From: Yongjian Xu <xuyongjiande@xxxxxxxxx> arg->time_out_us comes from user-space, then overflow may occur in this line: uint64_t wait_timeout = ((uint64_t)arg->timeout_us * HZ); This is not a serious problem, but still a bug. Signed-off-by: Yongjian Xu <xuyongjiande@xxxxxxxxx> --- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c index c62d20e..f9b0f8b 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c @@ -689,6 +689,8 @@ int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void *data, struct vmw_fence_obj *fence; struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile; int ret; + if (arg->timeout_us > (0xffffffffffffffff / HZ)) + return -EINVAL; uint64_t wait_timeout = ((uint64_t)arg->timeout_us * HZ); /* -- 1.7.9.5 _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx http://lists.freedesktop.org/mailman/listinfo/dri-devel
