Re: [PATCH v2 04/17] media: v4l2-ctrls: validate av1 tile info

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] media: v4l2-ctrls: out-of-bounds context_update_tile_id due to incorrect validation
--

commit e21c9b1dec9408bc9aafb56a531be7a72e6ad344
Author: Sofus Forstreuter <sofus.c@icloud.com>

media: v4l2-ctrls: validate av1 tile info

Many drivers use tile_cols and/or tile_rows, so make sure they are
valid.

> diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
> index 9caca56478d1a..f1d5049810747 100644
> --- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
> +++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
> @@ -800,10 +800,25 @@ static int validate_av1_film_grain(struct v4l2_ctrl_av1_film_grain *fg)
>  	return 0;
>  }
>  
> +static int validate_av1_tile_info(struct v4l2_av1_tile_info *ti)
> +{
> +	if (ti->tile_cols > V4L2_AV1_MAX_TILE_COLS ||
> +	    ti->tile_rows > V4L2_AV1_MAX_TILE_ROWS)
> +		return -EINVAL;
> +
> +	if (ti->context_update_tile_id > ti->tile_cols * ti->tile_rows)

[Severity: High]
Does this boundary check allow an out-of-bounds tile ID?

Since context_update_tile_id is a 0-based index, the valid IDs for a frame
with N total tiles (where N is ti->tile_cols * ti->tile_rows) should range
strictly from 0 to N-1.

Because this check uses the strictly greater than operator (>), a value
exactly equal to the total number of tiles will pass validation. Downstream
stateless decoder drivers (such as the Rockchip VPU driver) calculate and
program this tile ID directly into hardware registers. Instructing the
hardware to use an invalid, out-of-bounds tile index for CDF updates can
lead to out-of-bounds DMA memory writes or VPU hangs.

Should this use greater than or equal to (>=) instead?

> +		return -EINVAL;
> +
> +	return 0;
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926-avd-v2-0-ecebe6a3648e@icloud.com?part=4