From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mout-p-103.mailbox.org (mout-p-103.mailbox.org [80.241.56.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3EB63423143 for ; Tue, 3 Mar 2026 11:23:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=80.241.56.161 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772537018; cv=none; b=AoYKto46jVianF2XMb8hv8p5M5et2T/O8v6uI50FKYvoSRAP7vNMWFBsAnQcZa+tm9xterd5q1wD+sp8PyEamE0MMm7vSUZ6V4oSpXlnPBnaQWZVO7PMd2T/lZnoTKVG7NRAGP1gB2uBYKdKJ76YaOy1v2bWL+ZXjHi6u0LtH/k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772537018; c=relaxed/simple; bh=WDUCM2tDRuYd2NjB8f3T69/nbhTh9dCkJX6kOn9xTnA=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=We4V8oOEUxJuRaNXnifiNg/RJVzjMqS/YiD/GWGFpRKb4S9D6fFes4f+ftrFt8cR1m43Y0A0dzx/2xXbXdijTDrztAHq39gAKtWtkLilk7PkmCW1V8eAnjXPet01DuBDtXwvrrLvNwhaBVLmymrLBTId4T7Qn5NEIxunCTQr40U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=mailbox.org; spf=pass smtp.mailfrom=mailbox.org; dkim=pass (2048-bit key) header.d=mailbox.org header.i=@mailbox.org header.b=Gc5wS6iA; arc=none smtp.client-ip=80.241.56.161 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=mailbox.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mailbox.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=mailbox.org header.i=@mailbox.org header.b="Gc5wS6iA" Received: from smtp102.mailbox.org (smtp102.mailbox.org [10.196.197.102]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-103.mailbox.org (Postfix) with ESMTPS id 4fQCvV5tTZz9tdm; Tue, 3 Mar 2026 12:17:42 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailbox.org; s=mail20150812; t=1772536662; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3K6W7oNK2OPo9cE9jIdVYJw+yMU/74yDhidybo+WdvY=; b=Gc5wS6iA3yK40Um32L6I5Vqaw+WsG9rNDbJCv0l0EERQ+6AgB8vcw5kyD/U9Uh3bCZYZy+ 7TZWPWUNftZOcpZUijMaHglkCKAyweGXXIW97PKyW9+Th4RGbKFf5uJqF0kZwqodm1wQZR hnVqCJI0+HiQ3PgRGn+Tp5IbD91bKxM6mOM65UwLtGNFPiJN1H1g1YUgiYJNpc77GLqiiI nk73K26NqWIbFbufHFRzYAVL0VwBrFp+72dahAb8+y0Iylddo/aFzUBo2fbtDYfwzsRabo LCfV1USbsvJn23M1C8VooQMDmHib7urU9FdcQ1WLrCWgv+/OfgiKoSPp2US/Mw== Message-ID: <637a138f-ee6f-4940-843f-0ec873997de3@mailbox.org> Date: Tue, 3 Mar 2026 12:17:37 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [PATCH] drm/syncobj: Fix handle <-> fd ioctls with dirty stack To: Julian Orth , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , =?UTF-8?Q?Christian_K=C3=B6nig?= , Dmitry Osipenko , Rob Clark Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org References: <20260301-point-v1-1-21fc5fd98614@gmail.com> From: =?UTF-8?Q?Michel_D=C3=A4nzer?= Content-Language: en-CA In-Reply-To: <20260301-point-v1-1-21fc5fd98614@gmail.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-MBO-RS-ID: 2b5b15e3f77313718bf X-MBO-RS-META: 141euosyqzsi38o548x9147ak5obqgqo On 3/1/26 13:34, Julian Orth wrote: > Consider the following application: > > #include > #include > #include > #include > > int main(void) { > int fd = open("/dev/dri/renderD128", O_RDWR); > struct drm_syncobj_create arg1; > ioctl(fd, DRM_IOCTL_SYNCOBJ_CREATE, &arg1); > struct drm_syncobj_handle arg2; > memset(&arg2, 1, sizeof(arg2)); // simulate dirty stack > arg2.handle = arg1.handle; > arg2.flags = 0; > arg2.fd = 0; > arg2.pad = 0; > // arg2.point = 0; // userspace is required to set point to 0 > ioctl(fd, DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD, &arg2); > } > > The last ioctl returns EINVAL because args->point is not 0. However, > userspace developed against older kernel versions is not aware of the > new point field and might therefore not initialize it. > > The correct check would be > > if (args->flags & DRM_SYNCOBJ_FD_TO_HANDLE_FLAGS_TIMELINE) > return -EINVAL; > > However, there might already be userspace that relies on this not > returning an error as long as point == 0. Therefore use the more lenient > check. > > Fixes: c2d3a7300695 ("drm/syncobj: Extend EXPORT_SYNC_FILE for timeline syncobjs") > Signed-off-by: Julian Orth > --- > This patch fixes a regression that would cause conversions between > syncobj handles and fds to fail if userspace did not initialize a > recently-added field to 0. While I don't object to this change, I'd argue that this is really a workaround for broken user space, not a fix for a kernel regression. User space must initialize the full struct to 0, except for the fields it wants to have other values. This kind of kernel-side workaround for neglecting that won't be possible in all cases. -- Earthling Michel Dänzer \ GNOME / Xwayland / Mesa developer https://redhat.com \ Libre software enthusiast