From nobody Tue Feb 10 14:49:41 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1CBC820E023 for ; Sat, 15 Nov 2025 03:42:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763178180; cv=none; b=ZsC4CQJq8Pln0kKhF9+BgFeoeKtAz1u7Mx3f28EOOXxHduTzQDvgREZpzKs5TS6OxmlYGTHdESupwJXY3UUwYPI5471/FL34BCuVnYbhYCl+tUnZKfCtLPP1hCNgEHbuxJ1kru5QHcjMzzmhboxU4cJGzq5Rr+tmZ3pYJ+fDrQ4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763178180; c=relaxed/simple; bh=Zrx3F7zYvNugK1FdTfV6C4jbMJzk2pb6chyouaUp1/k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=UcEYEmoa1vY+f73pSPYJfUoRkCP2Tvb1Tmd0V1YYXI1TuVyK50/32DQuagUCMhC90ykDrfhec5LO0tUC1JNJu/OqoFbMJtRlNvaK4Bu1jyb2LSAvqGiuMLacQsy2e95TPdLc1VYGsuiTpfEpoUmrLEwBLYH/Gs4xKSxlhMjD4ts= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=Z5/ZteZQ; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=EZ/eTzYe; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="Z5/ZteZQ"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="EZ/eTzYe" Received: from pps.filterd (m0279862.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 5AEIQGK2043361 for ; Sat, 15 Nov 2025 03:42:58 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= BhpfJLji6/fhtqDCZ24EK575S0ON8OrjNodLzdYi1t8=; b=Z5/ZteZQFnfcvd9H zhmucCCTPYkD59BYzuozHbarBemxmP65bY/oVvwto7naAdmTmiPK8mOC9RWfu2Kl OVdSCVXOEQqCyWT2z44jvH1G2DWfTwwyMxwzG4BWjy1TxCGTA3ufSpLbm3JAZEa/ dtSpIACUTz/yDcXAg6p7yH7fO183Mn0dWtB1fi+akEMJC0Wda/7YochzrqNfckIR xkJjg3ePCXJ9g5y0/qxg9t8BSUKXG27yGCKE54BpQNQu5glSWtdilRhMMKtT0/PK Oe+d7SDAqzqIxOBf6UWciFuaBK45AEiEzI6xNeQeUOZHNamQRuf5yQ6qEziMFX+P gsjiFA== Received: from mail-qk1-f197.google.com (mail-qk1-f197.google.com [209.85.222.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4ae3t9ta38-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sat, 15 Nov 2025 03:42:58 +0000 (GMT) Received: by mail-qk1-f197.google.com with SMTP id af79cd13be357-8b24383b680so221584185a.0 for ; Fri, 14 Nov 2025 19:42:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1763178176; x=1763782976; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=BhpfJLji6/fhtqDCZ24EK575S0ON8OrjNodLzdYi1t8=; b=EZ/eTzYelLudBhdiVPRDnMU4Chg9rw013ZFBCaOuPba8EU33Vlg0TOFs/mxIpIcjzK hlr5ggwngKi5zd7zJ8ehS8S6QjlfWUUCLnFeyQPohHEraVMd8LyocrtRaj4iIXZMUTgn njv2Ii+M0UX0JdrKusR7zVchcoqyX2bhNyH/Fwnp5SMLbw1aVMjOJE22ZQ4oz+OcrSFp pxpcNQ0guhmfV0ZS4qH9KnpYncWH+ds8Pe7dgx6mtXath9NCr5qHKIdJKAPxrvMYLPfF KidM75QAYn84B0E3738FcVV3EvYOuQ+4LQfhhcqIsRVlLQs1KUzn2edDlEnHqScLxG9P 0J2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763178176; x=1763782976; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=BhpfJLji6/fhtqDCZ24EK575S0ON8OrjNodLzdYi1t8=; b=C0U0igHO041ekzaN3Fe8MeER9xVqE6zqk9LwQUAYtL1GUa/EtOS7S6EaEuDx6lmvdO zKWHClkJ2KOr5S1lH63+z7R+7YtYg7dFN/qLlxM1P3+bSH6PsS8LeZIqIhtOjJDf4rQf PdI2QMQnfBQ/Q4cdJaa/ItT9Cbz5+88sRjQ/3Rl4sVRKJGHvjJjXrxXI6g+u+oZjnHZC sWxMT0MF++5IUlsoQawL/L6aJXQml4LnsRWEw7ICCU05TzPHYvQSsgdGy2FvmY7TYNSx cqTiUvr49nO9kswhVHK7Z3Sb5nIb4BZp/cOVWvQIOAW6Eo8IbS5NE6tBgAXwt1hyF9PZ F+Ew== X-Forwarded-Encrypted: i=1; AJvYcCVela+vrIXziicefXwIb0fF5njj3Q3t7eIukKpdhvUefb9O54JADpYCXO6opioZyqkzitX5hkFIfvl8GGA=@vger.kernel.org X-Gm-Message-State: AOJu0Yy4cbwTLXGmAEa3wKEM5kRl+K0I1uKQeXjF5cOZhyaT1802NE8a mvPpPHq18gA1fbGT2beP4fzNYW3iIIpT+Ci5iSjr06ovVQO6d9AiDkgt7tDqOWAhqWiEiyec1Sx fIoTNSXtVH5f5OIuipvpEj5ojqAMz7zDCSxmqOQh6jdqNDhBWHQt2zLfqFXrdtYtxLZ8= X-Gm-Gg: