From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f52.google.com (mail-qv1-f52.google.com [209.85.219.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 774953603D9 for ; Sun, 14 Jun 2026 13:10:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781442609; cv=none; b=O2jOeV/b2Oi8PEOGnZtHYkp9UUW/Tq8uPps7ZvHgVz0jvZ9Ozdi2fvCx3p1Nli8JVhaaw7vnTZCzszpdVN21qRFSb0El+orw+KHtqIbRfpcYf9+it5qJP1R9/bZJfI4zR+2Aild5xIVBoDa/uluHNwGS5h7Ri/6wBFo0fR8mmFA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781442609; c=relaxed/simple; bh=ww3m6zmHNNiE/AdkpiZDuVVO/n5Rq3f4RU9rP/1BweQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=I2pP0WzQ8DMkn4nYw5CHQz26XvDXNY+f/85cDCEJpDeXd2rIlhjpfZqnsAcVTo4viU9IQ+RDXQ7k9eU0LFTKMb2OvFMcJlrZO7Aw/t42nKdRgUCNyhjF9rFA192buSwS/KbDwt/2CH9dPLEtXhgHwLdIa6gkzmmDMM8as64TsxY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Q74uaNl4; arc=none smtp.client-ip=209.85.219.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Q74uaNl4" Received: by mail-qv1-f52.google.com with SMTP id 6a1803df08f44-8cce87d7995so29124836d6.0 for ; Sun, 14 Jun 2026 06:10:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781442607; x=1782047407; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=W8QN1oqmeXkeOy6RyRuiD7b4Q+mpnATm3FAvEoUlIOM=; b=Q74uaNl4cajwK8UC8htuzAq3wLhue9iIuzSI+KeBl2F+bduTetCRb88AatgTi9J1XQ wNNvNTViPfkwMYXBOsx0iP2tRK45lxj07cUZNrDSLyXYcJ7u4GKO6wFcaI3o8ZbmAWPZ 3czZ2bEfIl8+JH/AoWdbDG9Q/QEHrZUqseiMKn8cyOEVSGiIlrIDs2xAvqyxMztlvugl AMDLoe7sAnjxXsk+oWoE+nLsJXHtYaWUKLWndn4kNTcMpVvL9BmZCOTJAL0luEBbWAhK 4b1G88cmxyIOCmWw8MdAOXiq+vvgoVDpJyorJGLNKBdpqdYsb+cPDYsVaQOKaOo/9jBx Rppg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781442607; x=1782047407; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=W8QN1oqmeXkeOy6RyRuiD7b4Q+mpnATm3FAvEoUlIOM=; b=rcgGV3q15tK4/LBKkn/sIzfBMdWv6SqrYaaXR4iINgUBVgjUSo9b/KnerVtu+WqbPQ rfZKchA8QioNEiy8DgGWdQvifSOIJQ8C6MiemAA6asxdTwdOyhVPEvZ60Aff5CxxgstC ESqZwj6EtbTCZ6FWV7m3Pxxd65geOES8cYJDadfxAeuEetnnuSgRKMKMbT2MxobiRShV ACGgSRv9QXl4bGnQtHxEzYKg0ygvNqivQU6CcQM69lR8OoUKTZtbrQRtD8md0j3hc6BH tHKEhSKIhNGyErAn8HFuMADxedNB6OODjkyi6iP0H++Pl/ZXCV9AiMdLbJWWcFU6lZbs qo8Q== X-Forwarded-Encrypted: i=1; AFNElJ8hcbpesY133x6v/1OKFlhSdX8EJNxjfgkc3yTJUoDHK+4inxyx2lPsOUb9hIjhAkEtbhQ9sgbjewuQm1s=@vger.kernel.org X-Gm-Message-State: AOJu0Yy2MNC7PgMxA8FHOmgjTvMnEdpqGgnVKUxc0T9aflAerUR0Bj3U F286vrHJXBiwmE+fDBMtMY1XVEWmRa34/zbVFAQcqg81jxTAHbmc+DZD X-Gm-Gg: Acq92OELyMxR+RrqKHqrxDOTgQe/ZxbLKJsV1RBzUaCnAYx8xW+vNJsEG2w1HzTIIhj CrOfLAVQuBgvV/+cXYPHI6m6/tIh4q4Plrs79GXT8qSlru51Pjzh2fZSxa9qbUr49FjO1RZdMo8 /KauO1C5xNB7eH9Ivz+mU/HUuRmfZFhqk0053k+lXfYFdMvp64H+iYxrzfJZsMdmcvipeJK2Ih1 qp6/GnA4y0lSbBrBqcQBqEaEwoeLzyqc59WxpT/QSOK+epaeqErIEIkQ4byIVQffg/60nMrOkGQ k23XPwPXBbyQxu2YsL0Fu7zG+38dNeeHXkmZfYOSwlk7UjUxm4iLh3KFbvob2oIwK9gMUjEABmi KT0FmrOXayfFvH7osjInb7tUlxE58VLHpd8+lDmUOhPW6eBUcpQLzmzVYvkTTvJlGDjbuSrWhN+ sn4zXQrRooS8shwQiJsNuenYtwigFKDWP9mmomvm3bewkUDND/9Z99mhEDvRZPxmyiRdHTwB6+Q lwcHV9+LIKxGy7P4EYc4/VIGcbRfOKmATkTvXTMgCg= X-Received: by 2002:a05:620a:2904:b0:915:9fba:878f with SMTP id af79cd13be357-9161bab4562mr1530615785a.5.1781442607439; Sun, 14 Jun 2026 06:10:07 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-91619f1b400sm752878985a.15.2026.06.14.06.10.