[PATCH v3] drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

[PATCH v3] drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

[David (Ming Qiang) Wu]

if supplied msg[2] in the header is too large, 4 times
of this unsigned 32 bit value will overflow and the test could pass.

v3: Using two-helper form is heavier than needed.
    Since len_dw is a plain u32, a division-based test is
    overflow-free by construction.

Fixes: b193019860d6 ("drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg")
Fixes: 0a78f2bac142 ("drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg")

Signed-off-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
Cc: stable@vger.kernel.org
---
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 8 ++++++--
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
index 81bba3ec2a93..686f5f758cb1 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
@@ -1964,8 +1964,12 @@ static int vcn_v3_0_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job,
 	len_dw = msg[1] / 4;
 	num_buffers = msg[2];
 
-	/* Verify that all indices fit within the claimed length. Each index is 4 DWORDs */
-	if (num_buffers > len_dw || 6 + num_buffers * 4 > len_dw) {
+	/* Verify that all indices fit within the claimed length.
+	 * There are 6 dwords in the header before the first buffer.
+	 * Each buffer has 4 dwords. Extra dwords will be ignored
+	 * at the end of the last buffer.
+	 */
+	if (len_dw < 6 || num_buffers > (len_dw - 6) / 4) {
 		DRM_ERROR("VCN message has too many buffers!\n");
 		r = -EINVAL;
 		goto out;
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
index 0cce78b205a8..6f0a51c436db 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
@@ -1880,8 +1880,12 @@ static int vcn_v4_0_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job,
 	len_dw = msg[1] / 4;
 	num_buffers = msg[2];
 
-	/* Verify that all indices fit within the claimed length. Each index is 4 DWORDs */
-	if (num_buffers > len_dw || 6 + num_buffers * 4 > len_dw) {
+	/* Verify that all indices fit within the claimed length.
+	 * There are 6 dwords in the header before the first buffer.
+	 * Each buffer has 4 dwords. Extra dwords will be ignored
+	 * at the end of the last buffer.
+	 */
+	if (len_dw < 6 || num_buffers > (len_dw - 6) / 4) {
 		DRM_ERROR("VCN message has too many buffers!\n");
 		r = -EINVAL;
 		goto out;
-- 
2.43.0

RE: [PATCH v3] drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

[Liu, Leo]

AMD General

Reviewed-by: Leo Liu <leo.liu@amd.com>


> -----Original Message-----
> From: Wu, David <David.Wu3@amd.com>
> Sent: Tuesday, August 11, 2026 1:07 PM
> To: amd-gfx@lists.freedesktop.org; Deucher, Alexander
> <Alexander.Deucher@amd.com>
> Cc: Liu, Leo <Leo.Liu@amd.com>; stable@vger.kernel.org
> Subject: [PATCH v3] drm/amdgpu/vcn: fix integer overflow in dec_msg buffer
> count check
>
> if supplied msg[2] in the header is too large, 4 times of this unsigned 32 bit value
> will overflow and the test could pass.
>
> v3: Using two-helper form is heavier than needed.
>     Since len_dw is a plain u32, a division-based test is
>     overflow-free by construction.
>
> Fixes: b193019860d6 ("drm/amdgpu/vcn3: Prevent OOB reads when parsing dec
> msg")
> Fixes: 0a78f2bac142 ("drm/amdgpu/vcn4: Prevent OOB reads when parsing dec
> msg")
>
> Signed-off-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
> Cc: stable@vger.kernel.org
> ---
>  drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 8 ++++++--
> drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 8 ++++++--
>  2 files changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
> b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
> index 81bba3ec2a93..686f5f758cb1 100644
> --- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
> +++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
> @@ -1964,8 +1964,12 @@ static int vcn_v3_0_dec_msg(struct
> amdgpu_cs_parser *p, struct amdgpu_job *job,
>       len_dw = msg[1] / 4;
>       num_buffers = msg[2];
>
> -     /* Verify that all indices fit within the claimed length. Each index is 4
> DWORDs */
> -     if (num_buffers > len_dw || 6 + num_buffers * 4 > len_dw) {
> +     /* Verify that all indices fit within the claimed length.
> +      * There are 6 dwords in the header before the first buffer.
> +      * Each buffer has 4 dwords. Extra dwords will be ignored
> +      * at the end of the last buffer.
> +      */
> +     if (len_dw < 6 || num_buffers > (len_dw - 6) / 4) {
>               DRM_ERROR("VCN message has too many buffers!\n");
>               r = -EINVAL;
>               goto out;
> diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
> b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
> index 0cce78b205a8..6f0a51c436db 100644
> --- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
> +++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
> @@ -1880,8 +1880,12 @@ static int vcn_v4_0_dec_msg(struct
> amdgpu_cs_parser *p, struct amdgpu_job *job,
>       len_dw = msg[1] / 4;
>       num_buffers = msg[2];
>
> -     /* Verify that all indices fit within the claimed length. Each index is 4
> DWORDs */
> -     if (num_buffers > len_dw || 6 + num_buffers * 4 > len_dw) {
> +     /* Verify that all indices fit within the claimed length.
> +      * There are 6 dwords in the header before the first buffer.
> +      * Each buffer has 4 dwords. Extra dwords will be ignored
> +      * at the end of the last buffer.
> +      */
> +     if (len_dw < 6 || num_buffers > (len_dw - 6) / 4) {
>               DRM_ERROR("VCN message has too many buffers!\n");
>               r = -EINVAL;
>               goto out;
> --
> 2.43.0