linux-kernel - Re: [PATCH] media: verisilicon: AV1: Fix tile info buffer size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e63bea4f457dad4e4661185188f2b030d82b7879.camel@collabora.com>
Date: Sun, 18 Jan 2026 17:34:24 -0500
From: Nicolas Dufresne <nicolas.dufresne@...labora.com>
To: Benjamin Gaignard <benjamin.gaignard@...labora.com>, 
	p.zabel@...gutronix.de, mchehab@...nel.org, heiko@...ech.de,
 hverkuil@...nel.org
Cc: linux-media@...r.kernel.org, linux-rockchip@...ts.infradead.org, 
	linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org, 
	kernel@...labora.com
Subject: Re: [PATCH] media: verisilicon: AV1: Fix tile info buffer size

Le mercredi 14 janvier 2026 à 10:07 +0100, Benjamin Gaignard a écrit :
> Each tile info is composed of: row_sb, col_sb, start_pos
> and end_pos (4 bytes each). So the total required memory
> is AV1_MAX_TILES * 16 bytes.
> Use the correct #define to allocate the buffer and avoid
> writing tile info in non-allocated memory.
> 
> Signed-off-by: Benjamin Gaignard <benjamin.gaignard@...labora.com>
> Fixes: 727a400686a2c ("media: verisilicon: Add Rockchip AV1 decoder")
> ---
>  .../media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c   | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
> index e4703bb6be7c..af854b149f35 100644
> --- a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
> +++ b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
> @@ -373,12 +373,12 @@ int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx)
>  		return -ENOMEM;
>  	av1_dec->global_model.size = GLOBAL_MODEL_SIZE;
>  
> -	av1_dec->tile_info.cpu = dma_alloc_coherent(vpu->dev, AV1_MAX_TILES,
> +	av1_dec->tile_info.cpu = dma_alloc_coherent(vpu->dev, AV1_TILE_INFO_SIZE,
>  						    &av1_dec->tile_info.dma,
>  						    GFP_KERNEL);
>  	if (!av1_dec->tile_info.cpu)
>  		return -ENOMEM;
> -	av1_dec->tile_info.size = AV1_MAX_TILES;
> +	av1_dec->tile_info.size = AV1_TILE_INFO_SIZE;

After checking the sizes, I can only conclude the we rarely have more then 8
tiles in our tests.

Reviewed-by: Nicolas Dufresne <nicolas.dufresne@...labora.com>

>  
>  	av1_dec->film_grain.cpu = dma_alloc_coherent(vpu->dev,
>  						     ALIGN(sizeof(struct rockchip_av1_film_grain), 2048),

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)