[PATCH] media: cobalt: bound the dv timings to the descriptor buffers

[PATCH] media: cobalt: bound the dv timings to the descriptor buffers

[Guo Zihao]

media: cobalt: bound the dv timings to the descriptor buffers

The DMA descriptor buffers are sized from the maximum frame the driver
supports:

        const size_t max_pages_per_line =
                (COBALT_MAX_WIDTH * COBALT_MAX_BPP) / PAGE_SIZE + 2;
        const size_t bytes =
                COBALT_MAX_HEIGHT * max_pages_per_line * 0x20;

With COBALT_MAX_WIDTH 1920, COBALT_MAX_HEIGHT 1200 and COBALT_MAX_BPP 3
that is 115200 bytes, or 3600 descriptors of 0x20 bytes each.

cobalt_s_dv_timings() however records whatever the subdevice accepts
without checking it against those maxima:

        err = v4l2_subdev_call(s->sd, pad, s_dv_timings, 0, timings);
        if (!err) {
                s->timings = *timings;
                s->width = timings->bt.width;
                s->height = timings->bt.height;
                s->stride = timings->bt.width * s->bpp;
        }

descriptor_list_create() in cobalt-omnitek.c then walks the whole frame
and writes one descriptor per scatterlist segment, with no upper bound of
its own. An HDMI source at 4096x2160 with bpp 3 gives stride 12288 and
size 26542080, which needs far more than the 3600 descriptors the buffer
holds, so d[] walks off the end of the coherent allocation.

cobalt_try_fmt_vid_cap() and cobalt_try_fmt_vid_out() already cap width
and height at 1920x1080, and this patch adds the same bound for the
timings path plus a stride limit on the pixelformat path.

No Fixes tag. The descriptor sizing and s_dv_timings() both come from the
initial driver, 85756a069c55 ("[media] cobalt: add new driver").

Reviewed-by: Liu Chao <liuc63@xiaopeng.com>
Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>
---
The timings come from the subdevice, which for the HDMI inputs is the
adv7604/adv7842 receiver, so connecting a source above 1080p is enough
to reach this. That is an ordinary signal, not a crafted one.

The stride limit in cobalt_try_fmt_vid_cap() covers the path where
bytesperline is chosen from userspace rather than derived from the
timings.

 drivers/media/pci/cobalt/cobalt-v4l2.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/media/pci/cobalt/cobalt-v4l2.c b/drivers/media/pci/cobalt/cobalt-v4l2.c
index 51fd9576c..32d967254 100644
--- a/drivers/media/pci/cobalt/cobalt-v4l2.c
+++ b/drivers/media/pci/cobalt/cobalt-v4l2.c
@@ -630,6 +630,13 @@ static int cobalt_s_dv_timings(struct file *file, void *priv,
 	if (vb2_is_busy(&s->q))
 		return -EBUSY;
 
+	if (timings->bt.width > COBALT_MAX_WIDTH ||
+	    timings->bt.height > COBALT_MAX_HEIGHT) {
+		cobalt_info("timings %ux%u out of range\n",
+			    timings->bt.width, timings->bt.height);
+		return -EINVAL;
+	}
+
 	err = v4l2_subdev_call(s->sd,
 			pad, s_dv_timings, 0, timings);
 	if (!err) {
@@ -781,6 +788,14 @@ static int cobalt_try_fmt_vid_cap(struct file *file, void *priv,
 		break;
 	}
 
+	/*
+	 * The DMA descriptor buffers are sized for at most
+	 * COBALT_MAX_WIDTH x COBALT_MAX_HEIGHT, so limit the line stride
+	 * accordingly.
+	 */
+	if (pix->bytesperline > COBALT_MAX_WIDTH * COBALT_MAX_BPP)
+		pix->bytesperline = COBALT_MAX_WIDTH * COBALT_MAX_BPP;
+
 	pix->sizeimage = pix->bytesperline * pix->height;
 	pix->field = V4L2_FIELD_NONE;
 
-- 
2.50.1

Re: [PATCH] media: cobalt: bound the dv timings to the descriptor buffers

[kernel test robot]

Hi Guo,

kernel test robot noticed the following build errors:

