From: Yongjian Xu <[email protected]>
arg->time_out_us comes from user-space, then overflow may occur in this line:
uint64_t wait_timeout = ((uint64_t)arg->timeout_us * HZ);
This is not a serious problem, but still a bug.
Signed-off-by: Yongjian Xu <xuyongjiande at gmail.com>
---
drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index c62d20e..f9b0f8b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -689,6 +689,8 @@ int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void
*data,
struct vmw_fence_obj *fence;
struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
int ret;
+ if (arg->timeout_us > (0xffffffffffffffff / HZ))
+ return -EINVAL;
uint64_t wait_timeout = ((uint64_t)arg->timeout_us * HZ);
/*
--
1.7.9.5
