[PATCH] media: cedrus: skip invalid H.264 reference list entries

[Chen-Yu Tsai]

On Sun, Mar 29, 2026 at 5:21 PM Jernej Škrabec <jernej.skrabec at gmail.com> wrote:
>
> Dne torek, 24. marec 2026 ob 09:08:56 Srednjeevropski poletni čas je Pengpeng Hou napisal(a):
> > Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the
> > stateless slice control and later uses their indices to look up
> > decode->dpb[] in _cedrus_write_ref_list().
> >
> > Rejecting such controls in cedrus_try_ctrl() would break existing
> > userspace, since stateless H.264 reference lists may legitimately carry
> > out-of-range indices for missing references. Instead, guard the actual
> > DPB lookup in Cedrus and skip entries whose indices do not fit the fixed
> > V4L2_H264_NUM_DPB_ENTRIES array.
> >
> > This keeps the fix local to the driver use site and avoids out-of-bounds
> > reads from malformed or unsupported reference list entries.
> >
> > Signed-off-by: Pengpeng Hou <pengpeng at iscas.ac.cn>
>
> Acked-by: Jernej Skrabec <jernej.skrabec at gmail.com>

Tested-by: Chen-Yu Tsai <wens at kernel.org>

This fixes a KASAN slab-use-after-free warning when running fluster H.264
tests.