[auto build test ERROR on linuxtv-media-pending/master]
[also build test ERROR on media-tree/master sailus-media-tree/master linus/master v7.3-rc3 next-20260918]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Guo-Zihao/media-cobalt-bound-the-dv-timings-to-the-descriptor-buffers/20260918-152526
base:   https://git.linuxtv.org/media-ci/media-pending.git master
patch link:    https://lore.kernel.org/r/20260918072526.2478529-1-guozh23%40xiaopeng.com
patch subject: [PATCH] media: cobalt: bound the dv timings to the descriptor buffers
config: s390-allmodconfig (https://download.01.org/0day-ci/archive/20260919/202609190745.z2mFq2RW-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 7252edd9aa82ef1c570ff6694ef7f4763a8a5d2f)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260919/202609190745.z2mFq2RW-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609190745.z2mFq2RW-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/media/pci/cobalt/cobalt-v4l2.c:635:3: error: use of undeclared identifier 'cobalt'
     635 |                 cobalt_info("timings %ux%u out of range\n",
         |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     636 |                             timings->bt.width, timings->bt.height);
         |                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/pci/cobalt/cobalt-driver.h:160:45: note: expanded from macro 'cobalt_info'
     160 | #define cobalt_info(fmt, arg...) v4l2_info(&cobalt->v4l2_dev, fmt, ## arg)
         |                                             ^~~~~~
   1 error generated.


vim +/cobalt +635 drivers/media/pci/cobalt/cobalt-v4l2.c

   615	
   616	static int cobalt_s_dv_timings(struct file *file, void *priv,
   617					    struct v4l2_dv_timings *timings)
   618	{
   619		struct cobalt_stream *s = video_drvdata(file);
   620		int err;
   621	
   622		if (s->input == 1) {
   623			*timings = cea1080p60;
   624			return 0;
   625		}
   626	
   627		if (v4l2_match_dv_timings(timings, &s->timings, 0, true))
   628			return 0;
   629	
   630		if (vb2_is_busy(&s->q))
   631			return -EBUSY;
   632	
   633		if (timings->bt.width > COBALT_MAX_WIDTH ||
   634		    timings->bt.height > COBALT_MAX_HEIGHT) {
 > 635			cobalt_info("timings %ux%u out of range\n",
   636				    timings->bt.width, timings->bt.height);
   637			return -EINVAL;
   638		}
   639	
   640		err = v4l2_subdev_call(s->sd,
   641				pad, s_dv_timings, 0, timings);
   642		if (!err) {
   643			s->timings = *timings;
   644			s->width = timings->bt.width;
   645			s->height = timings->bt.height;
   646			s->stride = timings->bt.width * s->bpp;
   647		}
   648		return err;
   649	}
   650	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] media: cobalt: bound the dv timings to the descriptor buffers

[kernel test robot]

Hi Guo,

kernel test robot noticed the following build errors:

[auto build test ERROR on linuxtv-media-pending/master]
[also build test ERROR on media-tree/master sailus-media-tree/master linus/master sailus-media-tree/streams v7.3-rc3 next-20260918]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Guo-Zihao/media-cobalt-bound-the-dv-timings-to-the-descriptor-buffers/20260918-152526
base:   https://git.linuxtv.org/media-ci/media-pending.git master
patch link:    https://lore.kernel.org/r/20260918072526.2478529-1-guozh23%40xiaopeng.com
patch subject: [PATCH] media: cobalt: bound the dv timings to the descriptor buffers
config: arm-randconfig-r1300-20260918 (https://download.01.org/0day-ci/archive/20260919/202609190912.ouKMS0Bi-lkp@intel.com/config)
compiler: arm-linux-gnueabi-gcc (GCC) 15.2.0
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260919/202609190912.ouKMS0Bi-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609190912.ouKMS0Bi-lkp@intel.com/

All errors (new ones prefixed by >>):

