| Message ID | 20250111-fix-cocci-v6-2-1aa7842006cc@chromium.org |
|---|---|
| State | New |
| Headers | show |
| Series | media: Fix coccinelle warning/errors | expand |
On 11/01/2025 09:55, Ricardo Ribalda wrote: > The driver uses "whole" fps in all its calculations (e.g. in > load_per_instance()). Those calculation expect an fps bigger than 1, and > not big enough to overflow. > > Clamp the value if the user provides a parm that will result in an invalid > fps. > > Reported-by: Hans Verkuil <hverkuil@xs4all.nl> > Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 > Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files") > Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> > --- > drivers/media/platform/qcom/venus/core.h | 2 ++ > drivers/media/platform/qcom/venus/vdec.c | 5 ++--- > 2 files changed, 4 insertions(+), 3 deletions(-) > > diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h > index 44f1c3bc4186..afae2b9fdaf7 100644 > --- a/drivers/media/platform/qcom/venus/core.h > +++ b/drivers/media/platform/qcom/venus/core.h > @@ -28,6 +28,8 @@ > #define VIDC_RESETS_NUM_MAX 2 > #define VIDC_MAX_HIER_CODING_LAYER 6 > > +#define VENUS_MAX_FPS 240 > + > extern int venus_fw_debug; > > struct freq_tbl { > diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c > index 98c22b9f9372..c1d5f94e16b4 100644 > --- a/drivers/media/platform/qcom/venus/vdec.c > +++ b/drivers/media/platform/qcom/venus/vdec.c > @@ -481,11 +481,10 @@ static int vdec_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a) > us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; > do_div(us_per_frame, timeperframe->denominator); > > - if (!us_per_frame) > - return -EINVAL; > - > + us_per_frame = max(USEC_PER_SEC, us_per_frame); > fps = (u64)USEC_PER_SEC; > do_div(fps, us_per_frame); > + fps = min(VENUS_MAX_FPS, fps); > > inst->fps = fps; > inst->timeperframe = *timeperframe; > Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # qrb5615-rb5 Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
On 1/11/2025 3:25 PM, Ricardo Ribalda wrote: > The driver uses "whole" fps in all its calculations (e.g. in > load_per_instance()). Those calculation expect an fps bigger than 1, and > not big enough to overflow. > > Clamp the value if the user provides a parm that will result in an invalid > fps. > > Reported-by: Hans Verkuil <hverkuil@xs4all.nl> > Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 > Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files") > Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> > --- > drivers/media/platform/qcom/venus/core.h | 2 ++ > drivers/media/platform/qcom/venus/vdec.c | 5 ++--- > 2 files changed, 4 insertions(+), 3 deletions(-) > > diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h > index 44f1c3bc4186..afae2b9fdaf7 100644 > --- a/drivers/media/platform/qcom/venus/core.h > +++ b/drivers/media/platform/qcom/venus/core.h > @@ -28,6 +28,8 @@ > #define VIDC_RESETS_NUM_MAX 2 > #define VIDC_MAX_HIER_CODING_LAYER 6 > > +#define VENUS_MAX_FPS 240 > + > extern int venus_fw_debug; > > struct freq_tbl { > diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c > index 98c22b9f9372..c1d5f94e16b4 100644 > --- a/drivers/media/platform/qcom/venus/vdec.c > +++ b/drivers/media/platform/qcom/venus/vdec.c > @@ -481,11 +481,10 @@ static int vdec_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a) > us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; > do_div(us_per_frame, timeperframe->denominator); > > - if (!us_per_frame) > - return -EINVAL; > - > + us_per_frame = max(USEC_PER_SEC, us_per_frame); This logic changes the actual fps from client. Consider a regular encode usecase from client setting an fps as 30. The "max(USEC_PER_SEC, us_per_frame)" would override it to USEC_PER_SEC and then the subsequent logic would eventually make fps to 1. Please make it conditional to handle the 0 fps case, i guess that the objective in above code, something like below if (!us_per_frame) us_per_frame = USEC_PER_SEC; Regards, Vikash > fps = (u64)USEC_PER_SEC; > do_div(fps, us_per_frame); > + fps = min(VENUS_MAX_FPS, fps); > > inst->fps = fps; > inst->timeperframe = *timeperframe; >
Hi Vikash On Mon, 16 Jun 2025 at 13:04, Vikash Garodia <quic_vgarodia@quicinc.com> wrote: > > > On 1/11/2025 3:25 PM, Ricardo Ribalda wrote: > > The driver uses "whole" fps in all its calculations (e.g. in > > load_per_instance()). Those calculation expect an fps bigger than 1, and > > not big enough to overflow. > > > > Clamp the value if the user provides a parm that will result in an invalid > > fps. > > > > Reported-by: Hans Verkuil <hverkuil@xs4all.nl> > > Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 > > Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files") > > Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> > > --- > > drivers/media/platform/qcom/venus/core.h | 2 ++ > > drivers/media/platform/qcom/venus/vdec.c | 5 ++--- > > 2 files changed, 4 insertions(+), 3 deletions(-) > > > > diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h > > index 44f1c3bc4186..afae2b9fdaf7 100644 > > --- a/drivers/media/platform/qcom/venus/core.h > > +++ b/drivers/media/platform/qcom/venus/core.h > > @@ -28,6 +28,8 @@ > > #define VIDC_RESETS_NUM_MAX 2 > > #define VIDC_MAX_HIER_CODING_LAYER 6 > > > > +#define VENUS_MAX_FPS 240 > > + > > extern int venus_fw_debug; > > > > struct freq_tbl { > > diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c > > index 98c22b9f9372..c1d5f94e16b4 100644 > > --- a/drivers/media/platform/qcom/venus/vdec.c > > +++ b/drivers/media/platform/qcom/venus/vdec.c > > @@ -481,11 +481,10 @@ static int vdec_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a) > > us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; > > do_div(us_per_frame, timeperframe->denominator); > > > > - if (!us_per_frame) > > - return -EINVAL; > > - > > + us_per_frame = max(USEC_PER_SEC, us_per_frame); > This logic changes the actual fps from client. Consider a regular encode usecase > from client setting an fps as 30. The "max(USEC_PER_SEC, us_per_frame)" would > override it to USEC_PER_SEC and then the subsequent logic would eventually make > fps to 1. > Please make it conditional to handle the 0 fps case, i guess that the objective > in above code, something like below > if (!us_per_frame) > us_per_frame = USEC_PER_SEC; You are correct. Thanks for catching it! I think I prefer: us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC); Regards > > Regards, > Vikash > > fps = (u64)USEC_PER_SEC; > > do_div(fps, us_per_frame); > > + fps = min(VENUS_MAX_FPS, fps); > > > > inst->fps = fps; > > inst->timeperframe = *timeperframe; > > -- Ricardo Ribalda
On 6/16/2025 5:14 PM, Ricardo Ribalda wrote: > Hi Vikash > > On Mon, 16 Jun 2025 at 13:04, Vikash Garodia <quic_vgarodia@quicinc.com> wrote: >> >> >> On 1/11/2025 3:25 PM, Ricardo Ribalda wrote: >>> The driver uses "whole" fps in all its calculations (e.g. in >>> load_per_instance()). Those calculation expect an fps bigger than 1, and >>> not big enough to overflow. >>> >>> Clamp the value if the user provides a parm that will result in an invalid >>> fps. >>> >>> Reported-by: Hans Verkuil <hverkuil@xs4all.nl> >>> Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 >>> Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files") >>> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> >>> --- >>> drivers/media/platform/qcom/venus/core.h | 2 ++ >>> drivers/media/platform/qcom/venus/vdec.c | 5 ++--- >>> 2 files changed, 4 insertions(+), 3 deletions(-) >>> >>> diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h >>> index 44f1c3bc4186..afae2b9fdaf7 100644 >>> --- a/drivers/media/platform/qcom/venus/core.h >>> +++ b/drivers/media/platform/qcom/venus/core.h >>> @@ -28,6 +28,8 @@ >>> #define VIDC_RESETS_NUM_MAX 2 >>> #define VIDC_MAX_HIER_CODING_LAYER 6 >>> >>> +#define VENUS_MAX_FPS 240 >>> + >>> extern int venus_fw_debug; >>> >>> struct freq_tbl { >>> diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c >>> index 98c22b9f9372..c1d5f94e16b4 100644 >>> --- a/drivers/media/platform/qcom/venus/vdec.c >>> +++ b/drivers/media/platform/qcom/venus/vdec.c >>> @@ -481,11 +481,10 @@ static int vdec_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a) >>> us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; >>> do_div(us_per_frame, timeperframe->denominator); >>> >>> - if (!us_per_frame) >>> - return -EINVAL; >>> - >>> + us_per_frame = max(USEC_PER_SEC, us_per_frame); >> This logic changes the actual fps from client. Consider a regular encode usecase >> from client setting an fps as 30. The "max(USEC_PER_SEC, us_per_frame)" would >> override it to USEC_PER_SEC and then the subsequent logic would eventually make >> fps to 1. >> Please make it conditional to handle the 0 fps case, i guess that the objective >> in above code, something like below >> if (!us_per_frame) >> us_per_frame = USEC_PER_SEC; > > You are correct. Thanks for catching it! > > I think I prefer: > us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC); This is good. Regards, Vikash > > Regards > > > >> >> Regards, >> Vikash >>> fps = (u64)USEC_PER_SEC; >>> do_div(fps, us_per_frame); >>> + fps = min(VENUS_MAX_FPS, fps); >>> >>> inst->fps = fps; >>> inst->timeperframe = *timeperframe; >>> > > > > -- > Ricardo Ribalda
diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h index 44f1c3bc4186..afae2b9fdaf7 100644 --- a/drivers/media/platform/qcom/venus/core.h +++ b/drivers/media/platform/qcom/venus/core.h @@ -28,6 +28,8 @@ #define VIDC_RESETS_NUM_MAX 2 #define VIDC_MAX_HIER_CODING_LAYER 6 +#define VENUS_MAX_FPS 240 + extern int venus_fw_debug; struct freq_tbl { diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c index 98c22b9f9372..c1d5f94e16b4 100644 --- a/drivers/media/platform/qcom/venus/vdec.c +++ b/drivers/media/platform/qcom/venus/vdec.c @@ -481,11 +481,10 @@ static int vdec_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a) us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; do_div(us_per_frame, timeperframe->denominator); - if (!us_per_frame) - return -EINVAL; - + us_per_frame = max(USEC_PER_SEC, us_per_frame); fps = (u64)USEC_PER_SEC; do_div(fps, us_per_frame); + fps = min(VENUS_MAX_FPS, fps); inst->fps = fps; inst->timeperframe = *timeperframe;
The driver uses "whole" fps in all its calculations (e.g. in load_per_instance()). Those calculation expect an fps bigger than 1, and not big enough to overflow. Clamp the value if the user provides a parm that will result in an invalid fps. Reported-by: Hans Verkuil <hverkuil@xs4all.nl> Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files") Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> --- drivers/media/platform/qcom/venus/core.h | 2 ++ drivers/media/platform/qcom/venus/vdec.c | 5 ++--- 2 files changed, 4 insertions(+), 3 deletions(-)