From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f47.google.com (mail-qv1-f47.google.com [209.85.219.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AE92E3A6410 for ; Sun, 14 Jun 2026 15:56:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781452576; cv=none; b=c9aU9CnsAdfUU64pkAb/J+V0hhGoZInWPwABPTbYn+GJvaH8iR1wp0huHqlWIp8BTwyCc9GwM3TZVcLcuDSiU+BYiaFkkL1rPvyhsCnIdCRzcuJ22okdXkQUuTxZJsLQa0ZW81qCwIqBkpFoOKkFep3dwirGh0+3frb9+VXZdzI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781452576; c=relaxed/simple; bh=oKkEKfhwkvx+v+Ta6PmsjoL6hTzX8sHn6G8U7vMuz54=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=K1KUfLTwYM+SDRFMr+Z1HAxjwbSEpCBkjkZKjA0aEAldIVsH1+OibIxbg2DAPY4c6TTfUvm6t9oKZn7UG0OS89cde0xRMFKA0z08emsaBydlbXI58alHtyVNEeSTFOY+q9RN+WQdAapaKoWt0f+PSFZ6ijUh+1xA9XHRxM4jyH0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=a2gWyOHZ; arc=none smtp.client-ip=209.85.219.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="a2gWyOHZ" Received: by mail-qv1-f47.google.com with SMTP id 6a1803df08f44-8ccf0fa0aacso39348066d6.2 for ; Sun, 14 Jun 2026 08:56:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781452575; x=1782057375; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=0ElgwnBNirjLiswOhHY1Csa+P9LjdxoJoEu8lkda184=; b=a2gWyOHZ2olj+zJ82fBLX3/Yda06Mw3riLRxSXhh23+uyQGcztB8Q4dRvNCOeKVtL7 QzYvm73D7WGrcU3KqEACJ2lsSzrTRAxPbSTn2hJTlDJCQlj4tIwx8zzfD+j/tUHKO+eU mGG3m0aRK+Q3qGP5ktdHh3gZnEo9sKfWkoM2IW0cDdjVyYPJEkNAhDGIretZQdx+YzNe Roupo/R76SV9fSo6efJ+y+8nRPYvQvv0HdPE3GvqD3HnViUWCxmVaHEsHA38jr+yoWRf 9M43z2UN2f5rZ13Jhe9hUbVsQvKfAIdI5Wk7aE1S9HEDzlP+MIjXtQgGUcUMpUGxBFyg ktCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781452575; x=1782057375; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=0ElgwnBNirjLiswOhHY1Csa+P9LjdxoJoEu8lkda184=; b=QEeMKri3E6iGk/G25U64QAfvMv2MlTz0Pv/Joszc0q/BTcpAF9z93xPiate/Vpa9Q3 +DBu2/AuWt6CgPLqnqaqozTIBFIONGmyUbrX5ci99jyamCNMzMb/Md7BBo85+f6RwZN+ XXWY5W5cZzzeRXXrNbKwEdSxi1ddzPb+LQqZKc7BpK0qKvFTRZv5xC7Xqg9/reI8iWtJ +srg1M1o8SuSE6lTGpQfUgn6ur/59oCLsUiPEUoLV9s5SElEnDx9PzDZvLRqUtv7zJxK ziQ60X33x/wdJ/fyMKPpCcH9nFITuP54QZ+haWG6juoYvqKcxC/F1F7DaD6+QyLNsT6d HQoA== X-Forwarded-Encrypted: i=1; AFNElJ8+qHgo62PTF/Q1gT65G4ciFYodYDoojTtPaB36D7JAqn9VE1SnprsJMeBoPXOXrf6TiOzQa6rLvQ6a90A=@vger.kernel.org X-Gm-Message-State: AOJu0YzmQicEKnLZJWYZttahVetZO1ITGok0V3WiHGtLyoRC8C0s1AFM ra5Dsb8awlkWlXso5bA4L1n7Bg2bFYBV+GGlp1vZ6U2i8uM+y5azBLcw X-Gm-Gg: Acq92OGAF1e1zmq0m9/07V8qqZH6XXeYWcfxiLhLZEUctHpw0Fvxr+tmeku/sNwg/Fl oZPKKJRPjWh30J1jvj0ThP94Lk/c+nlMZ6D+TiPIXbeX7XSYvgvtlRBFxzrekss8lPyrxg7IkFF 4CUK1LiK1c8pjL2TQi+f4+rndZRm+WO/6CupL1HLkeyVFMgDnZBQpVRsYOKRlyr8xEirY4NRuHA T/7mqeCNHu4teeVDM7I73MersqZEAwzEdEG81QheEgBEneHK/4jzqAAQTTnurgd2MbkjlOKwvVk f+paRAmCXfeUurkjLhK9ojcm3YZgQvhbxXrZKlygH0eiKAkg/jB37/XU2Dd3040zoYt4ZYHx5Nm eWd8pYMUZevmIKTRl+9n2iXkc7kRjvJ1NsOiByYuiRTzvEU5s2DI8Ntm25fHfZ/L+Bl/92fnUnB ZEYM6Q+Ag1iMjR9uvW2zYAs6Nhuoqsp3/7dnZ5Wjl8vjbryrboTVVoj3ePcpECcCuuXCmVpnPhI rt4TeCPuiI9TZQxH2k3TcVISZXRfOq+DA7iVvtSqko= X-Received: by 2002:a05:6214:3993:b0:8ce:b018:89ff with SMTP id 6a1803df08f44-8d44f8fc7a0mr121880556d6.36.1781452574638; Sun, 14 Jun 2026 08:56:14 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8d30522cbeasm82008446d6.44.2026.06.14.08.56.