AMD General Reviewed-by: Leo Liu <[email protected]>
> -----Original Message----- > From: Wu, David <[email protected]> > Sent: Tuesday, August 11, 2026 1:07 PM > To: [email protected]; Deucher, Alexander > <[email protected]> > Cc: Liu, Leo <[email protected]>; [email protected] > Subject: [PATCH v3] drm/amdgpu/vcn: fix integer overflow in dec_msg buffer > count check > > if supplied msg[2] in the header is too large, 4 times of this unsigned 32 > bit value > will overflow and the test could pass. > > v3: Using two-helper form is heavier than needed. > Since len_dw is a plain u32, a division-based test is > overflow-free by construction. > > Fixes: b193019860d6 ("drm/amdgpu/vcn3: Prevent OOB reads when parsing dec > msg") > Fixes: 0a78f2bac142 ("drm/amdgpu/vcn4: Prevent OOB reads when parsing dec > msg") > > Signed-off-by: David (Ming Qiang) Wu <[email protected]> > Cc: [email protected] > --- > drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 8 ++++++-- > drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 8 ++++++-- > 2 files changed, 12 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c > b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c > index 81bba3ec2a93..686f5f758cb1 100644 > --- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c > +++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c > @@ -1964,8 +1964,12 @@ static int vcn_v3_0_dec_msg(struct > amdgpu_cs_parser *p, struct amdgpu_job *job, > len_dw = msg[1] / 4; > num_buffers = msg[2]; > > - /* Verify that all indices fit within the claimed length. Each index is > 4 > DWORDs */ > - if (num_buffers > len_dw || 6 + num_buffers * 4 > len_dw) { > + /* Verify that all indices fit within the claimed length. > + * There are 6 dwords in the header before the first buffer. > + * Each buffer has 4 dwords. Extra dwords will be ignored > + * at the end of the last buffer. > + */ > + if (len_dw < 6 || num_buffers > (len_dw - 6) / 4) { > DRM_ERROR("VCN message has too many buffers!\n"); > r = -EINVAL; > goto out; > diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c > b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c > index 0cce78b205a8..6f0a51c436db 100644 > --- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c > +++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c > @@ -1880,8 +1880,12 @@ static int vcn_v4_0_dec_msg(struct > amdgpu_cs_parser *p, struct amdgpu_job *job, > len_dw = msg[1] / 4; > num_buffers = msg[2]; > > - /* Verify that all indices fit within the claimed length. Each index is > 4 > DWORDs */ > - if (num_buffers > len_dw || 6 + num_buffers * 4 > len_dw) { > + /* Verify that all indices fit within the claimed length. > + * There are 6 dwords in the header before the first buffer. > + * Each buffer has 4 dwords. Extra dwords will be ignored > + * at the end of the last buffer. > + */ > + if (len_dw < 6 || num_buffers > (len_dw - 6) / 4) { > DRM_ERROR("VCN message has too many buffers!\n"); > r = -EINVAL; > goto out; > -- > 2.43.0
