From patchwork Wed Jun 28 15:51:11 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sean Paul X-Patchwork-Id: 42169 Received: from mail.tu-berlin.de ([130.149.7.33]) by www.linuxtv.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dQFFf-0002SO-VT; Wed, 28 Jun 2017 15:51:35 +0000 X-tubIT-Incoming-IP: 209.132.180.67 Received: from vger.kernel.org ([209.132.180.67]) by mail.tu-berlin.de (exim-4.89/mailfrontend-8) with esmtp id 1dQFFe-0007cB-jf; Wed, 28 Jun 2017 17:51:35 +0200 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751782AbdF1Pv1 (ORCPT + 1 other); Wed, 28 Jun 2017 11:51:27 -0400 Received: from mail-qt0-f174.google.com ([209.85.216.174]:36856 "EHLO mail-qt0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751739AbdF1PvR (ORCPT ); Wed, 28 Jun 2017 11:51:17 -0400 Received: by mail-qt0-f174.google.com with SMTP id i2so52886901qta.3 for ; Wed, 28 Jun 2017 08:51:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id; bh=4iiT6IM8Y5zdH23VzWdPG6/SWUMHusDLMGC8oZ1EEzg=; b=hXUUpT4zXwmKOnWhZAxVLrx6w5+xav/6rGMG9Din4WLxpuRGuCSkiPLl1h0KfrC0gr gn8xCkuFAC8dJkQcuPomiVo8Ald4FrNHfzIsH9z/UrNOKYzanO6BYp9U4Ih6av2hLsvL KUuhdjkEYWMs49szK73nCYz50Im+aFgsYocgI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=4iiT6IM8Y5zdH23VzWdPG6/SWUMHusDLMGC8oZ1EEzg=; b=bqRC8+pxkGb6F8zhfm3wDjS5bNdZ+ZrM4vUQjvSLBzeDdNqrVaSz5/9meOzP934e0q N0MOPLua8nLXRoufwaglKPAoMHXj00HDLTw8m8glTrhvcWdh5JNAbIvv2L4Bn1b4hxoK xvHUVxDCE0D3e2ldoy99SY8hnZeBswhakG/yfaWxJhIJmd6h5/i0qAhiufH+vC1kOSvJ g0W/sdLVrvV3JPWs6tTzBdHH5fFLco21hCLx+D2EafpLUTghTWVZ2i44Mr51tHvhFAaT DrmiIS4kIPxW9qUyWTf+hhslIX5p09AinKWmy0+AYC6mCwnQLVsVziQ2Op2pE7VnY0YN tSHw== X-Gm-Message-State: AKS2vOw0vXcbJvYNMPDp9sbcB59LnJJQeNx3gj6zMI2nBVhRqzPOKrGf u/fQcrV4aFMS6AB3 X-Received: by 10.237.62.58 with SMTP id l55mr13434915qtf.20.1498665076957; Wed, 28 Jun 2017 08:51:16 -0700 (PDT) Received: from localhost.localdomain (99-45-70-16.lightspeed.rlghnc.sbcglobal.net. [99.45.70.16]) by smtp.gmail.com with ESMTPSA id c143sm1811107qkg.64.2017.06.28.08.51.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 28 Jun 2017 08:51:16 -0700 (PDT) From: Sean Paul To: dri-devel@lists.freedesktop.org Cc: dbehr@chromium.org, marcheu@chromium.org, Sean Paul , Sumit Semwal , Gustavo Padovan , linux-media@vger.kernel.org Subject: [PATCH] dma-buf/sw_sync: Fix timeline/pt overflow cases Date: Wed, 28 Jun 2017 11:51:11 -0400 Message-Id: <20170628155117.3558-1-seanpaul@chromium.org> X-Mailer: git-send-email 2.13.2.725.g09c95d1e9-goog Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2017.6.28.154217 X-PMX-Spam: Gauge=IIIIIIII, Probability=8%, Report=' MULTIPLE_RCPTS 0.1, HTML_00_01 0.05, HTML_00_10 0.05, BODYTEXTP_SIZE_3000_LESS 0, BODY_SIZE_1200_1299 0, BODY_SIZE_2000_LESS 0, BODY_SIZE_5000_LESS 0, BODY_SIZE_7000_LESS 0, DATE_TZ_NA 0, DKIM_SIGNATURE 0, LEGITIMATE_SIGNS 0, MULTIPLE_REAL_RCPTS 0, NO_URI_HTTPS 0, __ANY_URI 0, __CC_NAME 0, __CC_NAME_DIFF_FROM_ACC 0, __CC_REAL_NAMES 0, __FROM_DOMAIN_IN_ANY_CC1 0, __FROM_DOMAIN_IN_ANY_CC2 0, __FROM_DOMAIN_IN_RCPT 0, __HAS_CC_HDR 0, __HAS_FROM 0, __HAS_LIST_ID 0, __HAS_MSGID 0, __HAS_X_MAILER 0, __HAS_X_MAILING_LIST 0, __MIME_TEXT_ONLY 0, __MIME_TEXT_P 0, __MIME_TEXT_P1 0, __MULTIPLE_RCPTS_CC_X2 0, __NO_HTML_TAG_RAW 0, __SANE_MSGID 0, __SUBJ_ALPHA_END 0, __TO_MALFORMED_2 0, __TO_NO_NAME 0, __URI_NO_WWW 0, __URI_NS , __YOUTUBE_RCVD 0' Protect against long-running processes from overflowing the timeline and creating fences that go back in time. While we're at it, avoid overflowing while we're incrementing the timeline. Signed-off-by: Sean Paul --- drivers/dma-buf/sw_sync.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c index 69c5ff36e2f9..40934619ed88 100644 --- a/drivers/dma-buf/sw_sync.c +++ b/drivers/dma-buf/sw_sync.c @@ -142,7 +142,7 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc) spin_lock_irqsave(&obj->child_list_lock, flags); - obj->value += inc; + obj->value += min(inc, ~0x0U - obj->value); list_for_each_entry_safe(pt, next, &obj->active_list_head, active_list) { @@ -178,6 +178,11 @@ static struct sync_pt *sync_pt_create(struct sync_timeline *obj, int size, return NULL; spin_lock_irqsave(&obj->child_list_lock, flags); + if (value < obj->value) { + spin_unlock_irqrestore(&obj->child_list_lock, flags); + return NULL; + } + sync_timeline_get(obj); dma_fence_init(&pt->base, &timeline_fence_ops, &obj->child_list_lock, obj->context, value);