DF-1754 / fix.diff
diff --git a/sys/dev/drm/radeon/radeon_vce.c b/sys/dev/drm/radeon/radeon_vce.c --- a/sys/dev/drm/radeon/radeon_vce.c +++ b/sys/dev/drm/radeon/radeon_vce.c @@ -485,6 +485,14 @@ return -EINVAL; } + /* DF-1754: chunk_relocs->length_dw may not be a multiple of 4; + * admit only 4-dword-aligned indices that fit within nrelocs. */ + if ((idx % 4) != 0 || idx / 4 >= p->nrelocs) { + DRM_ERROR("VCE relocs idx %d not aligned / past nrelocs %d!\n", + idx, p->nrelocs); + return -EINVAL; + } + reloc = &p->relocs[(idx / 4)]; start = reloc->gpu_offset; end = start + radeon_bo_size(reloc->robj); |