From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5F2740627B for ; Mon, 13 Jul 2026 12:10:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944631; cv=none; b=u0c6jSicAiA3zNzSfO85irWKPwbxo9DCT7ZpyORQxr7jwkCf9hDv2VfD0M9GoupIfytYdPHK41uvn4ld2XLT8mEbW/rOhDNf8FLIzapiYyKXRNcpt1CFv9VuNuPA5P7CjGT2U4eF285/7/XPx86yJSVLsIRnLnQxreZhZT/OulA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783944631; c=relaxed/simple; bh=0h03bQuoUWZdGVlD74sLbbLEbbwu1nwFtUhUFitPw/I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=J9EO7q1oDabpYIKZ3/YvpZV1xwSyM47vwE7EOJdQtzbrv0lmxbizIZWzkonLmGNURZvzMwDjvFLVVQ/ujql5ig1H7Tcl8Cfn/+ETCkhRwiWoJgwUds+grJFlPQtjYvuMnuFvSduJm5xz6KjKnfGya4PSaMqMjMvy4tX7AE7KoIY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KtONpVPO; arc=none smtp.client-ip=209.85.210.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KtONpVPO" Received: by mail-pf1-f182.google.com with SMTP id d2e1a72fcca58-848595b338cso3446379b3a.0 for ; Mon, 13 Jul 2026 05:10:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944629; x=1784549429; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0g+WRe3x8NF1Lsmp6BpHJTM0uwdyJj9zKy0hm9x5WoY=; b=KtONpVPO4LcOHG8gfSNZNut1la4HkJOlA6soP0oV590gTu/6HPRSh2klWuU3b03OPy eWcwEFXNzAxZ5g6/pGbdty2w9ytfkage6OJu5lNezk5pZqGmOEhOn1Y832G4HoYokdWw 75QVUuKYznje0dfuDFo7hwiI1BTA5vJKB/UI9iZQGanedfuLJphypjtAvdZG2epNg7h9 q3OcW+CAaWm1ESROYFVw4c5/4/+8IcpCGd1t9P+9MdF9CJl18DlkKoxI0yRsoCcRwcvk KetrRYXR0qMX7QbwGT8+xXmeZcMAEkh909iI1mfJ2xmhumyhyJejFITpZttMV7Y2/ows rpaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944629; x=1784549429; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0g+WRe3x8NF1Lsmp6BpHJTM0uwdyJj9zKy0hm9x5WoY=; b=RPBghmQDsYNIlzPSfki08xrXXe8CiC7vXd7aDtyW5wFozSAFUGoyN24++3EtTbwmKT oOY3cHu7hHCM0ulC7J7Fp+2n1GS/tTo0bH0HJ/PCATUP0vpQjyw1yOus4IOT8ab8+jcA cZbbf8v6Qel/f5CZlquxBcs6tbqjnUkmjPPIM0DljhKPt7cqKCrgBXKBB0NMRWABudhE NhAnPxbaRpZWUZMc34kEKHLgZfi+B21j/Ho54wgW0PXNMLluEGQuCuyVG66+dRng19Zq vnx8yAbI9d2Jwo8vesuleRkW5RgiHLjBZst7YDs8K0HDmEWep9rHRj/HKLzCMd8FLGmf O8Ig== X-Forwarded-Encrypted: i=1; AHgh+Rp8SO2hZjQNDKhzXvz5BI0BXcCfL5UIxyY0ZjlBHqkb0on3oZRt78comkyVEf+NWraHoTBXNeiG/wr441C3@lists.linux.dev X-Gm-Message-State: AOJu0YzHlszKaG1zyzxtdW7AguzecafgfdjRtMpP9tbcB9spoXZFo+84 MO5Ptpn386WS4DdRCDsKpxuSRu87R2ARpHzrp3jL4ZmbjQOvjNeKAh0C X-Gm-Gg: AfdE7cnsMNF7H8OmlbTBca4PAEhUHxrMjkDXpTPYYtkzLp/sCCxPWTgcBai8C+0mrVS 5+TQYalZZGjAdf9yUyxlLUOgdDruDnc2v6f81OVdjGriaBPVEu2uCArdLTDNOnnhOnIvQWYnlCj nXz5nDZ2m2MHb61G/zs7FgaffgRzinT5Ru3Zu8Mqez+P4yqawQ6V1O3wYZtZcMeN0BnfS41GIh1 FgyBA2/y1i/Aqi7UEy7UD1KuCL80AKblPtiyqDYVYCbZ/tHpZsjyue7e773m9vUpRv9i7FEwWnR Wi+T7ZBYSXz2Cokd9nuWUUOXc0WvKVRy43VVQSRdjc0SpopcMr8avISWglMpAU9Cdv3Del4p02P LRFSrO+/QsUJqY1r+oub5UBRMPTHbyWjUMvJ1MqtvhgU4T4Dm9BDy5BYBDzlO7Oi+62WouZrom0 VCrRBoj1VsBy3c27noaW+/ X-Received: by 2002:a05:6a21:6088:b0:3bf:9fc0:f6c2 with SMTP id adf61e73a8af0-3c1109ec872mr8713076637.11.1783944629120; Mon, 13 Jul 2026 05:10:29 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.10.