From: Birk Skyum <birk.skyum@pm.me>
To: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Cc: Vikash Garodia <vikash.garodia@oss.qualcomm.com>,
Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>,
Abhinav Kumar <abhinav.kumar@linux.dev>,
Bryan O'Donoghue <bod@kernel.org>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Hans Verkuil <hverkuil@kernel.org>,
Stefan Schmidt <stefan.schmidt@linaro.org>,
linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH] media: iris: Fix out-of-bounds read in timestamp metadata fallback
Date: Sat, 17 Oct 2026 14:57:01 +0000 [thread overview]
Message-ID: <179224901845.60580.12634525576974095945@pm.me> (raw)
On Sat, 17 Oct 2026 08:55:04 +0530, Vishnu Reddy wrote:
> If iris_get_ts_metadata() finds no matching timestamp in that window,
> its fallback reads inst->tss[32], one entry past the end of the array.
I hit the same report on a Lenovo Yoga Slim 7x (X1E80100) while playing
video in Chromium, and it reproduces on demand: decoding a 64-frame
H.264 clip with ffmpeg's h264_v4l2m2m triggers it at the end of the
stream, while clips of 30 to 63 frames do not:
UBSAN: array-index-out-of-bounds in drivers/media/platform/qcom/iris/iris_buffer.c:932:26
index 32 is out of range for type 'iris_ts_metadata [32]'
With this patch on 7.2.8, 22 decodes of 30 to 192 frames (64, 96, 128,
160 and 192 among them) gave no report, and the 64- and 96-frame
decodes match a software decode frame for frame, timestamps included.
Tested-by: Birk Skyum <birk.skyum@pm.me> # Lenovo Yoga Slim 7x (X1E80100)
next reply other threads:[~2026-10-17 14:57 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-17 14:57 Birk Skyum [this message]
-- strict thread matches above, loose matches on Subject: below --
2026-10-17 3:25 Vishnu Reddy
2026-11-13 18:17 ` Deepa Guthyappa Madivalara
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=179224901845.60580.12634525576974095945@pm.me \
--to=birk.skyum@pm.me \
--cc=abhinav.kumar@linux.dev \
--cc=bod@kernel.org \
--cc=busanna.reddy@oss.qualcomm.com \
--cc=dikshita.agarwal@oss.qualcomm.com \
--cc=hverkuil@kernel.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=stable@vger.kernel.org \
--cc=stefan.schmidt@linaro.org \
--cc=vikash.garodia@oss.qualcomm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®