summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChris Wilson <chris@chris-wilson.co.uk>2017-06-29 15:59:26 +0300
committerGustavo Padovan <gustavo.padovan@collabora.com>2017-06-30 00:52:05 +0300
commit8f66d3aa1735bc95ae58d846a157357e8d41abb8 (patch)
treeed1f9f6ba317a12164091b82101bcb515e3c8ae2
parent61894b02716f122dd7662d5d89f5b2245ca551e2 (diff)
downloadlinux-8f66d3aa1735bc95ae58d846a157357e8d41abb8.tar.xz
dma-buf/sw-sync: Prevent user overflow on timeline advance
The timeline is u32, which limits any single advance to INT_MAX so that we can detect all fences that need signaling. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Sumit Semwal <sumit.semwal@linaro.org> Cc: Sean Paul <seanpaul@chromium.org> Cc: Gustavo Padovan <gustavo@padovan.org> Reviewed-by: Sean Paul <seanpaul@chromium.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.com> Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-3-chris@chris-wilson.co.uk
-rw-r--r--drivers/dma-buf/sw_sync.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
index 4d5d8c5e2534..0e676d08aa70 100644
--- a/drivers/dma-buf/sw_sync.c
+++ b/drivers/dma-buf/sw_sync.c
@@ -345,6 +345,11 @@ static long sw_sync_ioctl_inc(struct sync_timeline *obj, unsigned long arg)
if (copy_from_user(&value, (void __user *)arg, sizeof(value)))
return -EFAULT;
+ while (value > INT_MAX) {
+ sync_timeline_signal(obj, INT_MAX);
+ value -= INT_MAX;
+ }
+
sync_timeline_signal(obj, value);
return 0;