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:10:28 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Cc: Anand Moon , Doruk Tan Ozturk , Nicolas Dufresne Subject: [PATCH v7 09/19] media: meson: vdec: Fix vp9 header update failure on invalid payloads Date: Mon, 13 Jul 2026 17:37:04 +0530 Message-ID: <20260713120840.17427-10-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> Precedence: bulk X-Mailing-List: linux-staging@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Ensure vp9_update_header() returns an explicit error code on invalid or malformed buffer payloads instead of silently returning zero. When v4l2-compliance injects short, empty, or uninitialized test buffers, the validation logic catches the out-of-bounds size anomalies, but returning 0 tricks the calling esparser infrastructure into treating it as a successful 0-byte header conversion. This causes the hardware decoder engine to stall out, resulting in subsequent stream-on timeouts and failure marks inside v4l2-test-buffers.cpp. Fix this by returning -EINVAL across all validation and bounds check failures to force immediate core framework buffer drops. Additionally, tighten array pointer checks, secure the mag_ptr bounds loop, and convert the superframe parsing indexer into an explicit if/else block for readability. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/esparser.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/media/meson/vdec/esparser.c index 959673742e699..edbfc829e2da8 100644 --- a/drivers/staging/media/meson/vdec/esparser.c +++ b/drivers/staging/media/meson/vdec/esparser.c @@ -97,11 +97,15 @@ static int vp9_update_header(struct amvdec_core *core, struct vb2_buffer *buf) unsigned char *old_header = NULL; dp = (uint8_t *)vb2_plane_vaddr(buf, 0); + if (!dp) + return -EINVAL; + dsize = vb2_get_plane_payload(buf, 0); - if (dsize == vb2_plane_size(buf, 0)) { - dev_warn(core->dev, "%s: unable to update header\n", __func__); - return 0; + if (dsize <= 0 || dsize > vb2_plane_size(buf, 0)) { + dev_warn(core->dev, "%s: invalid payload size %d\n", + __func__, dsize); + return -EINVAL; } marker = dp[dsize - 1]; @@ -109,13 +113,16 @@ static int vp9_update_header(struct amvdec_core *core, struct vb2_buffer *buf) num_frames = (marker & 0x7) + 1; mag = ((marker >> 3) & 0x3) + 1; mag_ptr = dsize - mag * num_frames - 2; - if (dp[mag_ptr] != marker) - return 0; + if (mag_ptr < 0 || dp[mag_ptr] != marker) + return -EINVAL; mag_ptr++; for (cur_frame = 0; cur_frame < num_frames; cur_frame++) { frame_size[cur_frame] = 0; for (cur_mag = 0; cur_mag < mag; cur_mag++) { + if (mag_ptr >= dsize) + return -EINVAL; + frame_size[cur_frame] |= (dp[mag_ptr] << (cur_mag * 8)); mag_ptr++; @@ -140,7 +147,7 @@ static int vp9_update_header(struct amvdec_core *core, struct vb2_buffer *buf) if (new_frame_size >= vb2_plane_size(buf, 0)) { dev_warn(core->dev, "%s: unable to update header\n", __func__); - return 0; + return -ENOMEM; } for (cur_frame = num_frames - 1; cur_frame >= 0; cur_frame--) { -- 2.50.