Benjamin Cheng 65bce27ea6 drm/amdgpu/vcn4: Avoid overflow on msg bound check ...

As pointed out by SDL, the previous condition may be vulnerable to
overflow.

Fixes: 0a78f2bac1 ("drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg")
Cc: SDL <sdl@nppct.ru>
Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 3c5367d950140d4ec7af830b2268a5a6fdaa3885)

2026-04-28 15:51:18 -04:00

..

accel

Merge tag 'drm-misc-next-fixes-2026-04-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-04-10 11:15:22 +10:00

accessibility

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

acpi

Merge tag 'riscv-for-linus-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux

2026-04-05 14:43:47 -07:00

amba

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

android

rust_binder: use AssertSync for BINDER_VM_OPS

2026-03-31 14:58:56 +02:00

ata

ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in()

2026-03-20 09:59:30 +01:00

atm

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

auxdisplay

auxdisplay: line-display: fix NULL dereference in linedisp_release

2026-03-27 09:54:31 +01:00

base

mm: add gpu active/reclaim per-node stat counters (v2)

2026-04-08 06:52:47 +10:00

bcma

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

block

zram: do not slot_free() written-back slots

2026-03-21 17:36:33 -07:00

bluetooth

Bluetooth: hci_h4: Fix race during initialization

2026-04-01 16:45:47 -04:00

bus

driver core: platform: use generic driver_override infrastructure

2026-03-17 20:30:57 +01:00

cache

cache: ax45mp: Fix device node reference leak in ax45mp_cache_init()

2026-02-06 19:54:40 +00:00

cdrom

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

cdx

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

char

Merge tag 'for-linus-7.0-1' of https://github.com/cminyard/linux-ipmi

2026-02-26 14:34:21 -08:00

clk

driver core: platform: use generic driver_override infrastructure

2026-03-17 20:30:57 +01:00

clocksource

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

comedi

comedi: dt2815: add hardware detection to prevent crash

2026-04-02 14:40:27 +02:00

connector

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

counter

counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member

2026-03-22 15:59:22 +09:00

cpufreq

cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path

2026-04-01 16:08:15 +02:00

cpuidle

sched: idle: Make skipping governor callbacks more consistent

2026-03-10 16:03:02 +01:00

crypto

Merge tag 'v7.0-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

2026-04-02 17:29:48 -07:00

cxl

cxl: Adjust the startup priority of cxl_pmem to be higher than that of cxl_acpi

2026-03-19 15:12:40 -07:00

dax

Convert 'alloc_flex' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

dca

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

devfreq

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

dibs

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

dio

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

dma

dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA

2026-03-17 16:33:32 +05:30

dma-buf

dma-buf: fix htmldocs error for dma_buf_attach_revocable

2026-04-10 19:22:02 +05:30

dpll

Merge tag 'net-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-02-26 08:00:13 -08:00

edac

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

eisa

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

extcon

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

firewire

bonding: prevent potential infinite loop in bond_header_parse()

2026-03-16 19:29:45 -07:00

firmware

BackMerge tag 'v7.0-rc6' into drm-next

2026-03-31 07:51:02 +10:00

fpga

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

fsi

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

fwctl

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

gnss

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

gpib

gpib: fix use-after-free in IO ioctl handlers

2026-04-02 14:30:40 +02:00

gpio

gpio: shared: shorten the critical section in gpiochip_setup_shared()

2026-03-30 09:51:15 +02:00

gpu

drm/amdgpu/vcn4: Avoid overflow on msg bound check

2026-04-28 15:51:18 -04:00

greybus

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

hid

Merge tag 'hid-for-linus-2026031701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

2026-03-17 13:55:51 -07:00

hsi

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hte

Convert 'alloc_flex' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hv

mshv: Fix error handling in mshv_region_pin

2026-03-18 16:18:49 +00:00

hwmon

hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI

2026-04-01 07:45:57 -07:00

hwspinlock

Merge tag 'soc-drivers-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

2026-02-10 20:45:30 -08:00

hwtracing

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

i2c

i2c: designware: amdisp: Fix resume-probe race condition issue

2026-03-27 13:51:21 +01:00

i3c

i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach

2026-03-11 22:50:29 +01:00

idle

intel_idle: Add C-states validation

2026-01-07 21:17:43 +01:00

iio

Merge tag 'iio-fixes-for-7.0c' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus

2026-03-29 15:27:12 +02:00

infiniband

BackMerge tag 'v7.0-rc6' into drm-next

2026-03-31 07:51:02 +10:00

input

Merge tag 'input-for-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2026-04-04 08:24:32 -07:00

interconnect

interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes()

2026-03-14 12:53:13 +02:00

iommu

Merge v7.0-rc7 into drm-next

2026-04-07 12:36:31 +02:00

ipack

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

irqchip

irqchip/riscv-aplic: Restrict genpd notifier to device tree only

2026-03-31 10:11:29 +02:00

isdn

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

leds

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

macintosh

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

mailbox

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

mcb

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

md

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

media

media: ccs: Avoid deadlock in ccs_init_state()

