Re: [PATCH v3 0/9] media: bound stateless HEVC/AV1 tile counts

[Nicolas Dufresne <nicolas.dufresne@collabora.com>]

[-- Attachment #1: Type: text/plain, Size: 5368 bytes --]

Hi,

there was a problem with patchwork regarding that series. Mind trying to resent
to see if it can fix it ?

Nicolas

Le mardi 16 juin 2026 à 22:18 -0400, Michael Bommarito a écrit :
> The stateless HEVC and AV1 controls carry tile counts that several SoC
> decoder drivers consume as loop bounds and array indices when laying out
> fixed-size hardware descriptor buffers. std_validate_compound() does not
> bound them, so a crafted HEVC PPS or AV1 frame control can drive
> out-of-bounds writes and an AV1 divide-by-zero in the rkvdec, hantro,
> rockchip and mediatek decoders.
> 
>   1-2  reject out-of-range HEVC and AV1 tile counts in
>        std_validate_compound() (one patch per codec). For AV1 the per-
>        dimension bound is V4L2_AV1_MAX_TILE_{COLS,ROWS} and the total is
>        V4L2_AV1_MAX_TILE_COUNT.
>   3    add <media/v4l2-hevc.h> with bounded tile-count helpers.
>   4-5  use the helpers in rkvdec and hantro instead of open-coding the
>        clamp; rkvdec also bails before indexing the hardware
>        parameter-set table with an out-of-range HEVC PPS id.
>   6    guard the rockchip VPU981 AV1 divisor against tile_cols == 0 and
>        keep the descriptor writes inside the AV1_MAX_TILES buffer.
>   7    reject a rockchip AV1 frame whose tile_cols * tile_rows exceeds the
>        submitted tile group entry count or the AV1_MAX_TILES descriptor
>        capacity, which set_tile_info() would otherwise read past or leave
>        under-described while programming the larger geometry.
>   8    bound the mediatek AV1 tile-start copy.
>   9    KUnit coverage for the tile-count validation.
> 
> Changes since v2:
>   - Split the combined HEVC+AV1 validation into one patch per codec, each
>     with a single Fixes tag (Benjamin Gaignard).
>   - Move the AV1 total-tile bound into validate_av1_tile_info() using the
>     uAPI V4L2_AV1_MAX_TILE_COUNT, instead of clamping tile_cols/tile_rows
>     in the rockchip driver, which would have corrupted the values written
>     to the hardware registers (Benjamin Gaignard's NACK on v2 4/6).
>   - Add <media/v4l2-hevc.h> with shared bounded tile-count helpers so
>     rkvdec and hantro no longer duplicate the clamp (Benjamin Gaignard).
>   - New patch 7: reject a rockchip AV1 frame that claims more tiles than
>     the submitted tile group entry array holds (set_tile_info() indexes
>     it by tile_cols * tile_rows) or more than AV1_MAX_TILES (the hardware
>     descriptor buffer), which would otherwise leave the hardware
>     programmed for more tiles than the buffer describes. mediatek already
>     guards the entry count; rockchip now guards both.
> 
> checkpatch --strict: 0 errors on all nine. Patches 3 and 9 each carry one
> "added file ... does MAINTAINERS need updating?" warning for the new
> <media/v4l2-hevc.h> and the KUnit test file; both already fall under the
> existing include/media/ and drivers/media/v4l2-core/ MAINTAINERS entries,
> so no MAINTAINERS change is needed. (checkpatch's SPDX sub-check did not
> run in my environment -- spdxcheck.py needs python3-ply -- but the SPDX
> headers are present on both new files.)
> 
> The tile-count validation is exercised with KUnit (patch 9): in-range
> HEVC/AV1 counts pass, out-of-range per-dimension counts and an AV1 grid
> whose product exceeds V4L2_AV1_MAX_TILE_COUNT are rejected, and the
> zero-initialised AV1 frame control that v4l2-compliance and existing
> userspace submit still passes.
> 
> v2:
> https://lore.kernel.org/all/20260614155609.3107600-1-michael.bommarito@gmail.com/
> 
> Michael Bommarito (9):
>   media: v4l2-ctrls: validate HEVC tile counts
>   media: v4l2-ctrls: validate AV1 tile counts
>   media: hevc: add bounded tile-count helpers
>   media: rkvdec: bound HEVC tile loops and PPS id to the array capacity
>   media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer
>     capacity
>   media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
>   media: verisilicon: rockchip: reject AV1 frames exceeding the tile
>     capacity
>   media: mediatek: vcodec: bound AV1 tile-start copy to the array
>     capacity
>   media: v4l2-ctrls: add KUnit tests for compound control tile
>     validation
> 
>  .../vcodec/decoder/vdec/vdec_av1_req_lat_if.c |   5 +-
>  .../rockchip/rkvdec/rkvdec-hevc-common.c      |  14 +-
>  .../platform/rockchip/rkvdec/rkvdec-hevc.c    |   7 +-
>  .../rockchip/rkvdec/rkvdec-vdpu381-hevc.c     |   2 +
>  .../platform/verisilicon/hantro_g2_hevc_dec.c |   6 +-
>  .../verisilicon/rockchip_vpu981_hw_av1_dec.c  |  57 +++++--
>  drivers/media/v4l2-core/Kconfig               |  12 ++
>  .../media/v4l2-core/v4l2-ctrls-core-test.c    | 145 ++++++++++++++++++
>  drivers/media/v4l2-core/v4l2-ctrls-core.c     |  36 +++++
>  include/media/v4l2-hevc.h                     |  41 +++++
>  10 files changed, 306 insertions(+), 19 deletions(-)
>  create mode 100644 drivers/media/v4l2-core/v4l2-ctrls-core-test.c
>  create mode 100644 include/media/v4l2-hevc.h
> 
> 
> base-commit: e24a98d6884a6e4203a77a94f070a59fcab95208

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]