From patchwork Tue Mar 7 06:03:28 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wu-Cheng Li X-Patchwork-Id: 9608115 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 07782604DC for ; Tue, 7 Mar 2017 06:05:48 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EA16D28405 for ; Tue, 7 Mar 2017 06:05:47 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DF05728410; Tue, 7 Mar 2017 06:05:47 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7885128405 for ; Tue, 7 Mar 2017 06:05:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754560AbdCGGFa (ORCPT ); Tue, 7 Mar 2017 01:05:30 -0500 Received: from mail-pf0-f179.google.com ([209.85.192.179]:34014 "EHLO mail-pf0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752322AbdCGGF1 (ORCPT ); Tue, 7 Mar 2017 01:05:27 -0500 Received: by mail-pf0-f179.google.com with SMTP id v190so33540435pfb.1 for ; Mon, 06 Mar 2017 22:03:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=tgm+Nck0jPNlKM7cBJL71PtUTTbEpD7nnyyybBJE8vI=; b=nMn5MsUd+A+DigWDUTPoB/0mzqWM5Zkn53ihfXDdA9Wpn1ORBNayU55TAtVNcXxk4I xQj57P5J4h+kBqbODA99mc1ZCsljdYJUGMpYmyp5CAB1hFYCmpMdui4coQp/MtzNIHIf BkLslcEzg1Tk0i7PQMZVdh1TDqQWGBrNxHdLo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=tgm+Nck0jPNlKM7cBJL71PtUTTbEpD7nnyyybBJE8vI=; b=apTxCyAPMYQpY51t5r6uNywQ32mgG42yLx8vRal8n4ou3uK0OZKh8mV09mFaN/Tu3b nbBlyC9ZF7Dzr3T12idYBx1ZFOTbhgM23vcAnL/m+r0k76NdcEjI7i5HITlTk9HjWWfy q/tJKNNzPUdzz78/eoaOFjiqEfp1l0u4qYECgpu8/xWUuF1oN6hVnm8cGacgDFeo84Ni +gBjZeiXUn4YxbmZggA+GqgpmjzRQ09JR/12seGO2i/2iDWC5IBCWApUqwzstX3DQk+Q hKTOiZZuISdbrQ+vd70L4sm4zrdr00Jcq0PU3gZAxXbBDe/aEhfuN1F6q8FDBs6O1VJL SVnQ== X-Gm-Message-State: AMke39mHMYsVXHmRMXETxz/9HkWSoLxQyQzkR+dyFI0BJNaTOSfGgsfBl/w8LDH8BTC0RsgM X-Received: by 10.98.29.216 with SMTP id d207mr26131971pfd.144.1488866620883; Mon, 06 Mar 2017 22:03:40 -0800 (PST) Received: from wuchengli-z840.tpe.corp.google.com ([172.30.210.26]) by smtp.gmail.com with ESMTPSA id d199sm11539242pfd.107.2017.03.06.22.03.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 06 Mar 2017 22:03:40 -0800 (PST) From: Wu-Cheng Li To: pawel@osciak.com, tiffany.lin@mediatek.com, andrew-ct.chen@mediatek.com, mchehab@kernel.org, matthias.bgg@gmail.com, hans.verkuil@cisco.com, wuchengli@google.com Cc: djkurtz@chromium.org, linux-media@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, linux-kernel@vger.kernel.org, Wu-Cheng Li Subject: [PATCH 1/1] mtk-vcodec: check the vp9 decoder buffer index from VPU. Date: Tue, 7 Mar 2017 14:03:28 +0800 Message-Id: <20170307060328.114348-2-wuchengli@chromium.org> X-Mailer: git-send-email 2.12.0.rc1.440.g5b76565f74-goog In-Reply-To: <20170307060328.114348-1-wuchengli@chromium.org> References: <20170307060328.114348-1-wuchengli@chromium.org> Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Wu-Cheng Li VPU firmware has a bug and may return invalid buffer index for some vp9 videos. Check the buffer indexes before accessing the buffer. Signed-off-by: Wu-Cheng Li --- drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c | 6 +++++ .../media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 26 ++++++++++++++++++++++ drivers/media/platform/mtk-vcodec/vdec_drv_if.h | 2 ++ 3 files changed, 34 insertions(+) diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c index 502877a4b1df..7ebcf9e57ac7 100644 --- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c +++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c @@ -1176,6 +1176,12 @@ static void vb2ops_vdec_buf_queue(struct vb2_buffer *vb) "[%d] vdec_if_decode() src_buf=%d, size=%zu, fail=%d, res_chg=%d", ctx->id, src_buf->index, src_mem.size, ret, res_chg); + + if (ret == -EIO) { + mtk_v4l2_err("[%d] Unrecoverable error in vdec_if_decode.", + ctx->id); + ctx->state = MTK_STATE_ABORT; + } return; } diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c index e91a3b425b0c..5539b1853f16 100644 --- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c +++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c @@ -718,6 +718,26 @@ static void get_free_fb(struct vdec_vp9_inst *inst, struct vdec_fb **out_fb) *out_fb = fb; } +static int validate_vsi_array_indexes(struct vdec_vp9_inst *inst, + struct vdec_vp9_vsi *vsi) { + if (vsi->sf_frm_idx >= VP9_MAX_FRM_BUF_NUM - 1) { + mtk_vcodec_err(inst, "Invalid vsi->sf_frm_idx=%u.", + vsi->sf_frm_idx); + return -EIO; + } + if (vsi->frm_to_show_idx >= VP9_MAX_FRM_BUF_NUM) { + mtk_vcodec_err(inst, "Invalid vsi->frm_to_show_idx=%u.", + vsi->frm_to_show_idx); + return -EIO; + } + if (vsi->new_fb_idx >= VP9_MAX_FRM_BUF_NUM) { + mtk_vcodec_err(inst, "Invalid vsi->new_fb_idx=%u.", + vsi->new_fb_idx); + return -EIO; + } + return 0; +} + static void vdec_vp9_deinit(unsigned long h_vdec) { struct vdec_vp9_inst *inst = (struct vdec_vp9_inst *)h_vdec; @@ -834,6 +854,12 @@ static int vdec_vp9_decode(unsigned long h_vdec, struct mtk_vcodec_mem *bs, goto DECODE_ERROR; } + ret = validate_vsi_array_indexes(inst, vsi); + if (ret) { + mtk_vcodec_err(inst, "Invalid values from VPU."); + goto DECODE_ERROR; + } + if (vsi->resolution_changed) { if (!vp9_alloc_work_buf(inst)) { ret = -EINVAL; diff --git a/drivers/media/platform/mtk-vcodec/vdec_drv_if.h b/drivers/media/platform/mtk-vcodec/vdec_drv_if.h index db6b5205ffb1..ded1154481cd 100644 --- a/drivers/media/platform/mtk-vcodec/vdec_drv_if.h +++ b/drivers/media/platform/mtk-vcodec/vdec_drv_if.h @@ -85,6 +85,8 @@ void vdec_if_deinit(struct mtk_vcodec_ctx *ctx); * @res_chg : [out] resolution change happens if current bs have different * picture width/height * Note: To flush the decoder when reaching EOF, set input bitstream as NULL. + * + * Return: 0 on success. -EIO on unrecoverable error. */ int vdec_if_decode(struct mtk_vcodec_ctx *ctx, struct mtk_vcodec_mem *bs, struct vdec_fb *fb, bool *res_chg);