[PATCH] drm/amdgpu: fix division by zero with invalid uvd dimensions
From: Boyuan Zhang
When width or height is less than 16, width_in_mb or height_in_mb
becomes 0, leading to fs_in_mb being 0. This causes a division by
zero when calculating num_dpb_buffer in H264 and H264 Perf decode
paths.
Add validation to reject frames with width < 16 or height < 16
before performing any calculations that depend on these values.
V2: Format change - move up all vaiable definitions.
V3: Use warn_once to avoid spam.
Signed-off-by: Boyuan Zhang
Reviewed-by: Leo Liu
Reviewed-by: Alex Deucher
---
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 8
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index 3a3bc0d370fa..25fcaffb2164 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -635,6 +635,14 @@ static int amdgpu_uvd_cs_msg_decode(struct amdgpu_device
*adev, uint32_t *msg,
unsigned int image_size, tmp, min_dpb_size, num_dpb_buffer;
unsigned int min_ctx_size = ~0;
+ /* Reject invalid dimensions to prevent division by zero */
+ if (width < 16 || height < 16) {
+ dev_WARN_ONCE(adev->dev, 1,
+ "Invalid UVD decoding dimensions (%dx%d)!\n",
+ width, height);
+ return -EINVAL;
+ }
+
image_size = width * height;
image_size += image_size / 2;
image_size = ALIGN(image_size, 1024);
--
2.43.0
Re: [PATCH] drm/amdgpu: fix division by zero with invalid uvd dimensions
On Tue, May 19, 2026 at 1:21 PM wrote:
>
> From: Boyuan Zhang
>
> When width or height is less than 16, width_in_mb or height_in_mb
> becomes 0, leading to fs_in_mb being 0. This causes a division by
> zero when calculating num_dpb_buffer in H264 and H264 Perf decode
> paths.
>
> Add validation to reject frames with width < 16 or height < 16
> before performing any calculations that depend on these values.
>
> V2: Format change - move up all vaiable definitions.
>
> Signed-off-by: Boyuan Zhang
> Reviewed-by: Leo Liu
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 7 +++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
> index 3a3bc0d370fa..707e9d9441ce 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
> @@ -635,6 +635,13 @@ static int amdgpu_uvd_cs_msg_decode(struct amdgpu_device
> *adev, uint32_t *msg,
> unsigned int image_size, tmp, min_dpb_size, num_dpb_buffer;
> unsigned int min_ctx_size = ~0;
>
> + /* Reject invalid dimensions to prevent division by zero */
> + if (width < 16 || height < 16) {
> + DRM_ERROR("Invalid UVD decoding dimensions (%dx%d)!\n",
> + width, height);
I'd drop the message or make it warn_once. Otherwise you can spam the
log. With that fixed:
Reviewed-by: Alex Deucher
Alex
> + return -EINVAL;
> + }
> +
> image_size = width * height;
> image_size += image_size / 2;
> image_size = ALIGN(image_size, 1024);
> --
> 2.43.0
>
[PATCH] drm/amdgpu: fix division by zero with invalid uvd dimensions
From: Boyuan Zhang
When width or height is less than 16, width_in_mb or height_in_mb
becomes 0, leading to fs_in_mb being 0. This causes a division by
zero when calculating num_dpb_buffer in H264 and H264 Perf decode
paths.
Add validation to reject frames with width < 16 or height < 16
before performing any calculations that depend on these values.
V2: Format change - move up all vaiable definitions.
