| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <502dd378-db76-fbe0-c922-c0b3761e5eb8@collabora.com>
Date: Fri, 6 Jan 2023 09:22:57 +0100
From: Benjamin Gaignard <benjamin.gaignard@...labora.com>
To: Dan Carpenter <error27@...il.com>, oe-kbuild@...ts.linux.dev,
ezequiel@...guardiasur.com.ar, p.zabel@...gutronix.de,
mchehab@...nel.org, robh+dt@...nel.org,
krzysztof.kozlowski+dt@...aro.org, heiko@...ech.de,
daniel.almeida@...labora.com, nicolas.dufresne@...labora.co.uk
Cc: lkp@...el.com, oe-kbuild-all@...ts.linux.dev,
linux-media@...r.kernel.org, linux-rockchip@...ts.infradead.org,
devicetree@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
linux-kernel@...r.kernel.org, kernel@...labora.com
Subject: Re: [PATCH v2 10/13] media: verisilicon: Add Rockchip AV1 decoder
Le 06/01/2023 à 08:33, Dan Carpenter a écrit :
> Hi Benjamin,
>
> https://git-scm.com/docs/git-format-patch#_base_tree_information]
>
> url: https://github.com/intel-lab-lkp/linux/commits/Benjamin-Gaignard/dt-bindings-media-rockchip-vpu-Add-rk3588-vpu-compatible/20230104-010906
> base: git://linuxtv.org/media_tree.git master
> patch link: https://lore.kernel.org/r/20230103170058.810597-11-benjamin.gaignard%40collabora.com
> patch subject: [PATCH v2 10/13] media: verisilicon: Add Rockchip AV1 decoder
> config: ia64-randconfig-m041-20230101
> compiler: ia64-linux-gcc (GCC) 12.1.0
>
> If you fix the issue, kindly add following tag where applicable
> | Reported-by: kernel test robot <lkp@...el.com>
> | Reported-by: Dan Carpenter <error27@...il.com>
>
> smatch warnings:
> drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c:121 rockchip_vpu981_get_frame_index() error: buffer overflow 'frame->reference_frame_ts' 8 <= 8
> drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c:167 rockchip_vpu981_av1_dec_frame_ref() error: buffer overflow 'frame->global_motion.type' 8 <= 9
> drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c:1947 rockchip_vpu981_av1_dec_run() warn: missing error code 'ret'
>
> vim +121 drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
>
> 9223ba771533395 Benjamin Gaignard 2023-01-03 109
> 9223ba771533395 Benjamin Gaignard 2023-01-03 110 static int rockchip_vpu981_get_frame_index(struct hantro_ctx *ctx, int ref)
> 9223ba771533395 Benjamin Gaignard 2023-01-03 111 {
> 9223ba771533395 Benjamin Gaignard 2023-01-03 112 struct hantro_av1_dec_hw_ctx *av1_dec = &ctx->av1_dec;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 113 struct hantro_av1_dec_ctrls *ctrls = &av1_dec->ctrls;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 114 const struct v4l2_ctrl_av1_frame *frame = ctrls->frame;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 115 u64 timestamp;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 116 int i, idx = frame->ref_frame_idx[ref];
> 9223ba771533395 Benjamin Gaignard 2023-01-03 117
> 9223ba771533395 Benjamin Gaignard 2023-01-03 118 if (idx >= AV1_MAX_FRAME_BUF_COUNT || idx < 0)
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> Should this be V4L2_AV1_TOTAL_REFS_PER_FRAME?
Yes it should be.
I will fix that and the other warnings in v3.