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2BB45C43458 for ; Mon, 13 Jul 2026 12:10:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID:Date :Subject:To:From:Reply-To:Content-Type:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=0g+WRe3x8NF1Lsmp6BpHJTM0uwdyJj9zKy0hm9x5WoY=; b=hXnDoi52MRscqd oGud1+UzUQJRRFly9PKUPsAQGN0vta1clYTwSd1i4iC9hnB6/V3mIs+jgx4FoAnoY5s+YZP5kLm5x OcoCG3fXrtpTfVmUqHr6pOwj2aeL2EgR0ksZeCQdZoVXZR1XpXK9P7o5lwwRVwRfqN5PG791qU+A6 pVzZItLP/py9zyvT2iZnPehtmHvazLi+ZimP1BiHUwVlmY2g0ADAVJhJ/y5kOpxDPOgH2znsqR2VM 3BQoWIRShWQRp+KxEpLZHnUxdmkL10uqDn022zAiKL6yxw9F4hmpVDHYi2ED0MpfLvSvzAkGiqyLz 2/kEn0YwIZ9XSCRWCXsQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFUY-000000098oa-39M2; Mon, 13 Jul 2026 12:10:34 +0000 Received: from mail-pg1-x52c.google.com ([2607:f8b0:4864:20::52c]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFUT-000000098lW-47YF for linux-arm-kernel@lists.infradead.org; Mon, 13 Jul 2026 12:10:33 +0000 Received: by mail-pg1-x52c.google.com with SMTP id 41be03b00d2f7-caf45fc5202so768642a12.1 for ; Mon, 13 Jul 2026 05:10:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944629; x=1784549429; darn=lists.infradead.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0g+WRe3x8NF1Lsmp6BpHJTM0uwdyJj9zKy0hm9x5WoY=; b=mwZS+uiNuDAWdFe2D0rACYVJsGdRugi78eZMoqt7FL2EQcMkmvi0KBVIkDySEWLyfd LhlgoRR4S11OQKeNhOMZw3Qm74cWWvg2BEAX/is93GC86FIr0PSgaSRyWL2t74N0mQj9 6qn1xVWNbUGEVV1aLnL6pVh+/cHGSWp85VlpQ6AkdJg2cwCUn9mnQomkkvTlVn/Zd0vl zMMH/PjP40hlSIWS0iidLqHtLF2Pnc6BJDcfkyER89lz/eXWCPLJMLZNkT9lvHI3ECQw CuNqXa7iKIn88xANnIfZCQuYWJ7UFRxPVeEvPKz+gvZ/lxMYwjaClQSBJZBPyu3gKFiJ SlOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944629; x=1784549429; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0g+WRe3x8NF1Lsmp6BpHJTM0uwdyJj9zKy0hm9x5WoY=; b=aQExF5YrL71mC8xGESOCGV6fog7/4nD0SPomEiYQ39+9YS7R0o9SA/7pQDrs1D23+p vnLuuFrJd50l3yzsEqwQN8meyb3kNNxpzVvmyo+1t/vPSEx8z60edtzmgqyqDwU4OLyL qpM4Emhd6wihwARlny1uwVsDztgCGdPmDUWw5NhwuKGlyVe9vqOoyeniiPbiujFUeQhk WUJWWPInWn9n5T8st7Sc9jYNe1QhG2eCJg7yAZo4nfGIOMpVFW1FyCuhDnj+72V7qSWx REb8S08ypXK5k8SOSxJrpBkkHBgOZo5uBH9/zlkCPCXBTKrORRTLS8c1VOwasZbIedjZ RDGg== X-Forwarded-Encrypted: i=1; AHgh+RrZ4Q0EKIufabWwDYvAN9A4RLAnoxnUpy90KR2Ue3fYmOHyvkF0hmsas3BYTjpp/1CBGlB/3FzpI4wqMfXEk9Bi@lists.infradead.org X-Gm-Message-State: AOJu0Yw7ZXXtLow0q7D/7rtLmuQDACJDFcnNHwJRENMCtlpU1RwI7o/N zBwyC/hm7RnO1QB7w2P0uMmsRDg7OLctKLEJR8Dg9aIvJ3Q+Z/P1RyPp X-Gm-Gg: AfdE7cmLrSA5102AePlaqaUz2eqU74OtLgOj6oQJDsko/4CfrpNLJIm9Clrbr9nZcmF ePn2gbUSyDun9ZkJ3xdhGUuHDXwqDnUTYK9i+P+T5wmvim0moj4/cJTdZybSZJrjyo2VlIT8dmr 6j3oVZxERALSBKWq1/PBhYKaMZOCdiOumxrJgGjqsgG1infuaE9+Fc5H/qQTLxHUcqE80b0WQ1h wmixJttZg6Z+rkKW/CGUBLNx+yw6Mo/jC1KlDoOy5UqsZTrrECeY8fplP+FqAOJR6sms+3/sfPk 9rbn/isBMFM7GmfsA2QVtPkKf2d5OTwqkUON7NcZ+6taQjQUkLxlOh2f+KqQC50mAPnhS4e5iSe XS4SphtYu9fRluzF2n1dx65pjecA5gAnb7iJiai6N1ENKmewI17ge0vVoe9tWS2JXSAw1/hGQmF +2ddYfB1Y8+efdPktS/dkP X-Received: by 2002:a05:6a21:6088:b0:3bf:9fc0:f6c2 with SMTP id adf61e73a8af0-3c1109ec872mr8713076637.11.1783944629120; Mon, 13 Jul 2026 05:10:29 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.10.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:10:28 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Subject: [PATCH v7 09/19] media: meson: vdec: Fix vp9 header update failure on invalid payloads Date: Mon, 13 Jul 2026 17:37:04 +0530 Message-ID: <20260713120840.17427-10-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260713_051030_026535_212B96E9 X-CRM114-Status: GOOD ( 16.21 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Doruk Tan Ozturk , Nicolas