forked from luck/tmp_suning_uos_patched
dma-buf/sw-sync: Prevent user overflow on timeline advance
The timeline is u32, which limits any single advance to INT_MAX so that we can detect all fences that need signaling. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Sumit Semwal <sumit.semwal@linaro.org> Cc: Sean Paul <seanpaul@chromium.org> Cc: Gustavo Padovan <gustavo@padovan.org> Reviewed-by: Sean Paul <seanpaul@chromium.org> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.com> Link: http://patchwork.freedesktop.org/patch/msgid/20170629125930.821-3-chris@chris-wilson.co.uk
This commit is contained in:
parent
61894b0271
commit
8f66d3aa17
|
@ -345,6 +345,11 @@ static long sw_sync_ioctl_inc(struct sync_timeline *obj, unsigned long arg)
|
|||
if (copy_from_user(&value, (void __user *)arg, sizeof(value)))
|
||||
return -EFAULT;
|
||||
|
||||
while (value > INT_MAX) {
|
||||
sync_timeline_signal(obj, INT_MAX);
|
||||
value -= INT_MAX;
|
||||
}
|
||||
|
||||
sync_timeline_signal(obj, value);
|
||||
|
||||
return 0;
|
||||
|
|
Loading…
Reference in New Issue
Block a user