Re: [PATCH 2/2] media: verisilicon: Protect G2 HEVC decoder against invalid DPB index

From: Benjamin Gaignard <benjamin.gaignard@collabora.com>
To: Nicolas Dufresne <nicolas.dufresne@collabora.com>,
	Philipp Zabel <p.zabel@pengutronix.de>,
	Mauro Carvalho Chehab <mchehab@kernel.org>,
	Shawn Guo <shawnguo@kernel.org>,
	Sascha Hauer <s.hauer@pengutronix.de>,
	Pengutronix Kernel Team <kernel@pengutronix.de>,
	Fabio Estevam <festevam@gmail.com>,
	Jernej Skrabec <jernej.skrabec@gmail.com>,
	Hans Verkuil <hverkuil@kernel.org>,
	Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
Cc: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
	linux-media@vger.kernel.org, linux-rockchip@lists.infradead.org,
	linux-kernel@vger.kernel.org, imx@lists.linux.dev,
	linux-arm-kernel@lists.infradead.org, kernel@collabora.com,
	Stable@vger.kernel.org
Subject: Re: [PATCH 2/2] media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
Date: Tue, 23 Sep 2025 14:59:02 +0200	[thread overview]
Message-ID: <aafd2f8d-be8e-4929-a21c-c8f066e2f6f1@collabora.com> (raw)
In-Reply-To: <20250922-imx8mq-hantro-g2-hang-v1-2-67d00eb6a548@collabora.com>


Le 22/09/2025 à 20:43, Nicolas Dufresne a écrit :
> Fix the Hantro G2 HEVC decoder so that we use DPB index 0 whenever a
> ninvalid index is received from user space. This protects the hardware
> from doing faulty memory access which then leads to bus errors.
>
> To be noted that when a reference is missing, userspace such as GStreamer
> passes an invalid DPB index of 255. This issue was found by seeking to a
> CRA picture using GStreamer. The framework is currently missing the code
> to skip over RASL pictures placed after the CRA. This situation can also
> occur while doing live streaming over lossy transport.
>
> Fixes: cb5dd5a0fa518 ("media: hantro: Introduce G2/HEVC decoder")
> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>

Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>

> ---
>   drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c | 15 +++++++++++++--
>   1 file changed, 13 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
> index f066636e56f98560d9b1c5036691e3c34dd13b1f..e8c2e83379def53ce7fd86d6929ed4f5e0db068e 100644
> --- a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
> +++ b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
> @@ -283,6 +283,15 @@ static void set_params(struct hantro_ctx *ctx)
>   	hantro_reg_write(vpu, &g2_apf_threshold, 8);
>   }
>   
> +static u32 get_dpb_index(const struct v4l2_ctrl_hevc_decode_params *decode_params,
> +			 const u32 index)
> +{
> +	if (index > decode_params->num_active_dpb_entries)
> +		return 0;
> +
> +	return index;
> +}
> +
>   static void set_ref_pic_list(struct hantro_ctx *ctx)
>   {
>   	const struct hantro_hevc_dec_ctrls *ctrls = &ctx->hevc_dec.ctrls;
> @@ -355,8 +364,10 @@ static void set_ref_pic_list(struct hantro_ctx *ctx)
>   		list1[j++] = list1[i++];
>   
>   	for (i = 0; i < V4L2_HEVC_DPB_ENTRIES_NUM_MAX; i++) {
> -		hantro_reg_write(vpu, &ref_pic_regs0[i], list0[i]);
> -		hantro_reg_write(vpu, &ref_pic_regs1[i], list1[i]);
> +		hantro_reg_write(vpu, &ref_pic_regs0[i],
> +				 get_dpb_index(decode_params, list0[i]));
> +		hantro_reg_write(vpu, &ref_pic_regs1[i],
> +				 get_dpb_index(decode_params, list1[i]));
>   	}
>   }
>   
>

_______________________________________________
Linux-rockchip mailing list
Linux-rockchip@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-rockchip