Commit cea6e6e8 authored by Dmitry Baryshkov's avatar Dmitry Baryshkov
Browse files

drm/atomic: verify that gamma/degamma LUTs are not too big 



The kernel specifies LUT table sizes in a separate property, however it
doesn't enforce it as a maximum. Some drivers implement max size check
on their own in the atomic_check path. Other drivers simply ignore the
issue. Perform LUT size validation in the generic place.

Reviewed-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260106-drm-fix-lut-checks-v3-3-f7f979eb73c8@oss.qualcomm.com


Signed-off-by: default avatarDmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
parent ca59e33f

drivers/gpu/drm/drm_atomic_uapi.c

+20 −2
Original line number Diff line number Diff line
@@ -413,10 +413,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc, 
	} else if (property == config->prop_vrr_enabled) {

		state->vrr_enabled = val;

	} else if (property == config->degamma_lut_property) {

		const size_t elem_size = sizeof(struct drm_color_lut);

		u64 lut_size;



		ret = drm_object_immutable_property_get_value(&crtc->base,

							      config->degamma_lut_size_property,

							      &lut_size);

		if (ret)

			return ret;



		ret = drm_property_replace_blob_from_id(dev,

					&state->degamma_lut,

					val,

					-1, -1, sizeof(struct drm_color_lut),

					elem_size * lut_size, -1, elem_size,

					&replaced);

		state->color_mgmt_changed |= replaced;

		return ret;
@@ -429,10 +438,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc, 
		state->color_mgmt_changed |= replaced;

		return ret;

	} else if (property == config->gamma_lut_property) {

		const size_t elem_size = sizeof(struct drm_color_lut);

		u64 lut_size;



		ret = drm_object_immutable_property_get_value(&crtc->base,

							      config->gamma_lut_size_property,

							      &lut_size);

		if (ret)

			return ret;



		ret = drm_property_replace_blob_from_id(dev,

					&state->gamma_lut,

					val,

					-1, -1, sizeof(struct drm_color_lut),

					elem_size * lut_size, -1, elem_size,

					&replaced);

		state->color_mgmt_changed |= replaced;

		return ret;