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Jun 2026 08:56:14 -0700 (PDT) From: Michael Bommarito To: Hans Verkuil , Mauro Carvalho Chehab , Sakari Ailus , Nicolas Dufresne Cc: Laurent Pinchart , Benjamin Gaignard , Detlev Casanova , Ezequiel Garcia , Yunfei Dong , Jonas Karlman , Heiko Stuebner , Kees Cook , linux-media@vger.kernel.org, linux-rockchip@lists.infradead.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/6] media: v4l2-ctrls: validate HEVC and AV1 tile counts Date: Sun, 14 Jun 2026 11:56:03 -0400 Message-ID: <20260614155609.3107600-2-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260614155609.3107600-1-michael.bommarito@gmail.com> References: <20260614155609.3107600-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit The stateless HEVC and AV1 controls carry tile counts that several SoC decoder drivers consume as loop bounds when laying out fixed-size hardware descriptor buffers, but std_validate_compound() does not bound them. For V4L2_CTRL_TYPE_HEVC_PPS with tiling enabled, num_tile_columns_minus1 and num_tile_rows_minus1 (u8) drive loops over column_width_minus1[20] and row_height_minus1[22]. For V4L2_CTRL_TYPE_AV1_FRAME, tile_info.tile_cols and tile_rows (u8) bound loops over the mi_*_starts[] / *_in_sbs_minus_1[] arrays. Reject counts beyond the uAPI array capacity with -EINVAL. These are active-count fields (loop bounds), so bounding the upper limit here mirrors the existing num_active_dpb_entries check. Only the upper bound is enforced; a zero tile count is left to the consuming driver, so the zero-initialised AV1 frame control that existing userspace submits is not rejected, and the AV1 divisor (context_update_tile_id / tile_cols) is guarded where it is used in the rockchip decoder (patch 4). Driver-interpreted index values (HEVC pic_parameter_set_id, AV1 context_update_tile_id) are bounded in the consuming drivers instead (patches 2 and 4). Fixes: 256fa3920874 ("media: v4l: Add definitions for HEVC stateless decoding") Fixes: 9de30f579980 ("media: Add AV1 uAPI") Signed-off-by: Michael Bommarito Assisted-by: Claude:claude-opus-4-8 --- drivers/media/v4l2-core/v4l2-ctrls-core.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c index 6b375720e395c..58e2eb7002a19 100644 --- a/drivers/media/v4l2-core/v4l2-ctrls-core.c +++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c @@ -790,10 +790,25 @@ static int validate_av1_film_grain(struct v4l2_ctrl_av1_film_grain *fg) return 0; } +static int validate_av1_tile_info(struct v4l2_av1_tile_info *t) +{ + /* Loop bounds in the stateless AV1 drivers. */ + if (t->tile_cols > V4L2_AV1_MAX_TILE_COLS) + return -EINVAL; + + if (t->tile_rows > V4L2_AV1_MAX_TILE_ROWS) + return -EINVAL; + + return 0; +} + static int validate_av1_frame(struct v4l2_ctrl_av1_frame *f) { int ret = 0; + ret = validate_av1_tile_info(&f->tile_info); + if (ret) + return ret; ret = validate_av1_quantization(&f->quantization); if (ret) return ret; @@ -1242,6 +1257,14 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx, p_hevc_pps->flags &= ~V4L2_HEVC_PPS_FLAG_LOOP_FILTER_ACROSS_TILES_ENABLED; + } else { + /* Loop bounds in the stateless HEVC drivers. */ + if (p_hevc_pps->num_tile_columns_minus1 >= + ARRAY_SIZE(p_hevc_pps->column_width_minus1)) + return -EINVAL; + if (p_hevc_pps->num_tile_rows_minus1 >= + ARRAY_SIZE(p_hevc_pps->row_height_minus1)) + return -EINVAL; } if (p_hevc_pps->flags & -- 2.53.0