From: Benjamin Cheng <[email protected]> commit de2a02cc28d6d5d37db07d00a9a684c754a5fd74 upstream.
In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW. Signed-off-by: Benjamin Cheng <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]> [ Roman: In 5.10/5.15, amdgpu_vce_cs_reloc() does not take a struct amdgpu_ib *ib argument. The conversion was carried out by commit cdc7893fc93f ("drm/amdgpu: use job and ib structures directly in CS parsers"). Instead, the IB is obtained via p->job->ibs[ib_idx] ] Signed-off-by: Roman Demidov <[email protected]> --- Backport fix for CVE-2026-53375 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c index 0a28daa14fb1..9b0efddd145b 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c @@ -634,11 +634,15 @@ static int amdgpu_vce_validate_bo(struct amdgpu_cs_parser *p, uint32_t ib_idx, static int amdgpu_vce_cs_reloc(struct amdgpu_cs_parser *p, uint32_t ib_idx, int lo, int hi, unsigned size, uint32_t index) { + struct amdgpu_ib *ib = &p->job->ibs[ib_idx]; struct amdgpu_bo_va_mapping *mapping; struct amdgpu_bo *bo; uint64_t addr; int r; + if (lo >= ib->length_dw || hi >= ib->length_dw) + return -EINVAL; + if (index == 0xffffffff) index = 0; -- 2.53.0
