On Tue Jun 16 22:19:04 2026 -0400, Michael Bommarito wrote:
> rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group entry
> array by tile1 * tile_cols + tile0, reading up to tile_cols * tile_rows
> entries, lays out one descriptor per tile in the AV1_MAX_TILES tile_info
> buffer, and programs the real tile_cols / tile_rows into the hardware.
>
> The tile group entry control is a dynamic array sized to the number of
> entries userspace submitted, independent of tile_cols / tile_rows, so a
> frame that claims more tiles than entries reads past the array. A frame
> that claims more than AV1_MAX_TILES tiles also leaves the hardware
> programmed for more tiles than the descriptor buffer holds.
>
> Reject both in prepare_run(): tile_cols * tile_rows must not exceed the
> submitted entry count or AV1_MAX_TILES. The entry count is read via
> v4l2_ctrl_find() (ctrl->elems). This mirrors the bound the mediatek AV1
> decoder already enforces.
>
> Fixes: 727a400686a2 ("media: verisilicon: Add Rockchip AV1 decoder")
> Assisted-by: Claude:claude-opus-4-8
> Cc: [email protected]
> Signed-off-by: Michael Bommarito <[email protected]>
> Reviewed-by: Benjamin Gaignard <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
.../verisilicon/rockchip_vpu981_hw_av1_dec.c | 25 +++++++++++++++++++---
1 file changed, 22 insertions(+), 3 deletions(-)
---
diff --git a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
index fd00dbd79fe4..00aa566a4ccd 100644
--- a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
@@ -431,20 +431,39 @@ static int rockchip_vpu981_av1_dec_prepare_run(struct
hantro_ctx *ctx)
{
struct hantro_av1_dec_hw_ctx *av1_dec = &ctx->av1_dec;
struct hantro_av1_dec_ctrls *ctrls = &av1_dec->ctrls;
+ const struct v4l2_av1_tile_info *tile_info;
+ struct v4l2_ctrl *tge;
+ u32 num_tiles;
ctrls->sequence = hantro_get_ctrl(ctx, V4L2_CID_STATELESS_AV1_SEQUENCE);
if (WARN_ON(!ctrls->sequence))
return -EINVAL;
- ctrls->tile_group_entry =
- hantro_get_ctrl(ctx, V4L2_CID_STATELESS_AV1_TILE_GROUP_ENTRY);
- if (WARN_ON(!ctrls->tile_group_entry))
+ tge = v4l2_ctrl_find(&ctx->ctrl_handler,
+ V4L2_CID_STATELESS_AV1_TILE_GROUP_ENTRY);
+ if (WARN_ON(!tge))
return -EINVAL;
+ ctrls->tile_group_entry = tge->p_cur.p;
ctrls->frame = hantro_get_ctrl(ctx, V4L2_CID_STATELESS_AV1_FRAME);
if (WARN_ON(!ctrls->frame))
return -EINVAL;
+ /*
+ * rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group
+ * entry array by tile1 * tile_cols + tile0, so it reads up to
+ * tile_cols * tile_rows entries, and lays out one descriptor per tile
+ * in the AV1_MAX_TILES tile_info buffer while programming the real
+ * tile geometry into the hardware. Reject a frame that claims more
+ * tiles than userspace submitted, or more than the hardware tile
+ * buffer holds, so the read stays in bounds and the programmed
+ * geometry matches the descriptors written.
+ */
+ tile_info = &ctrls->frame->tile_info;
+ num_tiles = (u32)tile_info->tile_cols * tile_info->tile_rows;
+ if (num_tiles > tge->elems || num_tiles > AV1_MAX_TILES)
+ return -EINVAL;
+
ctrls->film_grain =
hantro_get_ctrl(ctx, V4L2_CID_STATELESS_AV1_FILM_GRAIN);
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
