Commit 65bce27e authored by Benjamin Cheng's avatar Benjamin Cheng Committed by Alex Deucher
Browse files

drm/amdgpu/vcn4: Avoid overflow on msg bound check 



As pointed out by SDL, the previous condition may be vulnerable to
overflow.

Fixes: 0a78f2ba ("drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg")
Cc: SDL <sdl@nppct.ru>
Signed-off-by: default avatarBenjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: default avatarRuijing Dong <ruijing.dong@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 3c5367d950140d4ec7af830b2268a5a6fdaa3885)
parent e6e9faba

drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c

+3 −1
Original line number Diff line number Diff line
@@ -1889,6 +1889,7 @@ static int vcn_v4_0_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job, 


	for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) {

		uint32_t offset, size, *create;

		uint64_t buf_end;



		if (msg[0] != RDECODE_MESSAGE_CREATE)

			continue;
@@ -1896,7 +1897,8 @@ static int vcn_v4_0_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job, 
		offset = msg[1];

		size = msg[2];



		if (size < 4 || offset + size > end - addr) {

		if (size < 4 || check_add_overflow(offset, size, &buf_end) ||

		    buf_end > end - addr) {

			DRM_ERROR("VCN message buffer exceeds BO bounds!\n");

			r = -EINVAL;

			goto out;