From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mout-p-103.mailbox.org (mout-p-103.mailbox.org [80.241.56.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B8D93A452D for ; Wed, 4 Mar 2026 14:30:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=80.241.56.161 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772634615; cv=none; b=m/jzQ17A7GXdogYV/ELb6U15LrEphfKiJvxNfLKhhwIDUTj9Pkfs/DOF/UJzKR33I4NI+Ip/MDdTOSxq4WZgbVCNIf7KBGSKSTaI4JWmhexodnTG+ncbtRJqULf2zcbZ0cMn6GPUKg8j2xkj2l24BtCjWq5IAkyJIUmOpdvnakw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772634615; c=relaxed/simple; bh=PB7Bz7677lq9kKMFHb1Lp9stH1+uZQVF5ZY4UJVmst8=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=k02FL5oFpbyFKoVtWeCeMWFcoXPeMkj09JNe8yCuGfv5w2NczJjFvywfn7ar3F0veoSDZZT1B9fvcZPs2xoxA9SP8YyWPO8TMJdW9EM6f7a9u7Eu53/BRX9MUY36XszIJvDEQYXaVMLjSXPkunmDUbEWEE7kMruMAUfl21AOuRw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=mailbox.org; spf=pass smtp.mailfrom=mailbox.org; dkim=pass (2048-bit key) header.d=mailbox.org header.i=@mailbox.org header.b=wDh7FDut; arc=none smtp.client-ip=80.241.56.161 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=mailbox.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mailbox.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=mailbox.org header.i=@mailbox.org header.b="wDh7FDut" Received: from smtp202.mailbox.org (smtp202.mailbox.org [10.196.197.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-103.mailbox.org (Postfix) with ESMTPS id 4fQw7369nfz9ttL; Wed, 4 Mar 2026 15:30:07 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailbox.org; s=mail20150812; t=1772634607; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/YiuLi/KCUXnYRop69aQ38ONbKLX4RjOZUSznn24Vc8=; b=wDh7FDutq1VABjfYubbeLEA2gOVdJ7r1ofdii+kTW2syYA/AKG6AJy12KbiLIjFbm+6FbQ ITLh6mycOb46nnPsHDAjIhkM7+MfN3oLBkUlR3rxTQrNpjKnyHyha8AVlJdtHLBBdCVMkh ZzFrBcLl4ADnytnY16Mq5cnZmA2gwea2N8HcOtVFL7OpegpGH14IZshF7U0SU73hOjWl1z EaPI4acbeOhZIKElOMidV6WeBNaQ6V+/vH7Z8r+1sn4gWEAtcCP7QpGh2quAKRCy/6X2xn qTCkJ1Xseq6SuhZqTE9YL1Uj0WCFJ0TMSwBPhyh4I18orv20LItpMXF535Ic6w== Message-ID: <07e4a878-199d-4f6a-a36c-95b3e168354a@mailbox.org> Date: Wed, 4 Mar 2026 15:29:59 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [PATCH] drm/syncobj: Fix handle <-> fd ioctls with dirty stack To: Julian Orth Cc: Maarten Lankhorst , =?UTF-8?Q?Christian_K=C3=B6nig?= , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dmitry Osipenko , Rob Clark , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org References: <20260301-point-v1-1-21fc5fd98614@gmail.com> <2b75199f-b78a-4915-8e75-5d186f63f7c5@mailbox.org> <5464a6fa-5a49-42f5-a1ea-ce9f18a6955e@mailbox.org> <59bd46c0-03d9-4fef-a4fd-14b8f68f9860@mailbox.org> <0847752c-39cb-4233-8e07-8e1325c196cc@mailbox.org> From: =?UTF-8?Q?Michel_D=C3=A4nzer?= Content-Language: en-CA In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-MBO-RS-META: b1ucx37pfrjfjt6ti54yw5mpg9ad6mpn X-MBO-RS-ID: 2ddff133a0b099d4947 On 3/4/26 13:32, Julian Orth wrote: > On Wed, Mar 4, 2026 at 12:47 PM Michel Dänzer > wrote: >> On 3/4/26 12:25, Julian Orth wrote: >>> On Wed, Mar 4, 2026 at 12:15 PM Michel Dänzer >>> wrote: >>>> On 3/3/26 20:12, Julian Orth wrote: >>>>> On Tue, Mar 3, 2026 at 7:53 PM Michel Dänzer wrote: >>>>>> On 3/3/26 18:44, Maarten Lankhorst wrote: >>>>>>> >>>>>>> You don't even need to use memset, this would work too: >>>>>>> >>>>>>> struct drm_syncobj_handle args = { >>>>>>> .flags = 0 >>>>>>> }; >>>>>> >>>>>> TL;DR: This method isn't 100% safe either. >>>>>> >>>>>> It won't initialize any padding which isn't covered by any struct field. We try to avoid that and have explicit padding fields instead, mistakes may happen though, and in theory such padding could later be used for a new field. >>>>> >>>>> I don't think this is workable. >>>> >>>> libdrm begs to differ. It shows that it's not only workable but really easy. There's no reason for doing it any other way. >>> >>> Using memset to initialize padding bytes between fields is workable. >>> Having the kernel add checks for this for existing ioctls is not >>> workable because it would break usespace that doesn't do this. >> >> As discussed in this thread, memset is also required for when the size of an ioctl struct is extended, even if there is no such padding. > > That is not a concern in rust code. If the rust code extends the > definition of the struct, all call sites will cause a compilation > error until the new field is also initialized. > > The issue I'm talking about here is strictly about padding bytes between fields. So this is not related to the issue which motivated your patch? >>> Which is every rust program out there as far as I can tell. >> >> That's surprising. Surely there must be some unsafe code involved which allows uninitialized memory to be passed to ioctl()? > > The memory is not uninitialized from the perspective of the rust > language since all fields are initialized. Only the padding bytes are > uninitialized and they cannot be accessed in safe rust, therefore no > unsafe is required. > > I've never seen any rust code that uses memset to initialize ioctl > arguments. It assumes that the ioctl implementation will only read > from the named fields. Therefore, while the ioctl syscall itself is > unsafe, developers assume that the safety requirements are satisfied > in this regard. As discussed in this thread, that's not a valid assumption and may blow up in their face sooner or later. ("No padding not covered by any fields" is best-effort, not a guarantee) -- Earthling Michel Dänzer \ GNOME / Xwayland / Mesa developer https://redhat.com \ Libre software enthusiast