Thanks,
Benjamin
>
> 9223ba771533395 Benjamin Gaignard 2023-01-03 119 return AV1_INVALID_IDX;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 120
> 9223ba771533395 Benjamin Gaignard 2023-01-03 @121 timestamp = frame->reference_frame_ts[idx];
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
>
> 9223ba771533395 Benjamin Gaignard 2023-01-03 122 for (i = 0; i < AV1_MAX_FRAME_BUF_COUNT; i++) {
> 9223ba771533395 Benjamin Gaignard 2023-01-03 123 if (!av1_dec->frame_refs[i].used)
> 9223ba771533395 Benjamin Gaignard 2023-01-03 124 continue;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 125 if (av1_dec->frame_refs[i].timestamp == timestamp)
> 9223ba771533395 Benjamin Gaignard 2023-01-03 126 return i;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 127 }
> 9223ba771533395 Benjamin Gaignard 2023-01-03 128
> 9223ba771533395 Benjamin Gaignard 2023-01-03 129 return AV1_INVALID_IDX;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 130 }
> 9223ba771533395 Benjamin Gaignard 2023-01-03 131
> 9223ba771533395 Benjamin Gaignard 2023-01-03 132 static int rockchip_vpu981_get_order_hint(struct hantro_ctx *ctx, int ref)
> 9223ba771533395 Benjamin Gaignard 2023-01-03 133 {
> 9223ba771533395 Benjamin Gaignard 2023-01-03 134 struct hantro_av1_dec_hw_ctx *av1_dec = &ctx->av1_dec;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 135 int idx = rockchip_vpu981_get_frame_index(ctx, ref);
> 9223ba771533395 Benjamin Gaignard 2023-01-03 136
> 9223ba771533395 Benjamin Gaignard 2023-01-03 137 if (idx != AV1_INVALID_IDX)
> 9223ba771533395 Benjamin Gaignard 2023-01-03 138 return av1_dec->frame_refs[idx].order_hint;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 139
> 9223ba771533395 Benjamin Gaignard 2023-01-03 140 return 0;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 141 }
> 9223ba771533395 Benjamin Gaignard 2023-01-03 142
> 9223ba771533395 Benjamin Gaignard 2023-01-03 143 static int rockchip_vpu981_av1_dec_frame_ref(struct hantro_ctx *ctx,
> 9223ba771533395 Benjamin Gaignard 2023-01-03 144 u64 timestamp)
> 9223ba771533395 Benjamin Gaignard 2023-01-03 145 {
> 9223ba771533395 Benjamin Gaignard 2023-01-03 146 struct hantro_av1_dec_hw_ctx *av1_dec = &ctx->av1_dec;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 147 struct hantro_av1_dec_ctrls *ctrls = &av1_dec->ctrls;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 148 const struct v4l2_ctrl_av1_frame *frame = ctrls->frame;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 149 int i;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 150
> 9223ba771533395 Benjamin Gaignard 2023-01-03 151 for (i = 0; i < AV1_MAX_FRAME_BUF_COUNT; i++) {
> 9223ba771533395 Benjamin Gaignard 2023-01-03 152 if (!av1_dec->frame_refs[i].used) {
> 9223ba771533395 Benjamin Gaignard 2023-01-03 153 int j;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 154
> 9223ba771533395 Benjamin Gaignard 2023-01-03 155 av1_dec->frame_refs[i].width =
> 9223ba771533395 Benjamin Gaignard 2023-01-03 156 frame->frame_width_minus_1 + 1;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 157 av1_dec->frame_refs[i].height =
> 9223ba771533395 Benjamin Gaignard 2023-01-03 158 frame->frame_height_minus_1 + 1;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 159 av1_dec->frame_refs[i].mi_cols =
> 9223ba771533395 Benjamin Gaignard 2023-01-03 160 DIV_ROUND_UP(frame->frame_width_minus_1 + 1, 8);
> 9223ba771533395 Benjamin Gaignard 2023-01-03 161 av1_dec->frame_refs[i].mi_rows =
> 9223ba771533395 Benjamin Gaignard 2023-01-03 162 DIV_ROUND_UP(frame->frame_height_minus_1 + 1, 8);
> 9223ba771533395 Benjamin Gaignard 2023-01-03 163 av1_dec->frame_refs[i].timestamp = timestamp;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 164 av1_dec->frame_refs[i].frame_type = frame->frame_type;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 165 av1_dec->frame_refs[i].order_hint = frame->order_hint;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 166 av1_dec->frame_refs[i].gm_mode =
> 9223ba771533395 Benjamin Gaignard 2023-01-03 @167 frame->global_motion.type[V4L2_AV1_REF_LAST_FRAME + i];
> 9223ba771533395 Benjamin Gaignard 2023-01-03 168 if (!av1_dec->frame_refs[i].vb2_ref)
> 9223ba771533395 Benjamin Gaignard 2023-01-03 169 av1_dec->frame_refs[i].vb2_ref = hantro_get_dst_buf(ctx);
> 9223ba771533395 Benjamin Gaignard 2023-01-03 170
> 9223ba771533395 Benjamin Gaignard 2023-01-03 171 for (j = 0; j < V4L2_AV1_TOTAL_REFS_PER_FRAME; j++)
> 9223ba771533395 Benjamin Gaignard 2023-01-03 172 av1_dec->frame_refs[i].order_hints[j] = frame->order_hints[j];
> 9223ba771533395 Benjamin Gaignard 2023-01-03 173
> 9223ba771533395 Benjamin Gaignard 2023-01-03 174 av1_dec->frame_refs[i].used = true;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 175 av1_dec->current_frame_index = i;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 176 return i;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 177 }
> 9223ba771533395 Benjamin Gaignard 2023-01-03 178 }
> 9223ba771533395 Benjamin Gaignard 2023-01-03 179
> 9223ba771533395 Benjamin Gaignard 2023-01-03 180 return AV1_INVALID_IDX;
> 9223ba771533395 Benjamin Gaignard 2023-01-03 181 }
>
Powered by blists - more mailing lists