From: Boyuan Zhang <[email protected]> When width or height is less than 16, width_in_mb or height_in_mb becomes 0, leading to fs_in_mb being 0. This causes a division by zero when calculating num_dpb_buffer in H264 and H264 Perf decode paths.
Add validation to reject frames with width < 16 or height < 16 before performing any calculations that depend on these values. Signed-off-by: Boyuan Zhang <[email protected]> --- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c index 3a3bc0d370fa..0cf0f53e5066 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c @@ -628,13 +628,20 @@ static int amdgpu_uvd_cs_msg_decode(struct amdgpu_device *adev, uint32_t *msg, unsigned int pitch = msg[28]; unsigned int level = msg[57]; + unsigned int image_size, tmp, min_dpb_size, num_dpb_buffer; + unsigned int min_ctx_size = ~0; + + /* Reject invalid dimensions to prevent division by zero */ + if (width < 16 || height < 16) { + DRM_ERROR("Invalid UVD decoding dimensions (%dx%d)!\n", + width, height); + return -EINVAL; + } + unsigned int width_in_mb = width / 16; unsigned int height_in_mb = ALIGN(height / 16, 2); unsigned int fs_in_mb = width_in_mb * height_in_mb; - unsigned int image_size, tmp, min_dpb_size, num_dpb_buffer; - unsigned int min_ctx_size = ~0; - image_size = width * height; image_size += image_size / 2; image_size = ALIGN(image_size, 1024); -- 2.43.0
