Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, width_in_mb or height_in_mb becomes 0, leading to fs_in_mb being 0. This causes a division by zero when calculating num_dpb_buffer in H264 and H264 Perf decode paths. Add validation to reject frames with width < 16 or height < 16 before performing any calculations that depend on these values. V2: Format change - move up all vaiable definitions. V3: Use warn_once to avoid spam. (cherry picked from commit 3e41d26c70b0a459d041cc19482a226c4b7423cb)
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < 004d0453cfef16f056cb7b8bc04f69f19cf9df32affectedd38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < 00ee64910ecf748cc15b23bbcbea472c203ec1e8affectedd38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < 81c9b4921f62d1642b9d775524ae9240e521a5edaffectedd38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < 52f9a588296432accf2982f7d258192a37562f4faffectedd38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < a00946b5ab7c25da5685ca9c58f50ff6f43c0fdfaffectedd38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < ffb33d466a68cea3e8a3dbed04d79037a3cbabd1affectedd38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < be725ab23aa45c11a5afef3e2a9f6d8c084ae5dcaffectedd38ceaf99ed015f2a0b9af3499791bd3a3daae21 to < 0c01c811be47e6b146552dd59bfedbea8f09b8f4affected
Linux Linux
Default version status: affected
4.2affected0 to < 4.2unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/004d0453cfef16f056cb7b8bc04f69f19cf9df32 ↗
- https://git.kernel.org/stable/c/00ee64910ecf748cc15b23bbcbea472c203ec1e8 ↗
- https://git.kernel.org/stable/c/81c9b4921f62d1642b9d775524ae9240e521a5ed ↗
- https://git.kernel.org/stable/c/52f9a588296432accf2982f7d258192a37562f4f ↗
- https://git.kernel.org/stable/c/a00946b5ab7c25da5685ca9c58f50ff6f43c0fdf ↗
- https://git.kernel.org/stable/c/ffb33d466a68cea3e8a3dbed04d79037a3cbabd1 ↗
- https://git.kernel.org/stable/c/be725ab23aa45c11a5afef3e2a9f6d8c084ae5dc ↗
- https://git.kernel.org/stable/c/0c01c811be47e6b146552dd59bfedbea8f09b8f4 ↗