From patchwork Wed Jun 28 15:51:11 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sean Paul X-Patchwork-Id: 9814769 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 94791603D7 for ; Wed, 28 Jun 2017 15:51:20 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 86E04285F9 for ; Wed, 28 Jun 2017 15:51:20 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7B8A928600; Wed, 28 Jun 2017 15:51:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 0CEFE28607 for ; Wed, 28 Jun 2017 15:51:19 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 152B76E0D7; Wed, 28 Jun 2017 15:51:19 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-qt0-x22c.google.com (mail-qt0-x22c.google.com [IPv6:2607:f8b0:400d:c0d::22c]) by gabe.freedesktop.org (Postfix) with ESMTPS id 23F826E0D7 for ; Wed, 28 Jun 2017 15:51:18 +0000 (UTC) Received: by mail-qt0-x22c.google.com with SMTP id 32so52930279qtv.1 for ; Wed, 28 Jun 2017 08:51:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id; bh=4iiT6IM8Y5zdH23VzWdPG6/SWUMHusDLMGC8oZ1EEzg=; b=hXUUpT4zXwmKOnWhZAxVLrx6w5+xav/6rGMG9Din4WLxpuRGuCSkiPLl1h0KfrC0gr gn8xCkuFAC8dJkQcuPomiVo8Ald4FrNHfzIsH9z/UrNOKYzanO6BYp9U4Ih6av2hLsvL KUuhdjkEYWMs49szK73nCYz50Im+aFgsYocgI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=4iiT6IM8Y5zdH23VzWdPG6/SWUMHusDLMGC8oZ1EEzg=; b=WjmifGLxiKmgABKYGr65f4L5KMTp4gkS/eTSKVFC316HvZyucZ9+pTQUokuNYcwYfV j9v507vtpGGh20OQ6tnXVrpAG9qTnf2LPpdXEVHNM97bL5cy78N5q5CUk++uGJDflacd n2px0hLUfQd8k807gCCrZSekwvJLcKwy/TIxaiil/h5LEKzWZ+muAvIm4lQfG17mX5DJ F4XU2mbonm0XiHiYouwt05TMwcjdqml5b341xDjX5NTdb9qRtn9PgMzYD3AKeq9QUQvP 3NzMZIIYzeRuYmAmlQk0TWRQcMbLzIGYb7GaieOSCq81yUijFpri3ckmEmRyDplk4KRk oIKw== X-Gm-Message-State: AKS2vOxCfXeU2OOExyif2BAWBXyySpvXgxmDQGJ5WGzzlyU5XEcemZj6 BAJ0pePHQrHXRrvPkXzvDQ== X-Received: by 10.237.62.58 with SMTP id l55mr13434915qtf.20.1498665076957; Wed, 28 Jun 2017 08:51:16 -0700 (PDT) Received: from localhost.localdomain (99-45-70-16.lightspeed.rlghnc.sbcglobal.net. [99.45.70.16]) by smtp.gmail.com with ESMTPSA id c143sm1811107qkg.64.2017.06.28.08.51.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 28 Jun 2017 08:51:16 -0700 (PDT) From: Sean Paul To: dri-devel@lists.freedesktop.org Subject: [PATCH] dma-buf/sw_sync: Fix timeline/pt overflow cases Date: Wed, 28 Jun 2017 11:51:11 -0400 Message-Id: <20170628155117.3558-1-seanpaul@chromium.org> X-Mailer: git-send-email 2.13.2.725.g09c95d1e9-goog Cc: marcheu@chromium.org, linux-media@vger.kernel.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP Protect against long-running processes from overflowing the timeline and creating fences that go back in time. While we're at it, avoid overflowing while we're incrementing the timeline. Signed-off-by: Sean Paul --- drivers/dma-buf/sw_sync.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c index 69c5ff36e2f9..40934619ed88 100644 --- a/drivers/dma-buf/sw_sync.c +++ b/drivers/dma-buf/sw_sync.c @@ -142,7 +142,7 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc) spin_lock_irqsave(&obj->child_list_lock, flags); - obj->value += inc; + obj->value += min(inc, ~0x0U - obj->value); list_for_each_entry_safe(pt, next, &obj->active_list_head, active_list) { @@ -178,6 +178,11 @@ static struct sync_pt *sync_pt_create(struct sync_timeline *obj, int size, return NULL; spin_lock_irqsave(&obj->child_list_lock, flags); + if (value < obj->value) { + spin_unlock_irqrestore(&obj->child_list_lock, flags); + return NULL; + } + sync_timeline_get(obj); dma_fence_init(&pt->base, &timeline_fence_ops, &obj->child_list_lock, obj->context, value);