[PATCH 3/4] drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg

[Benjamin Cheng]

Check bounds against the end of the BO whenever we access the msg.

Signed-off-by: Benjamin Cheng <benjamin.ch...@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c 
b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
index d17219be50f3..f0f492777b09 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
@@ -1826,7 +1826,7 @@ static int vcn_v4_0_dec_msg(struct amdgpu_cs_parser *p, 
struct amdgpu_job *job,
        struct ttm_operation_ctx ctx = { false, false };
        struct amdgpu_device *adev = p->adev;
        struct amdgpu_bo_va_mapping *map;
-       uint32_t *msg, num_buffers;
+       uint32_t *msg, num_buffers, len_dw;
        struct amdgpu_bo *bo;
        uint64_t start, end;
        unsigned int i;
@@ -1863,6 +1863,12 @@ static int vcn_v4_0_dec_msg(struct amdgpu_cs_parser *p, 
struct amdgpu_job *job,
 
        msg = ptr + addr - start;
 
+       /* Make sure there's at least 4 DWORDs accessible */
+       if (end - addr < 16) {
+               r = -EINVAL;
+               goto out;
+       }
+
        /* Check length */
        if (msg[1] > end - addr) {
                r = -EINVAL;
@@ -1872,7 +1878,15 @@ static int vcn_v4_0_dec_msg(struct amdgpu_cs_parser *p, 
struct amdgpu_job *job,
        if (msg[3] != RDECODE_MSG_CREATE)
                goto out;
 
+       len_dw = msg[1] / 4;
        num_buffers = msg[2];
+
+       /* Verify that all indices fit within the claimed length. Each index is 
4 DWORDs */
+       if (num_buffers > len_dw || 6 + num_buffers * 4 > len_dw) {
+               r = -EINVAL;
+               goto out;
+       }
+
        for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) {
                uint32_t offset, size, *create;
 
@@ -1882,7 +1896,7 @@ static int vcn_v4_0_dec_msg(struct amdgpu_cs_parser *p, 
struct amdgpu_job *job,
                offset = msg[1];
                size = msg[2];
 
-               if (offset + size > end) {
+               if (size < 4 || offset + size > end - addr) {
                        r = -EINVAL;
                        goto out;
                }
-- 
2.53.0