Dufresne Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Ensure vp9_update_header() returns an explicit error code on invalid or malformed buffer payloads instead of silently returning zero. When v4l2-compliance injects short, empty, or uninitialized test buffers, the validation logic catches the out-of-bounds size anomalies, but returning 0 tricks the calling esparser infrastructure into treating it as a successful 0-byte header conversion. This causes the hardware decoder engine to stall out, resulting in subsequent stream-on timeouts and failure marks inside v4l2-test-buffers.cpp. Fix this by returning -EINVAL across all validation and bounds check failures to force immediate core framework buffer drops. Additionally, tighten array pointer checks, secure the mag_ptr bounds loop, and convert the superframe parsing indexer into an explicit if/else block for readability. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/esparser.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/media/meson/vdec/esparser.c index 959673742e699..edbfc829e2da8 100644 --- a/drivers/staging/media/meson/vdec/esparser.c +++ b/drivers/staging/media/meson/vdec/esparser.c @@ -97,11 +97,15 @@ static int vp9_update_header(struct amvdec_core *core, struct vb2_buffer *buf) unsigned char *old_header = NULL; dp = (uint8_t *)vb2_plane_vaddr(buf, 0); + if (!dp) + return -EINVAL; + dsize = vb2_get_plane_payload(buf, 0); - if (dsize == vb2_plane_size(buf, 0)) { - dev_warn(core->dev, "%s: unable to update header\n", __func__); - return 0; + if (dsize <= 0 || dsize > vb2_plane_size(buf, 0)) { + dev_warn(core->dev, "%s: invalid payload size %d\n", + __func__, dsize); + return -EINVAL; } marker = dp[dsize - 1]; @@ -109,13 +113,16 @@ static int vp9_update_header(struct amvdec_core *core, struct vb2_buffer *buf) num_frames = (marker & 0x7) + 1; mag = ((marker >> 3) & 0x3) + 1; mag_ptr = dsize - mag * num_frames - 2; - if (dp[mag_ptr] != marker) - return 0; + if (mag_ptr < 0 || dp[mag_ptr] != marker) + return -EINVAL; mag_ptr++; for (cur_frame = 0; cur_frame < num_frames; cur_frame++) { frame_size[cur_frame] = 0; for (cur_mag = 0; cur_mag < mag; cur_mag++) { + if (mag_ptr >= dsize) + return -EINVAL; + frame_size[cur_frame] |= (dp[mag_ptr] << (cur_mag * 8)); mag_ptr++; @@ -140,7 +147,7 @@ static int vp9_update_header(struct amvdec_core *core, struct vb2_buffer *buf) if (new_frame_size >= vb2_plane_size(buf, 0)) { dev_warn(core->dev, "%s: unable to update header\n", __func__); - return 0; + return -ENOMEM; } for (cur_frame = num_frames - 1; cur_frame >= 0; cur_frame--) { -- 2.50.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 792E4C43458 for ; Mon, 13 Jul 2026 12:10:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=vpsYPsxWko63gzltOJkepmDi9lpd+OiLpiu0a6xxXgo=; b=4wa3LG4zxC6Epr 3ttsqQ103sWIyxQ21DEw3cR5j9hBdPME4C4FvYHpQGQzKG69n2VPEbZa2qTUWQCEczBvbNtdMO1iV OcitOPSOYpW06CxjfI4bxg/FvYnboqyTkppadE4NHVX/nLnoSXLLrX0mvebm3VjY6a5xF4MoRPNiU zVp0Om1M6aEAh1X5JpR3+weu5Ghc38vPkUd2NMbZ3BrF8WKrPolcawD41WUTWdE1OLI+1BriTSdOX ucgjUyWVhx/9QKph7qtU+sWrmLdnRpdpsCg7QvoetPGJmWLlPlKWKqwKB+6pnM0rI0Q9ly1Mzgxgc dOpXXz8aRX2i9/4qP6TQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFUX-000000098ng-2O0v; Mon, 13 Jul 2026 12:10:33 +0000 Received: from mail-pf1-x433.google.com ([2607:f8b0:4864:20::433]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjFUT-000000098lX-47VA for linux-amlogic@lists.infradead.org; Mon, 13 Jul 2026 12:10:31 +0000 Received: by mail-pf1-x433.google.com with SMTP id d2e1a72fcca58-8485ef63b68so2574626b3a.1 for ; Mon, 13 Jul 2026 05:10:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783944629; x=1784549429; darn=lists.infradead.