[PATCH v3 5/9] media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity

[Benjamin Gaignard]

Le 17/06/2026 à 04:19, Michael Bommarito a écrit :
> prepare_tile_info_buffer() writes one entry per tile into the tile_sizes
> DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the
> bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows()
> helpers so the loops stay inside the buffer.
>
> Fixes: cb5dd5a0fa51 ("media: hantro: Introduce G2/HEVC decoder")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Michael Bommarito <michael.bommarito at gmail.com>

Reviewed-by: Benjamin Gaignard <benjamin.gaignard at collabora.com>

> ---
>   drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
> index e8c2e83379def..e7a7c7a42467a 100644
> --- a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
> +++ b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
> @@ -5,6 +5,8 @@
>    * Copyright (C) 2020 Safran Passenger Innovations LLC
>    */
>   
> +#include <media/v4l2-hevc.h>
> +
>   #include "hantro_hw.h"
>   #include "hantro_g2_regs.h"
>   
> @@ -15,8 +17,8 @@ static void prepare_tile_info_buffer(struct hantro_ctx *ctx)
>   	const struct v4l2_ctrl_hevc_pps *pps = ctrls->pps;
>   	const struct v4l2_ctrl_hevc_sps *sps = ctrls->sps;
>   	u16 *p = (u16 *)((u8 *)ctx->hevc_dec.tile_sizes.cpu);
> -	unsigned int num_tile_rows = pps->num_tile_rows_minus1 + 1;
> -	unsigned int num_tile_cols = pps->num_tile_columns_minus1 + 1;
> +	unsigned int num_tile_rows = v4l2_hevc_pps_num_tile_rows(pps);
> +	unsigned int num_tile_cols = v4l2_hevc_pps_num_tile_columns(pps);
>   	unsigned int pic_width_in_ctbs, pic_height_in_ctbs;
>   	unsigned int max_log2_ctb_size, ctb_size;
>   	bool tiles_enabled, uniform_spacing;