github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity

Browse Source 
rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group entry
array by tile1 * tile_cols + tile0, reading up to tile_cols * tile_rows
entries, lays out one descriptor per tile in the AV1_MAX_TILES tile_info
buffer, and programs the real tile_cols / tile_rows into the hardware.

The tile group entry control is a dynamic array sized to the number of
entries userspace submitted, independent of tile_cols / tile_rows, so a
frame that claims more tiles than entries reads past the array. A frame
that claims more than AV1_MAX_TILES tiles also leaves the hardware
programmed for more tiles than the descriptor buffer holds.

Reject both in prepare_run(): tile_cols * tile_rows must not exceed the
submitted entry count or AV1_MAX_TILES. The entry count is read via
v4l2_ctrl_find() (ctrl->elems). This mirrors the bound the mediatek AV1
decoder already enforces.

Fixes: 727a400686 ("media: verisilicon: Add Rockchip AV1 decoder")
Assisted-by: Claude:claude-opus-4-8
Cc: stable@vger.kernel.org
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
This commit is contained in:
Michael Bommarito 2026-06-16 22:19:04 -04:00 committed by Hans Verkuil
parent b84f6533a8
commit 367db8b23c
1 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
View File

@ -431,20 +431,39 @@ static int rockchip_vpu981_av1_dec_prepare_run(struct hantro_ctx *ctx)
{
struct hantro_av1_dec_hw_ctx *av1_dec = &ctx->av1_dec;
struct hantro_av1_dec_ctrls *ctrls = &av1_dec->ctrls;
const struct v4l2_av1_tile_info *tile_info;
struct v4l2_ctrl *tge;
u32 num_tiles;
ctrls->sequence = hantro_get_ctrl(ctx, V4L2_CID_STATELESS_AV1_SEQUENCE);
if (WARN_ON(!ctrls->sequence))
return -EINVAL;
ctrls->tile_group_entry =
hantro_get_ctrl(ctx, V4L2_CID_STATELESS_AV1_TILE_GROUP_ENTRY);
if (WARN_ON(!ctrls->tile_group_entry))
tge = v4l2_ctrl_find(&ctx->ctrl_handler,
V4L2_CID_STATELESS_AV1_TILE_GROUP_ENTRY);
if (WARN_ON(!tge))
return -EINVAL;
ctrls->tile_group_entry = tge->p_cur.p;
ctrls->frame = hantro_get_ctrl(ctx, V4L2_CID_STATELESS_AV1_FRAME);
if (WARN_ON(!ctrls->frame))
return -EINVAL;
/*
* rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group
* entry array by tile1 * tile_cols + tile0, so it reads up to
* tile_cols * tile_rows entries, and lays out one descriptor per tile
* in the AV1_MAX_TILES tile_info buffer while programming the real
* tile geometry into the hardware. Reject a frame that claims more
* tiles than userspace submitted, or more than the hardware tile
* buffer holds, so the read stays in bounds and the programmed
* geometry matches the descriptors written.
*/
tile_info = &ctrls->frame->tile_info;
num_tiles = (u32)tile_info->tile_cols * tile_info->tile_rows;
if (num_tiles > tge->elems || num_tiles > AV1_MAX_TILES)
return -EINVAL;
ctrls->film_grain =
hantro_get_ctrl(ctx, V4L2_CID_STATELESS_AV1_FILM_GRAIN);