[PATCH] media: iris: Fix out-of-bounds read in timestamp metadata fallback

[PATCH] media: iris: Fix out-of-bounds read in timestamp metadata fallback

[Vishnu Reddy]

inst->tss[] has VIDEO_MAX_FRAME (32) entries, so valid indexes are 0
through 31. iris_set_ts_metadata() writes at metadata_idx and then
increments it. After the 32nd input buffer, metadata_idx is 32 until
the next input buffer is queued.

If iris_get_ts_metadata() finds no matching timestamp in that window,
its fallback reads inst->tss[32], one entry past the end of the array.
UBSAN (Undefined Behavior Sanity Checker) reports this as an
array-index-out-of-bounds error.

Use the last written entry, metadata_idx - 1, in the fallback instead.
Fall back to slot 0 if nothing has been written yet. Even if stream off
and stream on happen multiple times on the same session, the fallback
always uses the latest metadata received.

Fixes: 17f2a485ca67 ("media: iris: implement vb2 ops for buf_queue and firmware response")
Cc: stable@vger.kernel.org
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
---
 drivers/media/platform/qcom/iris/iris_buffer.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c
index eb8de60c1177f..31cba99a665c1 100644
--- a/drivers/media/platform/qcom/iris/iris_buffer.c
+++ b/drivers/media/platform/qcom/iris/iris_buffer.c
@@ -865,9 +865,11 @@ static void iris_get_ts_metadata(struct iris_inst *inst, u64 timestamp_ns,
 		return;
 	}
 
+	i = inst->metadata_idx ? inst->metadata_idx - 1 : 0;
+
 	vbuf->flags &= ~mask;
-	vbuf->flags |= inst->tss[inst->metadata_idx].flags;
-	vbuf->timecode = inst->tss[inst->metadata_idx].tc;
+	vbuf->flags |= inst->tss[i].flags;
+	vbuf->timecode = inst->tss[i].tc;
 }
 
 int iris_vb2_buffer_done(struct iris_inst *inst, struct iris_buffer *buf)

---
base-commit: 2efb7a11f1aa4d2dc285fe2680cca22cb9f72f64
change-id: 20261013-fix-oob-tss-7d317d612cf0

Best regards,
--  
Vishnu Reddy <busanna.reddy@oss.qualcomm.com>

Re: [PATCH] media: iris: Fix out-of-bounds read in timestamp metadata fallback

[Deepa Guthyappa Madivalara]

On 10/16/2026 8:25 PM, Vishnu Reddy wrote:
> inst->tss[] has VIDEO_MAX_FRAME (32) entries, so valid indexes are 0
> through 31. iris_set_ts_metadata() writes at metadata_idx and then
> increments it. After the 32nd input buffer, metadata_idx is 32 until
> the next input buffer is queued.
>
> If iris_get_ts_metadata() finds no matching timestamp in that window,
> its fallback reads inst->tss[32], one entry past the end of the array.
> UBSAN (Undefined Behavior Sanity Checker) reports this as an
> array-index-out-of-bounds error.
>
> Use the last written entry, metadata_idx - 1, in the fallback instead.
> Fall back to slot 0 if nothing has been written yet. Even if stream off
> and stream on happen multiple times on the same session, the fallback
> always uses the latest metadata received.
>
> Fixes: 17f2a485ca67 ("media: iris: implement vb2 ops for buf_queue and firmware response")
> Cc: stable@vger.kernel.org
> Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
> ---
>   drivers/media/platform/qcom/iris/iris_buffer.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c
> index eb8de60c1177f..31cba99a665c1 100644
> --- a/drivers/media/platform/qcom/iris/iris_buffer.c
> +++ b/drivers/media/platform/qcom/iris/iris_buffer.c
> @@ -865,9 +865,11 @@ static void iris_get_ts_metadata(struct iris_inst *inst, u64 timestamp_ns,
>   		return;
>   	}
>   
> +	i = inst->metadata_idx ? inst->metadata_idx - 1 : 0;
> +
>   	vbuf->flags &= ~mask;
> -	vbuf->flags |= inst->tss[inst->metadata_idx].flags;
> -	vbuf->timecode = inst->tss[inst->metadata_idx].tc;
> +	vbuf->flags |= inst->tss[i].flags;
> +	vbuf->timecode = inst->tss[i].tc;
>   }
>   
>   int iris_vb2_buffer_done(struct iris_inst *inst, struct iris_buffer *buf)
>
> ---
> base-commit: 2efb7a11f1aa4d2dc285fe2680cca22cb9f72f64
> change-id: 20261013-fix-oob-tss-7d317d612cf0
>
> Best regards,
> --
> Vishnu Reddy <busanna.reddy@oss.qualcomm.com>

Tested-by: Deepa Madivalara <deepa.madivalara@oss.qualcomm.com>

Re: [PATCH] media: iris: Fix out-of-bounds read in timestamp metadata fallback

[Bryan O'Donoghue]