Signed-off-by: Boyuan Zhang
Reviewed-by: Leo Liu
---
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 7 +++
1 file changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index 3a3bc0d370fa..707e9d9441ce 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -635,6 +635,13 @@ static int amdgpu_uvd_cs_msg_decode(struct amdgpu_device
*adev, uint32_t *msg,
unsigned int image_size, tmp, min_dpb_size, num_dpb_buffer;
unsigned int min_ctx_size = ~0;
+ /* Reject invalid dimensions to prevent division by zero */
+ if (width < 16 || height < 16) {
+ DRM_ERROR("Invalid UVD decoding dimensions (%dx%d)!\n",
+ width, height);
+ return -EINVAL;
+ }
+
image_size = width * height;
image_size += image_size / 2;
image_size = ALIGN(image_size, 1024);
--
2.43.0
RE: [PATCH] drm/amdgpu: fix division by zero with invalid uvd dimensions
AMD General > -Original Message- > From: Zhang, Boyuan > Sent: May 12, 2026 10:58 AM > To: [email protected] > Cc: Liu, Leo ; Deucher, Alexander > ; Zhang, Boyuan > > Subject: [PATCH] drm/amdgpu: fix division by zero with invalid uvd > dimensions > > From: Boyuan Zhang > > When width or height is less than 16, width_in_mb or height_in_mb > becomes 0, leading to fs_in_mb being 0. This causes a division by > zero when calculating num_dpb_buffer in H264 and H264 Perf decode > paths. > > Add validation to reject frames with width < 16 or height < 16 > before performing any calculations that depend on these values. > > Signed-off-by: Boyuan Zhang > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 13 ++--- > 1 file changed, 10 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c > index 3a3bc0d370fa..0cf0f53e5066 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c > @@ -628,13 +628,20 @@ static int amdgpu_uvd_cs_msg_decode(struct > amdgpu_device *adev, uint32_t *msg, > unsigned int pitch = msg[28]; > unsigned int level = msg[57]; > > + unsigned int image_size, tmp, min_dpb_size, num_dpb_buffer; > + unsigned int min_ctx_size = ~0; > + > + /* Reject invalid dimensions to prevent division by zero */ > + if (width < 16 || height < 16) { > + DRM_ERROR("Invalid UVD decoding dimensions > (%dx%d)!\n", > + width, height); > + return -EINVAL; > + } > + May be we can move up the variable definition below with the rest definition there. With that: Reviewed-by: Leo Liu > unsigned int width_in_mb = width / 16; > unsigned int height_in_mb = ALIGN(height / 16, 2); > unsigned int fs_in_mb = width_in_mb * height_in_mb; > > - unsigned int image_size, tmp, min_dpb_size, num_dpb_buffer; > - unsigned int min_ctx_size = ~0; > - > image_size = width * height; > image_size += image_size / 2; > image_size = ALIGN(image_size, 1024); > -- > 2.43.0
[PATCH] drm/amdgpu: fix division by zero with invalid uvd dimensions
From: Boyuan Zhang
When width or height is less than 16, width_in_mb or height_in_mb
becomes 0, leading to fs_in_mb being 0. This causes a division by
zero when calculating num_dpb_buffer in H264 and H264 Perf decode
paths.
Add validation to reject frames with width < 16 or height < 16
before performing any calculations that depend on these values.
Signed-off-by: Boyuan Zhang
---
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 13 ++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index 3a3bc0d370fa..0cf0f53e5066 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -628,13 +628,20 @@ static int amdgpu_uvd_cs_msg_decode(struct amdgpu_device
*adev, uint32_t *msg,
unsigned int pitch = msg[28];
unsigned int level = msg[57];
+ unsigned int image_size, tmp, min_dpb_size, num_dpb_buffer;
+ unsigned int min_ctx_size = ~0;
+
+ /* Reject invalid dimensions to prevent division by zero */
+ if (width < 16 || height < 16) {
+ DRM_ERROR("Invalid UVD decoding dimensions (%dx%d)!\n",
+ width, height);
+ return -EINVAL;
+ }
+
unsigned int width_in_mb = width / 16;
unsigned int height_in_mb = ALIGN(height / 16, 2);
unsigned int fs_in_mb = width_in_mb * height_in_mb;
- unsigned int image_size, tmp, min_dpb_size, num_dpb_buffer;
- unsigned int min_ctx_size = ~0;
-
image_size = width * height;
image_size += image_size / 2;
image_size = ALIGN(image_size, 1024);
--
2.43.0
