[PATCH 1/4] media: verisilicon: Size the VP8 segment map for the largest frame

[Arun Iyengar via B4 Relay <devnull+aiyengar1990.gmail.com@kernel.org>]

From: Arun Iyengar <aiyengar1990@gmail.com>

The segment map is allocated at STREAMON for the CAPTURE format of that
time, but the format can grow while streaming, and the decoder writes
2 bits per macroblock of the new size. The map of a small format is one
page, which a frame of more than 16384 macroblocks (3840x2160, for
example) overruns.

Size it for the largest frame the variant decodes, as VP9 does.

Found by Sashiko in its review of hantro-dec-size-check v1.

Fixes: bbd267daf4fc ("media: verisilicon: vp9: Allow to change resolution while streaming")
Cc: stable@vger.kernel.org
Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 drivers/media/platform/verisilicon/hantro_vp8.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/verisilicon/hantro_vp8.c b/drivers/media/platform/verisilicon/hantro_vp8.c
index 381bc1d3bfda..12907f000a92 100644
--- a/drivers/media/platform/verisilicon/hantro_vp8.c
+++ b/drivers/media/platform/verisilicon/hantro_vp8.c
@@ -150,9 +150,9 @@ int hantro_vp8_dec_init(struct hantro_ctx *ctx)
 	size_t segment_map_size;
 	int ret;
 
-	/* segment map table size calculation */
-	mb_width = DIV_ROUND_UP(ctx->dst_fmt.width, 16);
-	mb_height = DIV_ROUND_UP(ctx->dst_fmt.height, 16);
+	/* The format can grow while streaming: size for the largest frame. */
+	mb_width = DIV_ROUND_UP(ctx->vpu_src_fmt->frmsize.max_width, 16);
+	mb_height = DIV_ROUND_UP(ctx->vpu_src_fmt->frmsize.max_height, 16);
 	segment_map_size = round_up(DIV_ROUND_UP(mb_width * mb_height, 4), 64);
 
 	/*

-- 
2.55.0