Re: [PATCH v6 13/14] media: mediatek: decoder: fill av1 buffer size with picinfo

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but this patch incompletely fixes a subsystem-wide issue by fixing AV1 while leaving the exact same bug in the VP9 stateless decoder. The C plane offset for reference frames is incorrectly calculated during dynamic resolution changes.
--

--- Patch [13]: [PATCH v6 13/14] media: mediatek: decoder: fill av1 buffer size with picinfo ---
commit 6fb6f33cb9871d45e294575fbf5e9c61dfa39742
Author: Kyrie Wu <kyrie.wu@mediatek.com>

media: mediatek: decoder: fill av1 buffer size with picinfo

The buffer size of y and c plane has been calculated in vcp/scp,
can fill each frame buffer size with picinfo directly.

> diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c
> --- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c
> +++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c

[ ... ]

> @@ -1845,8 +1846,10 @@ static int vdec_av1_slice_setup_core_buffer(struct vdec_av1_slice_instance *inst
>  		}
>  
>  		vref->y.dma_addr = vb2_dma_contig_plane_dma_addr(vb, 0);
> +		vref->y.size = vsi->fb.y.size;
> +		vref->c.size = vsi->fb.c.size;
>  		if (plane == 1)
> -			vref->c.dma_addr = vref->y.dma_addr + size;
> +			vref->c.dma_addr = vref->y.dma_addr + vsi->fb.y.size;

[Severity: High]
This is a pre-existing issue, but this fix for AV1 appears to leave the exact
same bug unfixed in the VP9 stateless decoder.

When a VP9 stream changes resolution mid-stream, the driver calculates the
C plane offset based on the current frame's width and height. Does this
erroneously apply the current-frame offset to all previously decoded
reference frames?

vdec_vp9_req_lat_if.c:vdec_vp9_slice_setup_core_buffer() {
    ...
    size = ALIGN(w, 64) * ALIGN(h, 64);
    ...
                    vsi->ref[i].c.dma_addr =
                        vsi->ref[i].y.dma_addr + size;
    ...
}

If the current frame is smaller than the reference frame, would the hardware
read corrupted chroma data from the middle of the reference frame's Y plane?

If the current frame is larger, could the calculated offset applied to the
reference frame point beyond its actual chroma offset, potentially triggering
a hardware fault via the IOMMU?

Could a similar fix using ctx->picinfo.fb_sz[0] be applied to VP9?

>  		else
>  			vref->c.dma_addr = vb2_dma_contig_plane_dma_addr(vb, 1);
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720012056.1026551-1-kyrie.wu@mediatek.com?part=13