From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f173.google.com (mail-qk1-f173.google.com [209.85.222.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4AD923B19A6 for ; Wed, 27 May 2026 19:48:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779911298; cv=none; b=fTLXsyUTEXJCKuAy1zy8Z9u63Pc8ncSIUXQhS+P5r6EJOvg9EuQqe0z+Qz0E2R4Z1UCYXPkBrecq+mNHXOG6Y7IqehHUtoTBti6nIg+qcOXWv5v7TUO6LGvnjbIS2FmdcMNYDfGYw/VtMPbsCPpEFqbdm6vcuqv1tALqlatZHUc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779911298; c=relaxed/simple; bh=y+E8ZzupUHLf3gc/wNrJPKcphCNANPEiF+VWr/qbaf4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uLseq7wY2s1gWBzKR3u293KueVSCd29c2gQxYZ4WvXfh8iO8guxUTOLmUllvK0A5ngOTNu9pQ56nvSeQRFx9d8GmClobCr9Nk0RGpUaHunCazcLH31UTKcMbI0BU/9huRhtnQ9ZhziEEDB7+g8ZCwxybB4bBYKAFe9pa3jN35VE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BjAug6No; arc=none smtp.client-ip=209.85.222.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BjAug6No" Received: by mail-qk1-f173.google.com with SMTP id af79cd13be357-912475287a5so1338194485a.2 for ; Wed, 27 May 2026 12:48:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779911296; x=1780516096; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=R8mDciBpPj7QyAvnzZsu2M6LtyDI2HbLOpEqsNC58XE=; b=BjAug6NozGbX9p5nbs4G+DAgooiNz5PRAhLl37xzA5AgY5p2OLulpzCrcIfbTnbo// 7o2jRjxP9QwDh6s2vyir6uoLVq3s1MGG+YwGBIlVsJd6Jv8rUaa53lDtn98rzMVfNFVR grjy/ineC4NHaNzGwu4xF8GG+RbBkvzE4Swde3gyEqVaOkSHKJKt0LkquEc+3zVOPRX5 EeFrUjTMDQNEdo3yRbTxbLgVP7yTMg32z9khvHRITpBt93lZ6QtkCyHEj/XWAP2VzffA hkSmYm5v327p3XfOVorRVKF2GD9qcU726co9I9ipxLxKHQlPONxKXKDR0I8VU9PZludG FUxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779911296; x=1780516096; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=R8mDciBpPj7QyAvnzZsu2M6LtyDI2HbLOpEqsNC58XE=; b=jDpZGYnSJ7a9/8RBx/yOC7hS/IxJUCcWSQsNMuVNJk8qYC0Z5LnmI7lwR60KZO+m3F VGva7xMR0DL83NPc8MlJql9AUCX+Janl9QW5+7jSdBjGB+JrBUeYItdaT4ulFLs9ii+9 Tm4Npnjh+Nqi258tdtgh0N0bGA4VWnus/sIziwBn0OuQ+oH/qf/LhSFpVfcIY99rStNe ku9QKg9hM5ng8rBBxleDA2dBG4Jy/KFa87FCpk27BhNuyHWSC1uv+I2EDaks7GiJyp6m QJRUc/hlVZch3d9pqIlJ5bWSu4W+b6nBvIqbe54BK5LILqpP9T8o/cOknprOoSoEGxIW L1SA== X-Forwarded-Encrypted: i=1; AFNElJ/t+h7FNd68tuSGoA2k7WMFV6F+6YkLDIB6NLxgZyEWgljFCuMLw5zld2uSuY7+WryC05rNUfpjEQ4a208=@vger.kernel.org X-Gm-Message-State: AOJu0YxiITWOKe5LqlxpthdJP0dTixcJsLf83vo6UcOilhPEEUQ4rSBy TDlGmt21SYBId/fmcTPKo3NJ2qMt8+f7irAu/TvT4cG0byuYsGPcCFm5 X-Gm-Gg: Acq92OEzDi7+HoYnQH+7oibzTl8+vf30Wmhy0FhfnJDHYCghEV75QJTHLWvDJqlkYHD dgTGG4QUyGX5ul3zJp+r8K398Rji9HDsQR56iWoZWr/n5KPaWhQSM700TNE7wbNe2oBhRiRo+pb L15ZQONb7hbzz/0VuuyvYrd2W54EBuxGBJxohS6nc9+P6HlTGC5dHa+knLXTJa9tY2Jvi17cj6R Bi29F7Hhp5cRBZEGnKlZszQqxn69zkGBXVoj6kSf1U+Fhy2TPBtFlZXoefoe7d15rDWnHDIbD2o 4jGJ/mWP/whJ+/gPrcAsTr8wFHzc7KBi+3bLLlXdUBPW4gcIO6SuhDtK57vTbLGitZAoZ5xVfsV OLGFRCsx+0GDA5KPg286aQpmbwoS5xd/aDBbKTNyZiKuvV0+NgLVpffhJeZsNXiqxHfZk4fyZAU n2Shj9n8DnLsV+B0NAX7mz1KgGnHSdJCXDJA5Jj4QTXIv7ai70jHuflVn70sufX7e7xSjPkcuS0 Lz6BfTBpKHmpB3Atvu3imhBf+WpfX6BYVMs0BPieSBQ3nbNegd53A== X-Received: by 2002:a05:620a:1b81:b0:912:1:b415 with SMTP id af79cd13be357-914b4934c9dmr3420082985a.26.1779911295913; Wed, 27 May 2026 12:48:15 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-914f87017a0sm564942385a.15.2026.05.27.12.48.