   In file included from include/asm-generic/bug.h:31,
                    from arch/arm/include/asm/bug.h:60,
                    from include/linux/bug.h:5,
                    from include/linux/thread_info.h:13,
                    from include/linux/sched.h:14,
                    from include/linux/ratelimit.h:6,
                    from include/linux/dev_printk.h:16,
                    from include/linux/device.h:15,
                    from include/linux/dma-mapping.h:5,
                    from drivers/media/pci/cobalt/cobalt-v4l2.c:11:
   drivers/media/pci/cobalt/cobalt-v4l2.c: In function 'cobalt_s_dv_timings':
>> drivers/media/pci/cobalt/cobalt-driver.h:160:45: error: 'cobalt' undeclared (first use in this function)
     160 | #define cobalt_info(fmt, arg...) v4l2_info(&cobalt->v4l2_dev, fmt, ## arg)
         |                                             ^~~~~~
   include/linux/printk.h:483:33: note: in definition of macro 'printk_index_wrap'
     483 |                 _p_func(_fmt, ##__VA_ARGS__);                           \
         |                                 ^~~~~~~~~~~
   include/media/v4l2-common.h:58:9: note: in expansion of macro 'printk'
      58 |         printk(level "%s: " fmt, (dev)->name , ## arg)
         |         ^~~~~~
   include/media/v4l2-common.h:67:9: note: in expansion of macro 'v4l2_printk'
      67 |         v4l2_printk(KERN_INFO, dev, fmt , ## arg)
         |         ^~~~~~~~~~~
   drivers/media/pci/cobalt/cobalt-driver.h:160:34: note: in expansion of macro 'v4l2_info'
     160 | #define cobalt_info(fmt, arg...) v4l2_info(&cobalt->v4l2_dev, fmt, ## arg)
         |                                  ^~~~~~~~~
   drivers/media/pci/cobalt/cobalt-v4l2.c:635:17: note: in expansion of macro 'cobalt_info'
     635 |                 cobalt_info("timings %ux%u out of range\n",
         |                 ^~~~~~~~~~~
   drivers/media/pci/cobalt/cobalt-driver.h:160:45: note: each undeclared identifier is reported only once for each function it appears in
     160 | #define cobalt_info(fmt, arg...) v4l2_info(&cobalt->v4l2_dev, fmt, ## arg)
         |                                             ^~~~~~
   include/linux/printk.h:483:33: note: in definition of macro 'printk_index_wrap'
     483 |                 _p_func(_fmt, ##__VA_ARGS__);                           \
         |                                 ^~~~~~~~~~~
   include/media/v4l2-common.h:58:9: note: in expansion of macro 'printk'
      58 |         printk(level "%s: " fmt, (dev)->name , ## arg)
         |         ^~~~~~
   include/media/v4l2-common.h:67:9: note: in expansion of macro 'v4l2_printk'
      67 |         v4l2_printk(KERN_INFO, dev, fmt , ## arg)
         |         ^~~~~~~~~~~
   drivers/media/pci/cobalt/cobalt-driver.h:160:34: note: in expansion of macro 'v4l2_info'
     160 | #define cobalt_info(fmt, arg...) v4l2_info(&cobalt->v4l2_dev, fmt, ## arg)
         |                                  ^~~~~~~~~
   drivers/media/pci/cobalt/cobalt-v4l2.c:635:17: note: in expansion of macro 'cobalt_info'
     635 |                 cobalt_info("timings %ux%u out of range\n",
         |                 ^~~~~~~~~~~


vim +/cobalt +160 drivers/media/pci/cobalt/cobalt-driver.h

85756a069c55e0 Hans Verkuil 2015-05-12  157  
85756a069c55e0 Hans Verkuil 2015-05-12  158  #define cobalt_err(fmt, arg...)  v4l2_err(&cobalt->v4l2_dev, fmt, ## arg)
85756a069c55e0 Hans Verkuil 2015-05-12  159  #define cobalt_warn(fmt, arg...) v4l2_warn(&cobalt->v4l2_dev, fmt, ## arg)
85756a069c55e0 Hans Verkuil 2015-05-12 @160  #define cobalt_info(fmt, arg...) v4l2_info(&cobalt->v4l2_dev, fmt, ## arg)
85756a069c55e0 Hans Verkuil 2015-05-12  161  #define cobalt_dbg(level, fmt, arg...) \
85756a069c55e0 Hans Verkuil 2015-05-12  162  	v4l2_dbg(level, cobalt_debug, &cobalt->v4l2_dev, fmt, ## arg)
85756a069c55e0 Hans Verkuil 2015-05-12  163  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki