[PATCH v3 7/9] media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity

[Benjamin Gaignard]

Le 17/06/2026 à 04:19, Michael Bommarito a écrit :
> rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group entry
> array by tile1 * tile_cols + tile0, reading up to tile_cols * tile_rows
> entries, lays out one descriptor per tile in the AV1_MAX_TILES tile_info
> buffer, and programs the real tile_cols / tile_rows into the hardware.
>
> The tile group entry control is a dynamic array sized to the number of
> entries userspace submitted, independent of tile_cols / tile_rows, so a
> frame that claims more tiles than entries reads past the array. A frame
> that claims more than AV1_MAX_TILES tiles also leaves the hardware
> programmed for more tiles than the descriptor buffer holds.
>
> Reject both in prepare_run(): tile_cols * tile_rows must not exceed the
> submitted entry count or AV1_MAX_TILES. The entry count is read via
> v4l2_ctrl_find() (ctrl->elems). This mirrors the bound the mediatek AV1
> decoder already enforces.
>
> Fixes: 727a400686a2 ("media: verisilicon: Add Rockchip AV1 decoder")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Michael Bommarito <michael.bommarito at gmail.com>

Reviewed-by: Benjamin Gaignard <benjamin.gaignard at collabora.com>

> ---
>   .../verisilicon/rockchip_vpu981_hw_av1_dec.c  | 25 ++++++++++++++++---
>   1 file changed, 22 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
> index fd00dbd79fe46..00aa566a4ccdb 100644
> --- a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
> +++ b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
> @@ -431,20 +431,39 @@ static int rockchip_vpu981_av1_dec_prepare_run(struct hantro_ctx *ctx)
>   {
>   	struct hantro_av1_dec_hw_ctx *av1_dec = &ctx->av1_dec;
>   	struct hantro_av1_dec_ctrls *ctrls = &av1_dec->ctrls;
> +	const struct v4l2_av1_tile_info *tile_info;
> +	struct v4l2_ctrl *tge;
> +	u32 num_tiles;
>   
>   	ctrls->sequence = hantro_get_ctrl(ctx, V4L2_CID_STATELESS_AV1_SEQUENCE);
>   	if (WARN_ON(!ctrls->sequence))
>   		return -EINVAL;
>   
> -	ctrls->tile_group_entry =
> -	    hantro_get_ctrl(ctx, V4L2_CID_STATELESS_AV1_TILE_GROUP_ENTRY);
> -	if (WARN_ON(!ctrls->tile_group_entry))
> +	tge = v4l2_ctrl_find(&ctx->ctrl_handler,
> +			     V4L2_CID_STATELESS_AV1_TILE_GROUP_ENTRY);
> +	if (WARN_ON(!tge))
>   		return -EINVAL;
> +	ctrls->tile_group_entry = tge->p_cur.p;
>   
>   	ctrls->frame = hantro_get_ctrl(ctx, V4L2_CID_STATELESS_AV1_FRAME);
>   	if (WARN_ON(!ctrls->frame))
>   		return -EINVAL;
>   
> +	/*
> +	 * rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group
> +	 * entry array by tile1 * tile_cols + tile0, so it reads up to
> +	 * tile_cols * tile_rows entries, and lays out one descriptor per tile
> +	 * in the AV1_MAX_TILES tile_info buffer while programming the real
> +	 * tile geometry into the hardware. Reject a frame that claims more
> +	 * tiles than userspace submitted, or more than the hardware tile
> +	 * buffer holds, so the read stays in bounds and the programmed
> +	 * geometry matches the descriptors written.
> +	 */
> +	tile_info = &ctrls->frame->tile_info;
> +	num_tiles = (u32)tile_info->tile_cols * tile_info->tile_rows;
> +	if (num_tiles > tge->elems || num_tiles > AV1_MAX_TILES)
> +		return -EINVAL;
> +
>   	ctrls->film_grain =
>   	    hantro_get_ctrl(ctx, V4L2_CID_STATELESS_AV1_FILM_GRAIN);
>