mirror of
https://github.com/torvalds/linux.git
synced 2026-10-16 04:39:02 +02:00
367db8b23c
rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group entry
array by tile1 * tile_cols + tile0, reading up to tile_cols * tile_rows
entries, lays out one descriptor per tile in the AV1_MAX_TILES tile_info
buffer, and programs the real tile_cols / tile_rows into the hardware.
The tile group entry control is a dynamic array sized to the number of
entries userspace submitted, independent of tile_cols / tile_rows, so a
frame that claims more tiles than entries reads past the array. A frame
that claims more than AV1_MAX_TILES tiles also leaves the hardware
programmed for more tiles than the descriptor buffer holds.
Reject both in prepare_run(): tile_cols * tile_rows must not exceed the
submitted entry count or AV1_MAX_TILES. The entry count is read via
v4l2_ctrl_find() (ctrl->elems). This mirrors the bound the mediatek AV1
decoder already enforces.
Fixes:
|
||
|---|---|---|
| .. | ||
| hantro_drv.c | ||
| hantro_g1_h264_dec.c | ||
| hantro_g1_mpeg2_dec.c | ||
| hantro_g1_regs.h | ||
| hantro_g1_vp8_dec.c | ||
| hantro_g1.c | ||
| hantro_g2_hevc_dec.c | ||
| hantro_g2_regs.h | ||
| hantro_g2_vp9_dec.c | ||
| hantro_g2.c | ||
| hantro_h1_jpeg_enc.c | ||
| hantro_h1_regs.h | ||
| hantro_h264.c | ||
| hantro_hevc.c | ||
| hantro_hw.h | ||
| hantro_jpeg.c | ||
| hantro_jpeg.h | ||
| hantro_mpeg2.c | ||
| hantro_postproc.c | ||
| hantro_v4l2.c | ||
| hantro_v4l2.h | ||
| hantro_vp8.c | ||
| hantro_vp9.c | ||
| hantro_vp9.h | ||
| hantro.h | ||
| imx8m_vpu_hw.c | ||
| Kconfig | ||
| Makefile | ||
| rockchip_av1_entropymode.c | ||
| rockchip_av1_entropymode.h | ||
| rockchip_av1_filmgrain.c | ||
| rockchip_av1_filmgrain.h | ||
| rockchip_vpu_hw.c | ||
| rockchip_vpu2_hw_h264_dec.c | ||
| rockchip_vpu2_hw_jpeg_enc.c | ||
| rockchip_vpu2_hw_mpeg2_dec.c | ||
| rockchip_vpu2_hw_vp8_dec.c | ||
| rockchip_vpu2_regs.h | ||
| rockchip_vpu981_hw_av1_dec.c | ||
| rockchip_vpu981_regs.h | ||
| sama5d4_vdec_hw.c | ||
| stm32mp25_vpu_hw.c | ||
| sunxi_vpu_hw.c | ||