dma-buf/sw-sync: Prevent user overflow on timeline advance

The timeline is u32, which limits any single advance to INT_MAX so that
we can detect all fences that need signaling.

Signed-off-by: Chris Wilson <[email protected]>
Cc: Sumit Semwal <[email protected]>
Cc: Sean Paul <[email protected]>
Cc: Gustavo Padovan <[email protected]>
Reviewed-by: Sean Paul <[email protected]>
Signed-off-by: Gustavo Padovan <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]

diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
index 4d5d8c5e2534dae335a99f3f1a86f9f34a1e9b16..0e676d08aa70087b2daaa7c0cab0f896d16bcf42 100644 (file)
--- a/drivers/dma-buf/sw_sync.c
+++ b/drivers/dma-buf/sw_sync.c
@@ -345,6 +345,11 @@ static long sw_sync_ioctl_inc(struct sync_timeline *obj, unsigned long arg)
        if (copy_from_user(&value, (void __user *)arg, sizeof(value)))
                return -EFAULT;
 
+       while (value > INT_MAX)  {
+               sync_timeline_signal(obj, INT_MAX);
+               value -= INT_MAX;
+       }
+
        sync_timeline_signal(obj, value);
 
        return 0;