drm/amdgpu: Fix UVD decode image min size calculation

This needs to use pitch instead of width. Also reject pitch
over 4096 to avoid overflow.

Signed-off-by: David Rosca <david.rosca@amd.com>
Acked-by: Leo Liu <leo.liu@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)
Cc: stable@vger.kernel.org

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index c29554e75e770ae0b0a0a958e65610d55004c8c9..004a95d63b0949236b3eef8ba847d3061ed4987b 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -759,7 +759,7 @@ static int amdgpu_uvd_cs_msg_decode(struct amdgpu_device *adev, uint32_t *msg,
                return -EINVAL;
        }
 
-       if (width > pitch) {
+       if (width > pitch || pitch > 4096) {
                DRM_ERROR("Invalid UVD decoding target pitch!\n");
                return -EINVAL;
        }
@@ -771,7 +771,7 @@ static int amdgpu_uvd_cs_msg_decode(struct amdgpu_device *adev, uint32_t *msg,
        }
 
        buf_sizes[0x1] = dpb_size;
-       buf_sizes[0x2] = image_size;
+       buf_sizes[0x2] = (pitch * height) * 3 / 2;
        buf_sizes[0x4] = min_ctx_size;
        /* store image width to adjust nb memory pstate */
        adev->uvd.decode_image_width = width;