diff options
| author | Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> | 2026-01-06 05:09:57 +0200 |
|---|---|---|
| committer | Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> | 2026-01-14 02:18:31 +0200 |
| commit | cea6e6e8717e81de266aa496f44088b2b960aa32 (patch) | |
| tree | ec5460686daf63b079de47d2c31dfcbd7c678646 /drivers/gpu | |
| parent | ca59e33f5a1f642d13ae0e558fdbdd9aaa9fe203 (diff) | |
drm/atomic: verify that gamma/degamma LUTs are not too big
The kernel specifies LUT table sizes in a separate property, however it
doesn't enforce it as a maximum. Some drivers implement max size check
on their own in the atomic_check path. Other drivers simply ignore the
issue. Perform LUT size validation in the generic place.
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260106-drm-fix-lut-checks-v3-3-f7f979eb73c8@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/drm_atomic_uapi.c | 22 |
1 files changed, 20 insertions, 2 deletions
diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c index dff1fdefcbeb..dc013a22bf26 100644 --- a/drivers/gpu/drm/drm_atomic_uapi.c +++ b/drivers/gpu/drm/drm_atomic_uapi.c @@ -413,10 +413,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc, } else if (property == config->prop_vrr_enabled) { state->vrr_enabled = val; } else if (property == config->degamma_lut_property) { + const size_t elem_size = sizeof(struct drm_color_lut); + u64 lut_size; + + ret = drm_object_immutable_property_get_value(&crtc->base, + config->degamma_lut_size_property, + &lut_size); + if (ret) + return ret; + ret = drm_property_replace_blob_from_id(dev, &state->degamma_lut, val, - -1, -1, sizeof(struct drm_color_lut), + elem_size * lut_size, -1, elem_size, &replaced); state->color_mgmt_changed |= replaced; return ret; @@ -429,10 +438,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc, state->color_mgmt_changed |= replaced; return ret; } else if (property == config->gamma_lut_property) { + const size_t elem_size = sizeof(struct drm_color_lut); + u64 lut_size; + + ret = drm_object_immutable_property_get_value(&crtc->base, + config->gamma_lut_size_property, + &lut_size); + if (ret) + return ret; + ret = drm_property_replace_blob_from_id(dev, &state->gamma_lut, val, - -1, -1, sizeof(struct drm_color_lut), + elem_size * lut_size, -1, elem_size, &replaced); state->color_mgmt_changed |= replaced; return ret; |