Re: [PATCH v2 1/3] media: rkvdec: hevc: tighten EXT SPS RPS control dimensions

[Nicolas Dufresne <nicolas.dufresne@collabora.com>]

[-- Attachment #1: Type: text/plain, Size: 1815 bytes --]

Le mercredi 27 mai 2026 à 15:47 -0400, Michael Bommarito a écrit :
> The VDPU381 HEVC driver registers V4L2_CID_STATELESS_HEVC_EXT_SPS_ST_RPS
> and V4L2_CID_STATELESS_HEVC_EXT_SPS_LT_RPS with .cfg.dims = { 65 }, but
> the HEVC spec caps num_short_term_ref_pic_sets at 64 (ITU-T H.265 7.4.8)
> and num_long_term_ref_pics_sps at 32 (7.4.3.2.1). The hardware descriptor
> table (struct rkvdec_rps) sizes match those spec limits: refs[32] and
> short_term_ref_sets[64].
> 
> Reduce the dims to { 64 } and { 32 } respectively so the V4L2 control
> framework rejects oversized payloads before any driver code runs.
> 
> Fixes: c9a59dc2acc7 ("media: rkvdec: Add HEVC support for the VDPU381
> variant")
> Cc: stable@vger.kernel.org
> Suggested-by: Detlev Casanova <detlev.casanova@collabora.com>
> Assisted-by: Claude:claude-opus-4-7
> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>

Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>

> ---
>  drivers/media/platform/rockchip/rkvdec/rkvdec.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/platform/rockchip/rkvdec/rkvdec.c
> b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
> index 1d1e9bfef8e96..4fd06f4c04db0 100644
> --- a/drivers/media/platform/rockchip/rkvdec/rkvdec.c
> +++ b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
> @@ -278,12 +278,12 @@ static const struct rkvdec_ctrl_desc
> vdpu38x_hevc_ctrl_descs[] = {
>  	{
>  		.cfg.id = V4L2_CID_STATELESS_HEVC_EXT_SPS_ST_RPS,
>  		.cfg.ops = &rkvdec_ctrl_ops,
> -		.cfg.dims = { 65 },
> +		.cfg.dims = { 64 },
>  	},
>  	{
>  		.cfg.id = V4L2_CID_STATELESS_HEVC_EXT_SPS_LT_RPS,
>  		.cfg.ops = &rkvdec_ctrl_ops,
> -		.cfg.dims = { 65 },
> +		.cfg.dims = { 32 },
>  	},
>  };
>  

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]