Commit e6e9faba authored by Benjamin Cheng's avatar Benjamin Cheng Committed by Alex Deucher
Browse files

drm/amdgpu/vcn3: Avoid overflow on msg bound check 



As pointed out by SDL, the previous condition may be vulnerable to
overflow.

Fixes: b1930198 ("drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg")
Cc: SDL <sdl@nppct.ru>
Signed-off-by: default avatarBenjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: default avatarRuijing Dong <ruijing.dong@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
(cherry picked from commit db00257ac9e4a51eb2515aaea161a019f7125e10)
parent 47a5dfc8

drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c

+3 −1
Original line number Diff line number Diff line
@@ -1973,6 +1973,7 @@ static int vcn_v3_0_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job, 


	for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) {

		uint32_t offset, size, *create;

		uint64_t buf_end;



		if (msg[0] != RDECODE_MESSAGE_CREATE)

			continue;
@@ -1980,7 +1981,8 @@ static int vcn_v3_0_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job, 
		offset = msg[1];

		size = msg[2];



		if (size < 4 || offset + size > end - addr) {

		if (size < 4 || check_add_overflow(offset, size, &buf_end) ||

		    buf_end > end - addr) {

			DRM_ERROR("VCN message buffer exceeds BO bounds!\n");

			r = -EINVAL;

			goto out;