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Jun 2026 06:10:06 -0700 (PDT) From: Michael Bommarito To: Hans Verkuil , Mauro Carvalho Chehab , Sakari Ailus , Nicolas Dufresne , Sebastian Fricke Cc: Laurent Pinchart , Benjamin Gaignard , Detlev Casanova , Ezequiel Garcia , Yunfei Dong , Jonas Karlman , Heiko Stuebner , Kees Cook , linux-media@vger.kernel.org, linux-rockchip@lists.infradead.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 0/6] media: v4l2-ctrls: bound stateless HEVC/AV1 tile counts Date: Sun, 14 Jun 2026 09:09:57 -0400 Message-ID: <20260614131003.2524025-1-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit The stateless HEVC and AV1 V4L2 controls carry tile counts that several SoC decoder drivers consume as loop bounds and divisors when laying out fixed-size hardware descriptor buffers, but std_validate_compound() does not bound them. A process with access to a /dev/videoN stateless decoder (on a typical desktop or SBC, the active-seat local user via the logind/udev uaccess ACL, no extra capability) can set a HEVC PPS or AV1 frame control with a tile count far beyond the array capacity the drivers assume, making them loop past their fixed buffers. Patch 1 caps the HEVC and AV1 tile counts to the uAPI array capacity in the core. Patches 2-5 add matching bounds in the consuming driver loops (and bound the driver-interpreted HEVC pic_parameter_set_id / AV1 context_update_tile_id indices the core does not reject). Patch 6 adds KUnit tests for the core validation. I did my best to reproduce these with the hardware I have, but apologies in advance if I missed something because the soft repro. Test matrix: patch 1 + patch 6 run the real std_validate_compound() under KASAN on x86_64 (rejects out-of-range counts, in-range pass, stock and patched); all objects build clean W=1; the ARM SoC decoders are not reachable on the x86 host, so the per-driver writes are not reproduced here. Michael Bommarito (6): media: v4l2-ctrls: validate HEVC and AV1 tile counts media: rkvdec: bound HEVC tile loops and PPS id to the array capacity media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity media: verisilicon: rockchip: bound VPU981 AV1 tile loop and guard divisor media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity media: v4l2-ctrls: add KUnit tests for compound control tile validation .../vcodec/decoder/vdec/vdec_av1_req_lat_if.c | 5 +- .../rockchip/rkvdec/rkvdec-hevc-common.c | 22 +++- .../platform/rockchip/rkvdec/rkvdec-hevc.c | 8 +- .../rockchip/rkvdec/rkvdec-vdpu381-hevc.c | 2 + .../platform/verisilicon/hantro_g2_hevc_dec.c | 6 + .../verisilicon/rockchip_vpu981_hw_av1_dec.c | 29 +++-- drivers/media/v4l2-core/Kconfig | 12 ++ .../media/v4l2-core/v4l2-ctrls-core-test.c | 119 ++++++++++++++++++ drivers/media/v4l2-core/v4l2-ctrls-core.c | 27 ++++ 9 files changed, 213 insertions(+), 17 deletions(-) create mode 100644 drivers/media/v4l2-core/v4l2-ctrls-core-test.c base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8 -- 2.53.0