From mboxrd@z Thu Jan 1 00:00:00 1970 From: Yongjian@freedesktop.org, Xu@freedesktop.org, xuyongjiande@gmail.com Subject: [PATCH] drm: multiplication overflow in vmw_fence_obj_wait_ioctl() Date: Tue, 17 Dec 2013 19:09:54 +0800 Message-ID: <1387278594-11536-1-git-send-email-xuyongjiande@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail-pb0-f53.google.com (mail-pb0-f53.google.com [209.85.160.53]) by gabe.freedesktop.org (Postfix) with ESMTP id 11C92FBF58 for ; Tue, 17 Dec 2013 03:11:13 -0800 (PST) Received: by mail-pb0-f53.google.com with SMTP id ma3so6803430pbc.40 for ; Tue, 17 Dec 2013 03:11:12 -0800 (PST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces@lists.freedesktop.org Errors-To: dri-devel-bounces@lists.freedesktop.org To: linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Cc: Yongjian Xu List-Id: dri-devel@lists.freedesktop.org From: Yongjian Xu arg->time_out_us comes from user-space, then overflow may occur in this line: uint64_t wait_timeout = ((uint64_t)arg->timeout_us * HZ); This is not a serious problem, but still a bug. Signed-off-by: Yongjian Xu --- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c index c62d20e..f9b0f8b 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c @@ -689,6 +689,8 @@ int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void *data, struct vmw_fence_obj *fence; struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile; int ret; + if (arg->timeout_us > (0xffffffffffffffff / HZ)) + return -EINVAL; uint64_t wait_timeout = ((uint64_t)arg->timeout_us * HZ); /* -- 1.7.9.5