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 27 May 2026 12:48:15 -0700 (PDT) From: Michael Bommarito To: Detlev Casanova , Ezequiel Garcia , Mauro Carvalho Chehab Cc: Hans Verkuil , Nicolas Dufresne , Heiko Stuebner , linux-media@vger.kernel.org, linux-rockchip@lists.infradead.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 0/3] media: rkvdec: hevc: bound EXT SPS RPS control counts Date: Wed, 27 May 2026 15:47:34 -0400 Message-ID: <20260527194737.1999409-1-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260513181922.2075438-1-michael.bommarito@gmail.com> References: <20260513181922.2075438-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit A userspace V4L2 client that can open the Rockchip RKVDEC m2m decoder node can submit HEVC EXT SPS RPS controls whose spec-derived count fields exceed the driver's fixed hardware descriptor tables and temporary helper arrays. KASAN under a KUnit harness wrapping the real rkvdec_hevc_assemble_hw_rps() helper confirms slab-out-of-bounds writes on num_short_term_ref_pic_sets > 64, num_long_term_ref_pics_sps > 32, num_negative/positive_pics > 16, and an OOB read via u8 ref_rps_idx underflow when delta_idx_minus1 + 1 > idx. v2 splits the single validation function from v1 into three layers at the appropriate level, per Detlev's review: 1/3 Tighten .cfg.dims on EXT_SPS_ST_RPS (65 -> 64) and EXT_SPS_LT_RPS (65 -> 32) to match the HEVC spec limits and let the V4L2 control framework reject oversized payloads. 2/3 Add SPS ST/LT count validation plus num_negative_pics / num_positive_pics validation in v4l2-ctrls-core.c so every consumer driver is protected. 3/3 Guard the delta_idx_minus1 underflow in st_ref_pic_set_prediction() in the rkvdec construction code. Cc: stable@vger.kernel.org Changes in v2: - Split the monolithic rkvdec-hevc-common.c validation function into dims, v4l2-core, and construction-code layers as Detlev suggested. - Drop the rkvdec-local #defines and pr_err_ratelimited; the V4L2 framework now handles the bulk of the rejection, including the SPS count fields that drive the rkvdec loops. Michael Bommarito (3): media: rkvdec: hevc: tighten EXT SPS RPS control dimensions media: v4l2-ctrls: validate HEVC EXT SPS RPS counts media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow .../platform/rockchip/rkvdec/rkvdec-hevc-common.c | 3 +++ drivers/media/platform/rockchip/rkvdec/rkvdec.c | 4 ++-- drivers/media/v4l2-core/v4l2-ctrls-core.c | 15 +++++++++++++++ 3 files changed, 20 insertions(+), 2 deletions(-) base-commit: 7fd2df204f342fc17d1a0bfcd474b24232fb0f32 -- 2.53.0