FAILED: patch "[PATCH] media: v4l2-ctrls: validate HEVC tile counts" failed to apply to 5.10-stable tree

FAILED: patch "[PATCH] media: v4l2-ctrls: validate HEVC tile counts" failed to apply to 5.10-stable tree

[gregkh]

The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x dc694a9929f7cb9c88ef91e45eb982b7bbe5a477
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026091645-habitat-untoasted-f76f@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From dc694a9929f7cb9c88ef91e45eb982b7bbe5a477 Mon Sep 17 00:00:00 2001
From: Michael Bommarito <michael.bommarito@gmail.com>
Date: Tue, 16 Jun 2026 22:18:58 -0400
Subject: [PATCH] media: v4l2-ctrls: validate HEVC tile counts

The stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from
column_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[]
and use them as tile-loop bounds, but std_validate_compound() does not
bound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling
enabled whose tile counts exceed the uAPI array capacity, mirroring the
existing compound-control range checks.

Fixes: 256fa3920874 ("media: v4l: Add definitions for HEVC stateless decoding")
Assisted-by: Claude:claude-opus-4-8
Cc: stable@vger.kernel.org
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
index 5b8a594fb9e2..9b6121a3a2d2 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -1253,6 +1253,18 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
 
 			p_hevc_pps->flags &=
 				~V4L2_HEVC_PPS_FLAG_LOOP_FILTER_ACROSS_TILES_ENABLED;
+		} else {
+			/*
+			 * These count the entries the stateless HEVC drivers
+			 * read from column_width_minus1[] / row_height_minus1[]
+			 * and use as tile-loop bounds.
+			 */
+			if (p_hevc_pps->num_tile_columns_minus1 >=
+			    ARRAY_SIZE(p_hevc_pps->column_width_minus1))
+				return -EINVAL;
+			if (p_hevc_pps->num_tile_rows_minus1 >=
+			    ARRAY_SIZE(p_hevc_pps->row_height_minus1))
+				return -EINVAL;
 		}
 
 		if (p_hevc_pps->flags &

[PATCH 5.10.y 1/2] media: v4l2-ctrls: split up into four source files

[Sasha Levin]

From: Hans Verkuil <hverkuil-cisco@xs4all.nl>

[ Upstream commit 71c689dc2e732d4cb190aaf0edea73116b1611bd ]

The v4l2-ctrls.c source has become much too big, so split it up
into four separate parts:

v4l2-ctrls-core.c: contains the core framework code
v4l2-ctrls-api.c: contains the uAPI interface to the framework
v4l2-ctrls-defs.c: contains the control definitions
v4l2-ctrls-request.c: contains the Request API helpers

And it adds a new v4l2-ctrls-priv.h.

No code was changed, but a number of checkpatch.pl warnings were
fixed (alignment, f == NULL -> !f, long comment block coding style,
unsigned -> unsigned int).

The copyright statements were updated as well since they were
quite out of date.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

[5.10 dependency adaptation for dc694a9929f7]

Limit this dependency to renaming the existing stable v4l2-ctrls.c to
v4l2-ctrls-core.c and updating its object name in the Makefile. Preserve
the source contents byte for byte, including all stable fixes, and keep
v4l2-clk.o in the videodev object list. No functions are added or changed.

The target's HEVC PPS validation context already exists in this stable
source; only the upstream filename is needed for the target to apply.
Drop the remaining source split, private header, and documentation hunk:
those changes are unnecessary for the target, and the documentation file
is absent from this branch. The original subject is retained as required.

[ sashal: Reduced backport -- upstream 71c689dc2e732 touches 8 file(s), this
  backport carries 2. Not backported here:
  Documentation/userspace-api/media/v4l/ext-ctrls-codec-stateless.rst
  drivers/media/v4l2-core/v4l2-ctrls-api.c
  drivers/media/v4l2-core/v4l2-ctrls.c
  drivers/media/v4l2-core/v4l2-ctrls-defs.c
  drivers/media/v4l2-core/v4l2-ctrls-priv.h
  drivers/media/v4l2-core/v4l2-ctrls-request.c
  This note is generated from the file lists only; see the resolution record
  for the reasoning. ]

Stable-dep-of: dc694a9929f7 ("media: v4l2-ctrls: validate HEVC tile counts")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/v4l2-core/Makefile                            | 2 +-
 drivers/media/v4l2-core/{v4l2-ctrls.c => v4l2-ctrls-core.c} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename drivers/media/v4l2-core/{v4l2-ctrls.c => v4l2-ctrls-core.c} (100%)

diff --git a/drivers/media/v4l2-core/Makefile b/drivers/media/v4l2-core/Makefile
index 2ef0c7c958a24..a9926ef97db38 100644
--- a/drivers/media/v4l2-core/Makefile
+++ b/drivers/media/v4l2-core/Makefile
@@ -6,7 +6,7 @@
 tuner-objs	:=	tuner-core.o
 
 videodev-objs	:=	v4l2-dev.o v4l2-ioctl.o v4l2-device.o v4l2-fh.o \
-			v4l2-event.o v4l2-ctrls.o v4l2-subdev.o v4l2-clk.o \
+			v4l2-event.o v4l2-ctrls-core.o v4l2-subdev.o v4l2-clk.o \
 			v4l2-async.o v4l2-common.o
 videodev-$(CONFIG_COMPAT) += v4l2-compat-ioctl32.o
 videodev-$(CONFIG_TRACEPOINTS) += v4l2-trace.o
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
similarity index 100%
rename from drivers/media/v4l2-core/v4l2-ctrls.c
rename to drivers/media/v4l2-core/v4l2-ctrls-core.c
-- 
2.53.0

[PATCH 5.10.y 2/2] media: v4l2-ctrls: validate HEVC tile counts

[Sasha Levin]

From: Michael Bommarito <michael.bommarito@gmail.com>

[ Upstream commit dc694a9929f7cb9c88ef91e45eb982b7bbe5a477 ]

The stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from
column_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[]
and use them as tile-loop bounds, but std_validate_compound() does not
bound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling
enabled whose tile counts exceed the uAPI array capacity, mirroring the
existing compound-control range checks.

Fixes: 256fa3920874 ("media: v4l: Add definitions for HEVC stateless decoding")
Assisted-by: Claude:claude-opus-4-8
Cc: stable@vger.kernel.org
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/v4l2-core/v4l2-ctrls-core.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
index e754bb2a8a4e9..89957c835d4fa 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -1903,6 +1903,18 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx,
 
 			p_hevc_pps->flags &=
 				~V4L2_HEVC_PPS_FLAG_LOOP_FILTER_ACROSS_TILES_ENABLED;
+		} else {
+			/*
+			 * These count the entries the stateless HEVC drivers
+			 * read from column_width_minus1[] / row_height_minus1[]
+			 * and use as tile-loop bounds.
+			 */
+			if (p_hevc_pps->num_tile_columns_minus1 >=
+			    ARRAY_SIZE(p_hevc_pps->column_width_minus1))
+				return -EINVAL;
+			if (p_hevc_pps->num_tile_rows_minus1 >=
+			    ARRAY_SIZE(p_hevc_pps->row_height_minus1))
+				return -EINVAL;
 		}
 
 		if (p_hevc_pps->flags &
-- 
2.53.0