From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f176.google.com (mail-qk1-f176.google.com [209.85.222.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 159B93A451E for ; Sun, 14 Jun 2026 13:10:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781442615; cv=none; b=KVvpxRiFD89YcYQsrdq+q+sMfUlcXxOVj8oN3c4c2IQu8VkQtFz6lps4hlgpdDOn4G3goD3KYmfV2sNORrJcM7WZ56zEunZ4uxjYBL89Sasp4yG6aih6fSvjsXyUaGVR+NSPC1wWetrN4N+8km+rxW/JDCllVYgURP9Q0nX6naI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781442615; c=relaxed/simple; bh=3bfgMusxiRGeo2i6HGXgtHLR7Felcs11Fme4aBVT0rQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OzsErFn1HfzajiUc4VzUHFQX6HgcVxbxfWA2t9wAp+Gi9tpGqUUIRWGBu+DLmUZI/oMuYVcXz6umzKBfg4OjfmhadmBeFI/Q7WseIbHden8rNo5eYgtCgthHWu/PFTauvUSNWTWSoZZb/gQG87jspJ/xq5MSYpmXH3edZ6yMxCI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=FrI6Yq4C; arc=none smtp.client-ip=209.85.222.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="FrI6Yq4C" Received: by mail-qk1-f176.google.com with SMTP id af79cd13be357-91591f19c30so358259385a.1 for ; Sun, 14 Jun 2026 06:10:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781442612; x=1782047412; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=5zfgey8wi8pckGyHiNYDJA2CHFfMtkrqEl07FMub/Hg=; b=FrI6Yq4CswqXVH/IewhlGZeoqewtGDIIao1GWVrPrpNPqaFCmZ5qcm/leEf3VqR4Pu ZtkkfDvd0pLhqMrr0wuUSE8KVUmjdyRJn0Urs61x4bMRHAoVpSYEAc2lnWCPEFx8KECX plMUmFrhma7HrTAiDXupoLgNsIkrVRNmt4O2qK2bF/pyaBBgQSChYVDLKYKW+oNbWVHm rSnucXIQITpBlrYdnNGfbLwAef+UpG1zLMNP28Q+GshyeRYN1qnN04D0SzoAsd7EhnPS NjgXQ5ScdbnlkMc5OOB1rTypnNIXVojumFMvrDM0xM8jmMlWmqhWCZWsfrjY7ADu+i2q mJIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781442612; x=1782047412; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=5zfgey8wi8pckGyHiNYDJA2CHFfMtkrqEl07FMub/Hg=; b=I3EMsbWCcNHw8FVxClV9bbUldhgJiqLNXRV8VigLw8TXrTw6qHn+PCEsDkzCMxUFID uG5falv1RlXrBogEUtiv6L0hwHJcpX1QWSe2ZHxUFyeZBaPt02B82B8mD3rnJX/XXyda 72mCAbb44HmRV9jtzXHQQ53bP6vFitRnKuEmQur93VYNfR8q9Q3Cofwbn8M2ujkMeXuR CrbmeHa8uF0uJlUqcSCx1Kszq/XkuzJIvyENlmPZ54JSbYjpYfqb8pz/3S8dtz2T7Hbz haELXu7gMdB7GRpZ/YG79RjoQbwrhU6ug7pEqPOxeBUEb6wT81BjiZoXI/I0bGVUaEHh KxgQ== X-Forwarded-Encrypted: i=1; AFNElJ/oohsUzhd669GtBg6or7wj7wcXKB0lUYu+WqQabjGLp2rWElXl9JyM8aGgjm8DltMvKYjMAgqHk8KWQgk=@vger.kernel.org X-Gm-Message-State: AOJu0YxZIZgfxlUR1/2Qu9/femkwF+dQYH7umZTz/EuLnukHh4gl608G yHp13FMS6e9wIzPpu+NrKPIbQAtbBkG+ALmtScsFE/PO36zAvDdX/8Z3 X-Gm-Gg: Acq92OEvGMcwEinhkc1E+/ZPVhJTRmq9nOeBL8zhEvkh2c9cQj1rNg2ZMZsEqsNIn5h /Nj53XmOcs/NKuv/nycaAYEDHKw25dXObJ6D3bSdU1Uauto5TfSSHfRXap/sSQ8Tez25hKMlkiT A4dY3aK27Ua/f7SGQlqs61BvWqbGydd/Cpk9w33r3L6QT83cYvpObTGrVdoPWZrv8a7RR2NvBs4 nKlWCKp/WIYE7l2GYqlUdJfBZB34Jn4GL6zZ1irI0hHeWF6pJarxdnuTyQc5qMaDvyyHTTcwvmP J5F5MwL68IUQXrtsiM8CW7350+ciObeacsu3INtRotgf1yor6H7fBKDxuiG3U7fHH+h0Ww4XI+O nXxu2V3UfAJCwviC/Ch2rHgADdKsqcuhSOzJkqLIWzVx0nOp0HCoHzVXr8U8vCcUlxGs7qDbecj mk6hP+9oLjSz038z3nDHzWjoNnm/MPwMKUtpyR69ysswCXTeQgVa9fPmhfU8ElpY5xzM22WZ7fi 53s3I/6Acmm/JiJI9wJdUYzdKXwUDAmAZwdDFZDwns= X-Received: by 2002:a05:620a:2590:b0:915:aa7d:42bc with SMTP id af79cd13be357-917eefc36aemr1143196185a.10.1781442611978; Sun, 14 Jun 2026 06:10:11 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-91619f1b400sm752878985a.15.2026.06.14.06.10.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Jun 2026 06:10:11 -0700 (PDT) From: Michael Bommarito To: Hans Verkuil , Mauro Carvalho Chehab , Sakari Ailus , Nicolas Dufresne , Sebastian Fricke Cc: Laurent Pinchart , Benjamin Gaignard , Detlev Casanova , Ezequiel Garcia , Yunfei Dong , Jonas Karlman , Heiko Stuebner , Kees Cook , linux-media@vger.kernel.org, linux-rockchip@lists.infradead.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 3/6] media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity Date: Sun, 14 Jun 2026 09:10:00 -0400 Message-ID: <20260614131003.2524025-4-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260614131003.2524025-1-michael.bommarito@gmail.com> References: <20260614131003.2524025-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit prepare_tile_info_buffer() writes one entry per tile into the tile_sizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Bound the loop to that capacity so the writes stay inside the buffer. Fixes: cb5dd5a0fa51 ("media: hantro: Introduce G2/HEVC decoder") Signed-off-by: Michael Bommarito Assisted-by: Claude:claude-opus-4-8 --- This is an i.MX8M Hantro G2 SoC block not reachable on the x86 KUnit host, so the driver-side out-of-bounds write is not reproduced here. drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c index e8c2e83..94fbd79 100644 --- a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c +++ b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c @@ -22,6 +22,12 @@ static void prepare_tile_info_buffer(struct hantro_ctx *ctx) bool tiles_enabled, uniform_spacing; u32 no_chroma = 0; + /* Bound the loops to the tile_sizes buffer capacity. */ + num_tile_cols = min_t(unsigned int, num_tile_cols, + ARRAY_SIZE(pps->column_width_minus1)); + num_tile_rows = min_t(unsigned int, num_tile_rows, + ARRAY_SIZE(pps->row_height_minus1)); + tiles_enabled = !!(pps->flags & V4L2_HEVC_PPS_FLAG_TILES_ENABLED); uniform_spacing = !!(pps->flags & V4L2_HEVC_PPS_FLAG_UNIFORM_SPACING); -- 2.53.0