media: rkvdec: bound HEVC tile loops and PPS id to the array capacity

Browse source

compute_tiles_uniform() and compute_tiles_non_uniform() loop over
num_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and
assemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile
and indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from
the untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() /
v4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of
assemble_hw_pps() before indexing priv_tbl->param_set[] with an
out-of-range pic_parameter_set_id, so the writes stay within the hardware
tables.

Fixes: 3595375c23 ("media: rkvdec: Add HEVC backend")
Fixes: c9a59dc2ac ("media: rkvdec: Add HEVC support for the VDPU381 variant")
Assisted-by: Claude:claude-opus-4-8
Cc: stable@vger.kernel.org
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

...

This commit is contained in:

Michael Bommarito 2026-06-16 22:19:01 -04:00 • committed by Hans Verkuil

parent 592dd4f844

commit 81ad46bb33

3 changed files with 17 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

14

drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c

View file

7

drivers/media/platform/rockchip/rkvdec/rkvdec-hevc.c

View file

2

drivers/media/platform/rockchip/rkvdec/rkvdec-vdpu381-hevc.c

View file