2026-03-26 13:14:07 +01:00

memory

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

memstick

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

message

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

mfd

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

misc

misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe

2026-04-02 14:42:19 +02:00

mmc

mmc: sdhci: fix timing selection for 1-bit bus width

2026-03-16 16:08:54 +01:00

most

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

mtd

mtd: rawnand: pl353: make sure optimal timings are applied

2026-03-18 18:08:25 +01:00

mux

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

net

eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64

2026-04-02 08:38:34 -07:00

nfc

NFC: pn533: bound the UART receive buffer

2026-03-31 11:04:30 +02:00

ntb

Merge tag 'kmalloc_obj-treewide-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2026-02-21 11:02:58 -08:00

nubus

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

nvdimm

nvdimm/bus: Fix potential use after free in asynchronous initialization

2026-03-09 09:38:22 -05:00

nvme

Merge tag 'block-7.0-20260312' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

2026-03-13 10:13:06 -07:00

nvmem

nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy

2026-04-02 16:44:40 +02:00

of

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

opp

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

parisc

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

parport

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

pci

PCI/pwrctrl: Fix pci_pwrctrl_is_required() device node leak

2026-03-23 15:57:43 -05:00

pcmcia

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

peci

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

perf

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

phy

phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4

2026-02-27 20:46:57 +05:30

pinctrl

pinctrl: sunxi: fix gpiochip_lock_as_irq() failure when pinmux is unknown

2026-03-23 14:23:09 +01:00

platform

platform/x86: ISST: Correct locked bit width

2026-03-24 12:31:10 +02:00

pmdomain

Merge tag 'pmdomain-v7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm

2026-03-20 09:46:15 -07:00

pnp

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

power

power: sequencing: pcie-m2: Fix device node reference leak in probe

2026-03-04 09:16:41 +01:00

powercap

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

pps

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ps3

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ptp

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

pwm

Convert 'alloc_flex' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

rapidio

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ras

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

regulator

regulator: pca9450: Correct probed name for PCA9452

2026-03-10 14:52:42 +00:00

remoteproc

remoteproc: imx_rproc: Fix unreachable platform prepare_ops

2026-03-05 10:18:23 -07:00

resctrl

arm_mpam: Force __iomem casts

2026-03-13 14:17:30 +00:00

reset

reset: rzg2l-usbphy-ctrl: Check pwrrdy is valid before using it

2026-02-23 17:03:28 +01:00

rpmsg

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

rtc

Merge tag 'rtc-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux

2026-02-22 09:43:11 -08:00

s390

Merge tag 's390-7.0-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

2026-04-03 17:50:24 -07:00

sbus

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

scsi

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2026-03-27 19:58:22 -07:00

sh

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

siox

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

slimbus

driver core: platform: use generic driver_override infrastructure

2026-03-17 20:30:57 +01:00

soc

Merge tag 'v7.0-rockchip-drvfixes1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes

2026-03-17 09:35:40 +01:00

soundwire

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

spi

spi: cadence-qspi: Fix exec_mem_op error handling

2026-03-30 21:34:53 +01:00

spmi

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ssb

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

staging

staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie

2026-02-24 10:01:20 -08:00

target

scsi: target: file: Use kzalloc_flex for aio_cmd

2026-03-19 22:07:39 -04:00

tc

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

tee

tee: shm: Remove refcounting of kernel pages

2026-03-03 09:03:04 +01:00

thermal

thermal: core: Fix thermal zone device registration error path

2026-04-02 11:37:35 +02:00

thunderbolt

thunderbolt: Fix property read in nhi_wake_supported()

2026-03-09 12:36:54 +01:00

tty

vt: resize saved unicode buffer on alt screen exit after resize

2026-03-30 17:39:44 +02:00

ufs

scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend

2026-03-07 11:08:39 -05:00

uio

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

usb

Merge tag 'usb-serial-7.0-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

2026-04-02 13:28:22 +02:00

vdpa

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

vfio

BackMerge tag 'v7.0-rc6' into drm-next

2026-03-31 07:51:02 +10:00

vhost

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

video

Merge v7.0-rc3 into drm-next

2026-03-11 11:18:31 +01:00

virt

virt: tdx-guest: Fix handling of host controlled 'quote' buffer length

2026-03-20 21:05:50 -07:00

virtio

dma-mapping: Clarify valid conditions for CPU cache line overlap

2026-03-20 11:33:24 +01:00

w1

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

watchdog

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

xen

xen/privcmd: unregister xenstore notifier on module exit

2026-03-26 08:57:51 +01:00

zorro

Convert 'alloc_flex' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

Kconfig

…

Makefile

phy: enter drivers/phy/Makefile even without CONFIG_GENERIC_PHY

2026-02-04 20:45:26 +05:30