[PATCH v2 04/17] media: v4l2-ctrls: validate av1 tile info
From: Sofus Forstreuter
Date: Sat Sep 26 2026 - 09:19:01 EST
Many drivers use tile_cols and/or tile_rows, so make sure they are
valid.
Increase V4L2_AV1_MAX_TILE_COUNT to MAX_TILE_COLS * MAX_TILE_ROWS
Signed-off-by: Sofus Forstreuter <sofus.c@xxxxxxxxxx>
---
drivers/media/v4l2-core/v4l2-ctrls-core.c | 15 +++++++++++++++
include/uapi/linux/v4l2-controls.h | 2 +-
2 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
index 661a3a25da52..c3e7262ba4d3 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -800,10 +800,25 @@ static int validate_av1_film_grain(struct v4l2_ctrl_av1_film_grain *fg)
return 0;
}
+static int validate_av1_tile_info(struct v4l2_av1_tile_info *ti)
+{
+ if (ti->tile_cols > V4L2_AV1_MAX_TILE_COLS ||
+ ti->tile_rows > V4L2_AV1_MAX_TILE_ROWS)
+ return -EINVAL;
+
+ if (ti->context_update_tile_id > ti->tile_cols * ti->tile_rows)
+ return -EINVAL;
+
+ return 0;
+}
+
static int validate_av1_frame(struct v4l2_ctrl_av1_frame *f)
{
int ret = 0;
+ ret = validate_av1_tile_info(&f->tile_info);
+ if (ret)
+ return ret;
ret = validate_av1_quantization(&f->quantization);
if (ret)
return ret;
diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h
index d17e41d51d2e..abdfa102a77b 100644
--- a/include/uapi/linux/v4l2-controls.h
+++ b/include/uapi/linux/v4l2-controls.h
@@ -2939,7 +2939,7 @@ struct v4l2_ctrl_vp9_compressed_hdr {
#define V4L2_AV1_MAX_NUM_PLANES 3
#define V4L2_AV1_MAX_TILE_COLS 64
#define V4L2_AV1_MAX_TILE_ROWS 64
-#define V4L2_AV1_MAX_TILE_COUNT 512
+#define V4L2_AV1_MAX_TILE_COUNT 4096
#define V4L2_AV1_SEQUENCE_FLAG_STILL_PICTURE 0x00000001
#define V4L2_AV1_SEQUENCE_FLAG_USE_128X128_SUPERBLOCK 0x00000002
--
2.55.0