* [PATCH] drm: multiplication overflow in vmw_fence_obj_wait_ioctl()
@ 2013-12-17 11:09 Yongjian, Xu, xuyongjiande
0 siblings, 0 replies; only message in thread
From: Yongjian, Xu, xuyongjiande @ 2013-12-17 11:09 UTC (permalink / raw)
To: linux-kernel, dri-devel; +Cc: Yongjian Xu
From: Yongjian Xu <xuyongjiande@gmail.com>
arg->time_out_us comes from user-space, then overflow may occur in this line:
uint64_t wait_timeout = ((uint64_t)arg->timeout_us * HZ);
This is not a serious problem, but still a bug.
Signed-off-by: Yongjian Xu <xuyongjiande@gmail.com>
---
drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index c62d20e..f9b0f8b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -689,6 +689,8 @@ int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void *data,
struct vmw_fence_obj *fence;
struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
int ret;
+ if (arg->timeout_us > (0xffffffffffffffff / HZ))
+ return -EINVAL;
uint64_t wait_timeout = ((uint64_t)arg->timeout_us * HZ);
/*
--
1.7.9.5
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2013-12-17 11:11 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-12-17 11:09 [PATCH] drm: multiplication overflow in vmw_fence_obj_wait_ioctl() Yongjian, Xu, xuyongjiande
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).