[PATCH 07/10] staging: media: cedrus: validate VP8 frame size

[Nicolas Dufresne]

Hi,

Le lundi 02 novembre 2026 à 18:03 +0100, Jernej Skrabec a écrit :
> A VP8 key frame can change the frame size. If userspace doesn't
> reallocate the capture buffers, the hardware writes and reads past the
> buffers, which shows up as IOMMU page faults and decode timeouts.
> 
> Check the frame size in try_ctrl, like for the H.264 and HEVC SPS.
> 
> Fixes: 3c39a16d30d8 ("media: cedrus: Add support for VP8 decoding")
> Signed-off-by: Jernej Skrabec <jernej.skrabec at gmail.com>
> ---
>  drivers/staging/media/sunxi/cedrus/cedrus.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c
> index 45deebddb630..756243795de8 100644
> --- a/drivers/staging/media/sunxi/cedrus/cedrus.c
> +++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
> @@ -77,6 +77,11 @@ static int cedrus_try_ctrl(struct v4l2_ctrl *ctrl)
>  					  (sps->pic_width_in_mbs_minus1 + 1) * 16,
>  					  height))
>  			return -EINVAL;
> +	} else if (ctrl->id == V4L2_CID_STATELESS_VP8_FRAME) {
> +		const struct v4l2_ctrl_vp8_frame *frame = ctrl->p_new.p_vp8_frame;
> +
> +		if (cedrus_check_pic_size(ctx, frame->width, frame->height))
> +			return -EINVAL;

This is affected by my previous comment, let's discuss over the other report
first.

Nicolas

>  	} else if (ctrl->id == V4L2_CID_STATELESS_HEVC_SPS) {
>  		const struct v4l2_ctrl_hevc_sps *sps = ctrl->p_new.p_hevc_sps;
>  		unsigned int bit_depth, max_depth;
> @@ -270,6 +275,7 @@ static const struct cedrus_control cedrus_controls[] = {
>  	{
>  		.cfg = {
>  			.id	= V4L2_CID_STATELESS_VP8_FRAME,
> +			.ops	= &cedrus_ctrl_ops,
>  		},
>  		.capabilities	= CEDRUS_CAPABILITY_VP8_DEC,
>  	},
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: This is a digitally signed message part
URL: <http://lists.infradead.org/pipermail/linux-arm-kernel/attachments/20261102/44b418da/attachment-0001.sig>