diff mbox

drm: multiplication overflow in vmw_fence_obj_wait_ioctl()

Message ID 1387278594-11536-1-git-send-email-xuyongjiande@gmail.com (mailing list archive)
State New, archived
Headers show

Commit Message

Yongjian@freedesktop.org, Xu@freedesktop.org, xuyongjiande@gmail.com Dec. 17, 2013, 11:09 a.m. UTC 
From: Yongjian Xu <xuyongjiande@gmail.com>

arg->time_out_us comes from user-space, then overflow may occur in this line:
	uint64_t wait_timeout = ((uint64_t)arg->timeout_us * HZ);
This is not a serious problem, but still a bug.

Signed-off-by: Yongjian Xu <xuyongjiande@gmail.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c |    2 ++
 1 file changed, 2 insertions(+)
diff mbox

Patch

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index c62d20e..f9b0f8b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -689,6 +689,8 @@  int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void *data,
 	struct vmw_fence_obj *fence;
 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
 	int ret;
+	if (arg->timeout_us > (0xffffffffffffffff / HZ))
+		return -EINVAL;
 	uint64_t wait_timeout = ((uint64_t)arg->timeout_us * HZ);
 
 	/*