Re: [PATCH v2 08/17] media: apple: avd: add vp9 support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] media: apple: avd: integer underflow in set_tiles() leads to out-of-bounds DMA read
--

commit dea68a18dd2979fd1f45ba84519d873291b90e56
Author: Sofus Forstreuter <sofus.c@icloud.com>

media: apple: avd: add vp9 support

This commit introduces hardware VP9 decoding support for the Apple Video
Decoder (AVD). It achieves a fluster score of 216/305 for VP9-TEST-VECTORS.

> diff --git a/drivers/media/platform/apple/avd/avd-vp9.c b/drivers/media/platform/apple/avd/avd-vp9.c
> new file mode 100644
> index 0000000000000..f7c0ee6b70129
> --- /dev/null
> +++ b/drivers/media/platform/apple/avd/avd-vp9.c

[ ... ]

> +static int set_tiles(struct avd_ctx *ctx, struct avd_vp9_run *run)
> +{
> +	const struct v4l2_ctrl_vp9_frame *frame = run->decode_params;
> +	struct vb2_v4l2_buffer *src = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
> +	const u8 *data = vb2_plane_vaddr(&src->vb2_buf, 0);
> +	unsigned long plane_payload = vb2_get_plane_payload(&src->vb2_buf, 0);
> +	u32 offset =
> +		frame->uncompressed_header_size + frame->compressed_header_size;
> +	u32 num_tile_rows = 1 << frame->tile_rows_log2;
> +	u32 num_tile_cols = 1 << frame->tile_cols_log2;
> +	u32 tile_size, size;
> +	dma_addr_t coded_in;
> +
> +	if (plane_payload < offset)
> +		return -EINVAL;
> +	size = plane_payload - offset;
> +
> +	/* 6.2.6 Compute image size syntax */
> +	u32 sb_64_cols = (((frame->frame_width_minus_1 + 8) >> 3) + 7) >> 3;
> +	u32 sb_64_rows = (((frame->frame_height_minus_1 + 8) >> 3) + 7) >> 3;
> +
> +	for (int row = 0; row < num_tile_rows; row++)
> +		for (int col = 0; col < num_tile_cols; col++) {
> +			if (row == num_tile_rows - 1 &&
> +			    col == num_tile_cols - 1) {
> +				tile_size = size;

[Severity: Critical]
Could an underflowed size be assigned to tile_size here?

If size underflowed in a previous iteration, this assignment could result in a
massive out-of-bounds DMA read by the VPU when tile_size is pushed to the
hardware command buffer.

> +			} else {
> +				if (offset > plane_payload)
> +					return -EINVAL;
> +				tile_size = get_unaligned_be32(&data[offset]);
> +				if (tile_size > size - 4)

[Severity: Critical]
Does this code underflow size if the remaining payload is less than 4 bytes?

If a userspace caller provides a VP9 frame payload where plane_payload has
only 1 to 3 bytes remaining after offset, the offset > plane_payload check
evaluates to false. This allows get_unaligned_be32() to read out of bounds.
The unsigned arithmetic size - 4 would then underflow to a large value, causing
the size validation to incorrectly pass and permanently underflowing size for
subsequent tile loops.

> +					return -EINVAL;
> +				offset += 4;
> +				size -= 4;
> +			}

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926-avd-v2-0-ecebe6a3648e@icloud.com?part=8