bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-04-18 23:03:57 -04:00
Code Issues Packages Projects Releases Wiki Activity

drm/atomic: verify that gamma/degamma LUTs are not too big

Browse Source 
The kernel specifies LUT table sizes in a separate property, however it
doesn't enforce it as a maximum. Some drivers implement max size check
on their own in the atomic_check path. Other drivers simply ignore the
issue. Perform LUT size validation in the generic place.

Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260106-drm-fix-lut-checks-v3-3-f7f979eb73c8@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
This commit is contained in:
Dmitry Baryshkov
2026-01-06 05:09:57 +02:00
parent ca59e33f5a
commit cea6e6e871
1 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/gpu/drm/drm_atomic_uapi.c
View File

@@ -413,10 +413,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
} else if (property == config->prop_vrr_enabled) {
state->vrr_enabled = val;
} else if (property == config->degamma_lut_property) {
const size_t elem_size = sizeof(struct drm_color_lut);
u64 lut_size;
ret = drm_object_immutable_property_get_value(&crtc->base,
config->degamma_lut_size_property,
&lut_size);
if (ret)
return ret;
ret = drm_property_replace_blob_from_id(dev,
&state->degamma_lut,
val,
-1, -1, sizeof(struct drm_color_lut),
elem_size * lut_size, -1, elem_size,
&replaced);
state->color_mgmt_changed |= replaced;
return ret;
@@ -429,10 +438,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
state->color_mgmt_changed |= replaced;
return ret;
} else if (property == config->gamma_lut_property) {
const size_t elem_size = sizeof(struct drm_color_lut);
u64 lut_size;
ret = drm_object_immutable_property_get_value(&crtc->base,
config->gamma_lut_size_property,
&lut_size);
if (ret)
return ret;
ret = drm_property_replace_blob_from_id(dev,
&state->gamma_lut,
val,
-1, -1, sizeof(struct drm_color_lut),
elem_size * lut_size, -1, elem_size,
&replaced);
state->color_mgmt_changed |= replaced;
return ret;