diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2017-06-29 13:59:26 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-12-09 22:01:55 +0100 |
| commit | 985b5b238436f015e4368d82c032d3ce085efe17 (patch) | |
| tree | b87f580ba789b2dbc03973a3bd694352bb8b81cf /drivers/dma-buf | |
| parent | fc839ecb8edae9ec6fc757e6874f14ffecda7b3d (diff) | |
dma-buf/sw-sync: Prevent user overflow on timeline advance
commit 8f66d3aa1735bc95ae58d846a157357e8d41abb8 upstream.
The timeline is u32, which limits any single advance to INT_MAX so that
we can detect all fences that need signaling.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Sean Paul <seanpaul@chromium.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Reviewed-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-3-chris@chris-wilson.co.uk
[s/dma_fence/fence/g - gregkh]
Cc: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/dma-buf')
| -rw-r--r-- | drivers/dma-buf/sw_sync.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c index 77ede2a0fd5a..1098af298af6 100644 --- a/drivers/dma-buf/sw_sync.c +++ b/drivers/dma-buf/sw_sync.c @@ -345,6 +345,11 @@ static long sw_sync_ioctl_inc(struct sync_timeline *obj, unsigned long arg) if (copy_from_user(&value, (void __user *)arg, sizeof(value))) return -EFAULT; + while (value > INT_MAX) { + sync_timeline_signal(obj, INT_MAX); + value -= INT_MAX; + } + sync_timeline_signal(obj, value); return 0; |