From 0436bed3f2b43a51104a037c6ccc052bc8f157de Mon Sep 17 00:00:00 2001 From: David Rosca Date: Tue, 11 Aug 2026 17:03:10 +0800 Subject: [PATCH] drm/amdgpu: Reject UVD message with invalid number of h265 refs ANBZ: #45430 commit 9fca434208f1f9ab977feac62df8ebb1cc7ce893 upstream. commit 1facad2a78c1a8aeecc36eb4d560c7f1e10ce198 stable. Same change as for h264, avoids overflow later when calculating min dpb size. Signed-off-by: David Rosca Reviewed-by: Leo Liu Signed-off-by: Alex Deucher (cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5) Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Fixes: CVE-2026-80909 Assisted-by: PatchPilot Signed-off-by: Xunlei Pang --- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c index 665ead139c30..6f96f078bd3d 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c @@ -707,6 +707,9 @@ static int amdgpu_uvd_cs_msg_decode(struct amdgpu_device *adev, uint32_t *msg, image_size = ALIGN(image_size, 256); num_dpb_buffer = (le32_to_cpu(msg[59]) & 0xff) + 2; + if (num_dpb_buffer > 17) + return -EINVAL; + min_dpb_size = image_size * num_dpb_buffer; min_ctx_size = ((width + 255) / 16) * ((height + 255) / 16) * 16 * num_dpb_buffer + 52 * 1024; -- Gitee