tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/amdgpu/vcn4: Avoid overflow on msg bound check

As pointed out by SDL, the previous condition may be vulnerable to
overflow.

Fixes: 0a78f2bac142 ("drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg")
Cc: SDL <sdl@nppct.ru>
Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 3c5367d950140d4ec7af830b2268a5a6fdaa3885)

authored by

Benjamin Cheng and committed by
Alex Deucher 65bce27e e6e9faba

+3 -1
+3 -1
drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
··· 1889 1889 1890 1890 for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) { 1891 1891 uint32_t offset, size, *create; 1892 + uint64_t buf_end; 1892 1893 1893 1894 if (msg[0] != RDECODE_MESSAGE_CREATE) 1894 1895 continue; ··· 1897 1896 offset = msg[1]; 1898 1897 size = msg[2]; 1899 1898 1900 - if (size < 4 || offset + size > end - addr) { 1899 + if (size < 4 || check_add_overflow(offset, size, &buf_end) || 1900 + buf_end > end - addr) { 1901 1901 DRM_ERROR("VCN message buffer exceeds BO bounds!\n"); 1902 1902 r = -EINVAL; 1903 1903 goto out;