| From 8f66d3aa1735bc95ae58d846a157357e8d41abb8 Mon Sep 17 00:00:00 2001 |
| From: Chris Wilson <chris@chris-wilson.co.uk> |
| Date: Thu, 29 Jun 2017 13:59:26 +0100 |
| Subject: dma-buf/sw-sync: Prevent user overflow on timeline advance |
| |
| From: Chris Wilson <chris@chris-wilson.co.uk> |
| |
| commit 8f66d3aa1735bc95ae58d846a157357e8d41abb8 upstream. |
| |
| The timeline is u32, which limits any single advance to INT_MAX so that |
| we can detect all fences that need signaling. |
| |
| Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> |
| Cc: Sumit Semwal <sumit.semwal@linaro.org> |
| Cc: Sean Paul <seanpaul@chromium.org> |
| Cc: Gustavo Padovan <gustavo@padovan.org> |
| Reviewed-by: Sean Paul <seanpaul@chromium.org> |
| Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.com> |
| Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-3-chris@chris-wilson.co.uk |
| [s/dma_fence/fence/g - gregkh] |
| Cc: Jisheng Zhang <Jisheng.Zhang@synaptics.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/dma-buf/sw_sync.c | 5 +++++ |
| 1 file changed, 5 insertions(+) |
| |
| --- a/drivers/dma-buf/sw_sync.c |
| +++ b/drivers/dma-buf/sw_sync.c |
| @@ -345,6 +345,11 @@ static long sw_sync_ioctl_inc(struct syn |
| if (copy_from_user(&value, (void __user *)arg, sizeof(value))) |
| return -EFAULT; |
| |
| + while (value > INT_MAX) { |
| + sync_timeline_signal(obj, INT_MAX); |
| + value -= INT_MAX; |
| + } |
| + |
| sync_timeline_signal(obj, value); |
| |
| return 0; |