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0g+WRe3x8NF1Lsmp6BpHJTM0uwdyJj9zKy0hm9x5WoY=; b=mwZS+uiNuDAWdFe2D0rACYVJsGdRugi78eZMoqt7FL2EQcMkmvi0KBVIkDySEWLyfd LhlgoRR4S11OQKeNhOMZw3Qm74cWWvg2BEAX/is93GC86FIr0PSgaSRyWL2t74N0mQj9 6qn1xVWNbUGEVV1aLnL6pVh+/cHGSWp85VlpQ6AkdJg2cwCUn9mnQomkkvTlVn/Zd0vl zMMH/PjP40hlSIWS0iidLqHtLF2Pnc6BJDcfkyER89lz/eXWCPLJMLZNkT9lvHI3ECQw CuNqXa7iKIn88xANnIfZCQuYWJ7UFRxPVeEvPKz+gvZ/lxMYwjaClQSBJZBPyu3gKFiJ SlOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783944629; x=1784549429; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0g+WRe3x8NF1Lsmp6BpHJTM0uwdyJj9zKy0hm9x5WoY=; b=PNXBWW5lpRaTnyeIPqdgbyrJVb0FFxAUIZlSkzlg/JP+RB7l6/9Mu10nU3p96xGpQw xf/rAJ5b3xYKut8KhuE+pjUD4QpsV2JjXKVWRU61MtkyN8YxUOpg9c2teiDCb4YtAPnH 2XxzrrroklnZzROobcWf40Qq/qfUwy3/klPMkEpLXqzQU0rrX8+Bx4giX4NPVZNaXeQn 2L54t/Y+0BFolQeYOoA5yQXxHA6BT6ferxp+WW2gQhcWol2OfSQbRs4v6nBf5fRq2J6d JymU29jtgkGZF5W8IfdR0Mp1fQ6SVD+/79Vnd6vas9Tx073T/3vawReAyfoR0IptwLGE kyRA== X-Forwarded-Encrypted: i=1; AHgh+RrLV66RUEZikN5HIP7AnC/HqNV0g6Nn8DBrW/LoQrPadZrdVLdGlOJ6TwYDZewiNZjdp8KBEdF0dUASnN2F@lists.infradead.org X-Gm-Message-State: AOJu0YyL56mmGtL9nXJgQP5FI4JU2548aZ4Fp7oiPElCiHKxXFj2K1n6 diMRV5FhcNcxSddTIEUaV59AUlJGvpi7LLaE9kRlmIozvgG7IBLwLGvS X-Gm-Gg: AfdE7cmEWYRc4n1gAksG+N61M6Y+vNEpZwZhBYnCYMSgC11lT7uKPIFIGaZi1ecEaF4 MWD+CrRByR49dIM2O7tzhPwdJypLNV+ouoFOM1hrQn73A3ZT7Mt3c2djz4graiGeZwv06oDC/cB /9WgMglW8H424UrFdsHfmU3eI1AoQOcc809PYvibo6pT9k03XPg1145yCvhuvJRAKkyrSMGp+KI QB3Tf5pnhXdTL4GXgqIZYrlnXWMUhygfz/0cApz63BYk2xJ4+VkRnA6gh2thX7GU/TKYCdy7b25 siKrZkbNrP6Fbf0wSbx1YGAtJIvHV8t5Gnp2sR1mURSzENUKwVYRsYXazs1OeWnGKbzBp1YnOpn FAjFP3P5JE5aflDYfsGlyOyelzb2e6EWlMXauhJ/T4kDC+vICj0AZjtONoZ8fOR82wnyuC7p6ft fxpsZEntED2xG+/F8nGsvc X-Received: by 2002:a05:6a21:6088:b0:3bf:9fc0:f6c2 with SMTP id adf61e73a8af0-3c1109ec872mr8713076637.11.1783944629120; Mon, 13 Jul 2026 05:10:29 -0700 (PDT) Received: from rockpi-5b ([45.112.0.180]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311747f7293sm67756935eec.3.2026.07.13.05.10.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 05:10:28 -0700 (PDT) From: Anand Moon To: Neil Armstrong , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Kevin Hilman , Jerome Brunet , Martin Blumenstingl , Mauro Carvalho Chehab , Greg Kroah-Hartman , dri-devel@lists.freedesktop.