drm/amdgpu: Reject UVD message with dimensions above 4096

Fixes potential overflow in DPB size calculations.

Signed-off-by: David Rosca <david.rosca@amd.com>
Acked-by: Leo Liu <leo.liu@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10)
Cc: stable@vger.kernel.org

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index 23383ac5323f0ce0b1d83a3826ecf911e88e72e2..08b199518e22faa445b0103314c6f5a377488486 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -655,8 +655,8 @@ static int amdgpu_uvd_cs_msg_decode(struct amdgpu_device *adev, uint32_t *msg,
        unsigned int image_size, tmp, min_dpb_size, num_dpb_buffer;
        unsigned int min_ctx_size = ~0;
 
-       /* Reject invalid dimensions to prevent division by zero */
-       if (width < 16 || height < 16) {
+       /* Reject invalid dimensions */
+       if (width < 16 || height < 16 || width > 4096 || height > 4096) {
                dev_WARN_ONCE(adev->dev, 1,
                              "Invalid UVD decoding dimensions (%dx%d)!\n",
                              width, height);