From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 43C4138F64F for ; Mon, 30 Mar 2026 16:45:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774889119; cv=none; b=jMVEdUy8Hik8VQJEp4O+s833/hMQ2fwGYwmAldJxPtK7/ZOQERd61HW7h9yt6p8NIQE3quO3bc+TIAMvOlG630NcZzz/ba2uq+p6WOGb7QAkEmopVC0TxU/X4MBqcxG12J9uT1SRPr5iGTkmi3fRAHR0ylEEaI8N9A/B+2c0OBA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774889119; c=relaxed/simple; bh=cDdS45lavJOKhvVvf7Im6p8b+Plxzdq4VLLt3nmyGa4=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=VIHkz6dMWDsuMPineq4sBDpIdFb43PSvgGxXiE2CYe41BcgNN2NZjHOtYBvNRh8HjO0hS0WK7ifSz8pw6RSYoqkCzDAJiOEXSRfRrHR0mpTqbZrAeQViBmBuQ+1YKALO5aqcqtCCQxEm/KUTXx/iQWeQblVNrfxXSpfVkgC8eoU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=kD8SrnEP; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="kD8SrnEP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EB08DC2BCB8 for ; Mon, 30 Mar 2026 16:45:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774889119; bh=cDdS45lavJOKhvVvf7Im6p8b+Plxzdq4VLLt3nmyGa4=; h=References:In-Reply-To:Reply-To:From:Date:Subject:To:Cc:From; b=kD8SrnEPxGgq8Mf7Y91uMO95eUKrJqoVRZURcuNeHmIvDx3D+kYdAwILZWEvOhpm9 3tFoXy5tMvgq+lI5QLWBLbYYShnroQAxAnUuihc9yFCIOnR6/K1FqEraKzeLVL62c2 jKcy3gtqxDnh5Qt8PMvyC+USBQUGI4wzZTXmhOI6BtgN+YSpMh8fP+mKjr8U80ayn8 Br4ZvBD5qegnvwA+kgH/A29e7ULtbm3VexbEIWrChz7DMw2+hwABWuM7rS54fbUElc A5TvHa1w4XDIHFVHSTmWQPiJ4mcj0yHMhQhSKX1+RPpALJ9bDBKmmX7d+6IjZJP/4o 8Y+0O0GrVDqeA== Received: by mail-lj1-f181.google.com with SMTP id 38308e7fff4ca-38bf1561215so30831551fa.2 for ; Mon, 30 Mar 2026 09:45:18 -0700 (PDT) X-Forwarded-Encrypted: i=1; AJvYcCUCU22T6eQmw+ubmHbbIN5oA8H4nKf19tEm08giigMHvGAPBzcWl5BwMgzt7tJmmYxUTGSRRc5Wg3g+PUI=@vger.kernel.org X-Gm-Message-State: AOJu0YyT9jb3KgbEsgcf+U4Q7I/Gv0/stnsueRATtOglxLut+Sgx3jkK dBbAW7jj+knoJdqR+Crabj+fvxPcWnSsxSEp3kHdU1jYas09vMG/grmFQn2dxMbvAZxcPUwRzCo 8QDZn9yHpD+DINayOlaoI+ju+vI9Cjv4= X-Received: by 2002:a05:651c:3041:b0:38b:dd7a:52aa with SMTP id 38308e7fff4ca-38c731eb805mr36701791fa.7.1774889117273; Mon, 30 Mar 2026 09:45:17 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260324080856.56787-1-pengpeng@iscas.ac.cn> <2823210.mvXUDI8C0e@jernej-laptop> <603785eb48d69bc50c0296fc696eb0985c2a3ac5.camel@collabora.com> In-Reply-To: <603785eb48d69bc50c0296fc696eb0985c2a3ac5.camel@collabora.com> Reply-To: wens@kernel.org From: Chen-Yu Tsai Date: Tue, 31 Mar 2026 00:45:05 +0800 X-Gmail-Original-Message-ID: X-Gm-Features: AQROBzCCf-gBGZiQsgZ0PWLzupAc_iXzFsXr0d6GTNbJZ5GFha2Q7zktumWSWEw Message-ID: Subject: Re: [PATCH] media: cedrus: skip invalid H.264 reference list entries To: Nicolas Dufresne Cc: =?UTF-8?Q?Jernej_=C5=A0krabec?= , mripard@kernel.org, Pengpeng Hou , paulk@sys-base.io, mchehab@kernel.org, gregkh@linuxfoundation.org, samuel@sholland.org, linux-media@vger.kernel.org, linux-staging@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Mar 30, 2026 at 11:55=E2=80=AFPM Nicolas Dufresne wrote: > > Le dimanche 29 mars 2026 =C3=A0 20:44 +0800, Chen-Yu Tsai a =C3=A9crit : > > On Sun, Mar 29, 2026 at 5:21=E2=80=AFPM Jernej =C5=A0krabec wrote: > > > > > > Dne torek, 24. marec 2026 ob 09:08:56 Srednjeevropski poletni =C4=8Da= s je Pengpeng Hou napisal(a): > > > > Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the > > > > stateless slice control and later uses their indices to look up > > > > decode->dpb[] in _cedrus_write_ref_list(). > > > > > > > > Rejecting such controls in cedrus_try_ctrl() would break existing > > > > userspace, since stateless H.264 reference lists may legitimately c= arry > > > > out-of-range indices for missing references. Instead, guard the act= ual > > > > DPB lookup in Cedrus and skip entries whose indices do not fit the = fixed > > > > V4L2_H264_NUM_DPB_ENTRIES array. > > > > > > > > This keeps the fix local to the driver use site and avoids out-of-b= ounds > > > > reads from malformed or unsupported reference list entries. > > > > > > > > Signed-off-by: Pengpeng Hou > > > > > > Acked-by: Jernej Skrabec > > > > Tested-by: Chen-Yu Tsai > > > > This fixes a KASAN slab-use-after-free warning when running fluster H.2= 64 > > tests. > > Ah, very good, can you cite which test caused that ? I didn't expect flus= ter to > cover cases with missing references. I think it will be handy for future > testing. Looks like it is FM1_BT_B. And it only happens on the first run after reboo= t, or KASAN just only reports it once. BTW, this would be a lot easier to figure out if we could get fluster to output a system timestamp for each decode run (at least in single job mode)= . I had to hack in delays between each decode rune, and then look at `dmesg -= w` and switching back to the window that has fluster running once the warning triggers. ChenYu