declares a int variable to store the out_fence
> fd and pass it to OUT_FENCE_PTR the kernel will overwrite the 32 bits
> above the int variable on 64 bits systems.
> 
> Fix this by making the internal storage of out_fence in the kernel a s32
> pointer.
> 
> Reported-by: Chad Versace <chadversary@xxxxxxxxxxxx>
> Signed-off-by: Gustavo Padovan <gustavo.padovan@xxxxxxxxxxxxx>
> Cc: Daniel Vetter <daniel@xxxxxxxx>
> Cc: Rafael Antognolli <rafael.antognolli@xxxxxxxxx>
> Cc: Laurent Pinchart <laurent.pinchart@xxxxxxxxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx

Reviewed-and-Tested-by: Chad Versace <chadversary@xxxxxxxxxxxx>

I applied this to my kernel branch, updated kmscube, and the spinning cube still looks good.
For reference, here are the tags I tested with:

    mesa: http://git.kiwitree.net/cgit/~chadv/mesa/tag/?h=chadv/review/i965-exec-fence-v03
    libdrm: http://git.kiwitree.net/cgit/~chadv/libdrm/tag/?h=chadv/review/intel-exec-fence-v01
    linux: http://git.kiwitree.net/cgit/~chadv/linux/tag/?h=chadv/test/i915-exec-fence-v04
    kmscube: http://git.kiwitree.net/cgit/~chadv/kmscube/tag/?h=chadv/test/fences-v03
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]