Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8f66d3aa authored by Chris Wilson's avatar Chris Wilson Committed by Gustavo Padovan
Browse files

dma-buf/sw-sync: Prevent user overflow on timeline advance 



The timeline is u32, which limits any single advance to INT_MAX so that
we can detect all fences that need signaling.

Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Sean Paul <seanpaul@chromium.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Reviewed-by: default avatarSean Paul <seanpaul@chromium.org>
Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-3-chris@chris-wilson.co.uk
parent 61894b02

drivers/dma-buf/sw_sync.c

+5 −0
Original line number Diff line number Diff line
@@ -345,6 +345,11 @@ static long sw_sync_ioctl_inc(struct sync_timeline *obj, unsigned long arg) 
	if (copy_from_user(&value, (void __user *)arg, sizeof(value)))

		return -EFAULT;



	while (value > INT_MAX)  {

		sync_timeline_signal(obj, INT_MAX);

		value -= INT_MAX;

	}



	sync_timeline_signal(obj, value);



	return 0;