drm/amdgpu: Reject UVD message with invalid number of h265 refs

Same change as for h264, avoids overflow later when calculating
min dpb size.

Signed-off-by: David Rosca <david.rosca@amd.com>
Reviewed-by: Leo Liu <leo.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)
Cc: stable@vger.kernel.org

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index 7560bee895079c1f6f341cc37a35ff1cc4cd1daa..de3dbc95e376ca8c81bcd9977967399f782629c1 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -749,6 +749,9 @@ static int amdgpu_uvd_cs_msg_decode(struct amdgpu_device *adev, uint32_t *msg,
                image_size = ALIGN(image_size, 256);
 
                num_dpb_buffer = (le32_to_cpu(msg[59]) & 0xff) + 2;
+               if (num_dpb_buffer > 17)
+                       return -EINVAL;
+
                min_dpb_size = image_size * num_dpb_buffer;
                min_ctx_size = ((width + 255) / 16) * ((height + 255) / 16)
                                           * 16 * num_dpb_buffer + 52 * 1024;