[PATCH v2 3/6] media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity

[Benjamin Gaignard]

Le 14/06/2026 à 17:56, Michael Bommarito a écrit :
> prepare_tile_info_buffer() writes one entry per tile into the tile_sizes
> DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Bound
> the loop to that capacity so the writes stay inside the buffer.
>
> Fixes: cb5dd5a0fa51 ("media: hantro: Introduce G2/HEVC decoder")
> Signed-off-by: Michael Bommarito <michael.bommarito at gmail.com>
> Assisted-by: Claude:claude-opus-4-8
> ---
>   drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c | 6 ++++++
>   1 file changed, 6 insertions(+)
>
> diff --git a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
> index e8c2e83379def..94fbd79885aa5 100644
> --- a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
> +++ b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
> @@ -22,6 +22,12 @@ static void prepare_tile_info_buffer(struct hantro_ctx *ctx)
>   	bool tiles_enabled, uniform_spacing;
>   	u32 no_chroma = 0;
>   
> +	/* Bound the loops to the tile_sizes buffer capacity. */
> +	num_tile_cols = min_t(unsigned int, num_tile_cols,
> +			      ARRAY_SIZE(pps->column_width_minus1));
> +	num_tile_rows = min_t(unsigned int, num_tile_rows,
> +			      ARRAY_SIZE(pps->row_height_minus1));
> +

The same code is duplicated in rkvdec driver.
To avoid this problem in the future can you create helpers to get those
values where boundaries are checked ?

Regards,
Benjamin

>   	tiles_enabled = !!(pps->flags & V4L2_HEVC_PPS_FLAG_TILES_ENABLED);
>   	uniform_spacing = !!(pps->flags & V4L2_HEVC_PPS_FLAG_UNIFORM_SPACING);
>