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-amlogic@lists.infradead.org (open list:DRM DRIVERS FOR AMLOGIC SOCS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Amlogic Meson SoC support), linux-kernel@vger.kernel.org (open list), linux-media@vger.kernel.org (open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS), linux-staging@lists.linux.dev (open list:STAGING SUBSYSTEM) Subject: [PATCH v7 09/19] media: meson: vdec: Fix vp9 header update failure on invalid payloads Date: Mon, 13 Jul 2026 17:37:04 +0530 Message-ID: <20260713120840.17427-10-linux.amoon@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260713120840.17427-1-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260713_051030_026496_CB365A57 X-CRM114-Status: GOOD ( 14.58 ) X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Doruk Tan Ozturk , Nicolas Dufresne Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org Ensure vp9_update_header() returns an explicit error code on invalid or malformed buffer payloads instead of silently returning zero. When v4l2-compliance injects short, empty, or uninitialized test buffers, the validation logic catches the out-of-bounds size anomalies, but returning 0 tricks the calling esparser infrastructure into treating it as a successful 0-byte header conversion. This causes the hardware decoder engine to stall out, resulting in subsequent stream-on timeouts and failure marks inside v4l2-test-buffers.cpp. Fix this by returning -EINVAL across all validation and bounds check failures to force immediate core framework buffer drops. Additionally, tighten array pointer checks, secure the mag_ptr bounds loop, and convert the superframe parsing indexer into an explicit if/else block for readability. Cc: Nicolas Dufresne Signed-off-by: Anand Moon --- drivers/staging/media/meson/vdec/esparser.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/media/meson/vdec/esparser.c index 959673742e699..edbfc829e2da8 100644 --- a/drivers/staging/media/meson/vdec/esparser.c +++ b/drivers/staging/media/meson/vdec/esparser.c @@ -97,11 +97,15 @@ static int vp9_update_header(struct amvdec_core *core, struct vb2_buffer *buf) unsigned char *old_header = NULL; dp = (uint8_t *)vb2_plane_vaddr(buf, 0); + if (!dp) + return -EINVAL; + dsize = vb2_get_plane_payload(buf, 0); - if (dsize == vb2_plane_size(buf, 0)) { - dev_warn(core->dev, "%s: unable to update header\n", __func__); - return 0; + if (dsize <= 0 || dsize > vb2_plane_size(buf, 0)) { + dev_warn(core->dev, "%s: invalid payload size %d\n", + __func__, dsize); + return -EINVAL; } marker = dp[dsize - 1]; @@ -109,13 +113,16 @@ static int vp9_update_header(struct amvdec_core *core, struct vb2_buffer *buf) num_frames = (marker & 0x7) + 1; mag = ((marker >> 3) & 0x3) + 1; mag_ptr = dsize - mag * num_frames - 2; - if (dp[mag_ptr] != marker) - return 0; + if (mag_ptr < 0 || dp[mag_ptr] != marker) + return -EINVAL; mag_ptr++; for (cur_frame = 0; cur_frame < num_frames; cur_frame++) { frame_size[cur_frame] = 0; for (cur_mag = 0; cur_mag < mag; cur_mag++) { + if (mag_ptr >= dsize) + return -EINVAL; + frame_size[cur_frame] |= (dp[mag_ptr] << (cur_mag * 8)); mag_ptr++; @@ -140,7 +147,7 @@ static int vp9_update_header(struct amvdec_core *core, struct vb2_buffer *buf) if (new_frame_size >= vb2_plane_size(buf, 0)) { dev_warn(core->dev, "%s: unable to update header\n", __func__); - return 0; + return -ENOMEM; } for (cur_frame = num_frames - 1; cur_frame >= 0; cur_frame--) { -- 2.50.1 _______________________________________________ linux-amlogic mailing list linux-amlogic@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-amlogic