On 17/10/2026 04:25, Vishnu Reddy wrote:
> inst->tss[] has VIDEO_MAX_FRAME (32) entries, so valid indexes are 0
> through 31. iris_set_ts_metadata() writes at metadata_idx and then
> increments it. After the 32nd input buffer, metadata_idx is 32 until
> the next input buffer is queued.
> 
> If iris_get_ts_metadata() finds no matching timestamp in that window,
> its fallback reads inst->tss[32], one entry past the end of the array.
> UBSAN (Undefined Behavior Sanity Checker) reports this as an
> array-index-out-of-bounds error.
> 
> Use the last written entry, metadata_idx - 1, in the fallback instead.
> Fall back to slot 0 if nothing has been written yet. Even if stream off
> and stream on happen multiple times on the same session, the fallback
> always uses the latest metadata received.
> 
> Fixes: 17f2a485ca67 ("media: iris: implement vb2 ops for buf_queue and firmware response")
> Cc:stable@vger.kernel.org
> Signed-off-by: Vishnu Reddy<busanna.reddy@oss.qualcomm.com>
> ---
>   drivers/media/platform/qcom/iris/iris_buffer.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c
> index eb8de60c1177f..31cba99a665c1 100644
> --- a/drivers/media/platform/qcom/iris/iris_buffer.c
> +++ b/drivers/media/platform/qcom/iris/iris_buffer.c
> @@ -865,9 +865,11 @@ static void iris_get_ts_metadata(struct iris_inst *inst, u64 timestamp_ns,
>   		return;
>   	}
> 
> +	i = inst->metadata_idx ? inst->metadata_idx - 1 : 0;
> +
>   	vbuf->flags &= ~mask;
> -	vbuf->flags |= inst->tss[inst->metadata_idx].flags;
> -	vbuf->timecode = inst->tss[inst->metadata_idx].tc;
> +	vbuf->flags |= inst->tss[i].flags;
> +	vbuf->timecode = inst->tss[i].tc;
>   }
> 
>   int iris_vb2_buffer_done(struct iris_inst *inst, struct iris_buffer *buf)
> 
> ---
> base-commit: 2efb7a11f1aa4d2dc285fe2680cca22cb9f72f64
> change-id: 20261013-fix-oob-tss-7d317d612cf0
> 
> Best regards,
> --
> Vishnu Reddy<busanna.reddy@oss.qualcomm.com>

Just control the variable where it is owned/assigned - the index should 
never run outside of bounds - dealing with that out-of-bounds is a fixup 
that shouldn't have to be done.

Don't let the index overrun at all. That way the next function that 
reads the index, doesn't have to know or care that the index might run.

[0] % git diff
diff --git a/drivers/media/platform/qcom/iris/iris_common.c 
b/drivers/media/platform/qcom/iris/iris_common.c
index 25836561bcf3e..b2b9349c38ea9 100644
--- a/drivers/media/platform/qcom/iris/iris_common.c
+++ b/drivers/media/platform/qcom/iris/iris_common.c
@@ -33,9 +33,6 @@ void iris_set_ts_metadata(struct iris_inst *inst, 
struct vb2_v4l2_buffer *vbuf)
         struct vb2_buffer *vb = &vbuf->vb2_buf;
         u64 ts_us = vb->timestamp;

-       if (inst->metadata_idx >= ARRAY_SIZE(inst->tss))
-               inst->metadata_idx = 0;
-
         do_div(ts_us, NSEC_PER_USEC);

         inst->tss[inst->metadata_idx].flags = vbuf->flags & mask;
@@ -43,7 +40,10 @@ void iris_set_ts_metadata(struct iris_inst *inst, 
struct vb2_v4l2_buffer *vbuf)
         inst->tss[inst->metadata_idx].ts_us = ts_us;
         inst->tss[inst->metadata_idx].ts_ns = vb->timestamp;

-       inst->metadata_idx++;
+       if (inst->metadata_idx + 1 >= ARRAY_SIZE(inst->tss))
+               inst->metadata_idx = 0;
+       else
+               inst->metadata_idx++;
  }

  int iris_process_streamon_input(struct iris_inst *inst)

There should exist no window in time where the index is invalid.

---
bod

Re: [PATCH] media: iris: Fix out-of-bounds read in timestamp metadata fallback

[Birk Skyum]

On Sat, 17 Oct 2026 08:55:04 +0530, Vishnu Reddy wrote:
> If iris_get_ts_metadata() finds no matching timestamp in that window,
> its fallback reads inst->tss[32], one entry past the end of the array.

I hit the same report on a Lenovo Yoga Slim 7x (X1E80100) while playing
video in Chromium, and it reproduces on demand: decoding a 64-frame
H.264 clip with ffmpeg's h264_v4l2m2m triggers it at the end of the
stream, while clips of 30 to 63 frames do not:

  UBSAN: array-index-out-of-bounds in drivers/media/platform/qcom/iris/iris_buffer.c:932:26
  index 32 is out of range for type 'iris_ts_metadata [32]'

With this patch on 7.2.8, 22 decodes of 30 to 192 frames (64, 96, 128,
160 and 192 among them) gave no report, and the 64- and 96-frame
decodes match a software decode frame for frame, timestamps included.

Tested-by: Birk Skyum <birk.skyum@pm.me> # Lenovo Yoga Slim 7x (X1E80100)