ASbGnct6jIDiv9Q0Ho3sADlywof8Ht9bpJ47H/IIDzD+9pfYsdbWCMfTeZjr2pu4m/j 8QlXc1fsx4KzTqS+MSoRjezKP7ocD9Wyj6fE0GfEQAoEHlLbGrCPiZeFfY6QURjK3miJy17fTjK KEyiVJfDDC1oaEoceB3vFJL5D9U1kBTqEukYu3HpEz7lld3E8UFueXfzh0zbbci51Rm+eODCkdq 9E7nmNgRioJ2ae+r5/h3Or7tVZ+bMOQRYcWqnvii4BS8HF+elYv8taRGc8kWcz8NWGqIo5mLOCm lgXJwIGvaVNatgKIv2Cn6sOmUn+nz9meEYplNnTHSVRBrHNessfiE1aQB8gGBY2cwuU/eYv1+6g acgBqlpbNz+GOh9M3uwDXlPtY5QP72zBCQCUy0a56Sgcuo6lU8ORDMsXgmTR7+yt2OMQgKtW8xi Vaoh2F/ZPWkk0d X-Received: by 2002:a05:620a:390e:b0:8b2:77aa:73d3 with SMTP id af79cd13be357-8b2c31409bamr724153685a.2.1763178175563; Fri, 14 Nov 2025 19:42:55 -0800 (PST) X-Google-Smtp-Source: AGHT+IFv7gCdw6HKgZhMlZOXjPB0By0UhngBMETBduc0VjgNYn8qw6cDgmC2imheV8we/zNyBowEOQ== X-Received: by 2002:a05:620a:390e:b0:8b2:77aa:73d3 with SMTP id af79cd13be357-8b2c31409bamr724152685a.2.1763178175004; Fri, 14 Nov 2025 19:42:55 -0800 (PST) Received: from umbar.lan (2001-14ba-a0c3-3a00-264b-feff-fe8b-be8a.rev.dnainternet.fi. [2001:14ba:a0c3:3a00:264b:feff:fe8b:be8a]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5958040578fsm1475880e87.78.2025.11.14.19.42.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Nov 2025 19:42:54 -0800 (PST) From: Dmitry Baryshkov Date: Sat, 15 Nov 2025 05:42:50 +0200 Subject: [PATCH 2/3] drm/atomic: add max_size check to drm_property_replace_blob_from_id() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251115-drm-fix-lut-checks-v1-2-3586f5855bc7@oss.qualcomm.com> References: <20251115-drm-fix-lut-checks-v1-0-3586f5855bc7@oss.qualcomm.com> In-Reply-To: <20251115-drm-fix-lut-checks-v1-0-3586f5855bc7@oss.qualcomm.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Harry Wentland , Leo Li , Rodrigo Siqueira , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, amd-gfx@lists.freedesktop.org X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=6345; i=dmitry.baryshkov@oss.qualcomm.com; h=from:subject:message-id; bh=Zrx3F7zYvNugK1FdTfV6C4jbMJzk2pb6chyouaUp1/k=; b=owGbwMvMwMXYbdNlx6SpcZXxtFoSQ6b4t931fGVRZn/3KBwu59oo42C+gumWghjbqshfKxv/v E5w+Da9k9GYhYGRi0FWTJHFp6Blasym5LAPO6bWwwxiZQKZwsDFKQATqchn/6fsMXPfam13vxMS koJqp88Gds9Qf9x8YWls8jHXysM3lnnHKSbt6jyfe+X6wVs3nK5t/Kuz+4ct3/Mduw6c2GxvWs7 fF/LjQVussV4le+OepIdaZ1r9jYNE7Ctn1cq6OxvuDvRVz6zp7pScfYh76e3DJ7uZY3rXplboby v2ZmqL0HtanNX7//KCs4mcMlG1ylGclsIBsr6dqzJTmVUOBxgGPfwu8Hvi1n/2LQJROpnLdvUdC HGbdNhV8Wcaz70+zsnbxKs/mBXL3nvcsi47/Ha8hFfNYaPnbnFL167fekjkoMB+W831a31/uhdt ELRLb5hnZFp07TQrg82hE0sdlN9uVJjdWPiqRaeRaUc9AA== X-Developer-Key: i=dmitry.baryshkov@oss.qualcomm.com; a=openpgp; fpr=8F88381DD5C873E4AE487DA5199BF1243632046A X-Authority-Analysis: v=2.4 cv=IOAPywvG c=1 sm=1 tr=0 ts=6917f6c2 cx=c_pps a=50t2pK5VMbmlHzFWWp8p/g==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=6UeiqGixMTsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=EUspDBNiAAAA:8 a=GF-90_O6f30kfN1CyEYA:9 a=QEXdDO2ut3YA:10 a=IoWCM6iH3mJn3m4BftBB:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUxMTE1MDAyOCBTYWx0ZWRfX9l3g42pnJ1pi 7Z/47yzctj5bJRLe3gfa2WU3tMV7ipKtOtg3t6Ia+RQiPgDFUcaO5iml9TW8OTFf69qZ0TdQs+L i/C2IfYiwaCmln5OUoPGanHhblXmuEaZ19cdzppeX12p7ClyY33Ffk4wKsu630wSLUuNoSNBIHe nfD6Bv/4xyZsps8mqFvNDJKC92PKL1rOA4dCQLVkIW0LXo0hiue4k3wahWm21qrXfuXHq2adBpU MYgWtonoBLUqs7PKetFwI1+uKiEvF58Na1i5HleTzlfRoOiL1KGQdJ+Na5uKqGibz5Wc/OtMT4m kv5/1YhARkhLOHq/oSRPYDpS7Zvm7VzNGGTIdXSultAfS3rasvGGdmwqhj5Ybt2eGih7lennVJL 2CF08ICvYVXNZYCSgnyVCEs8fxBtOA== X-Proofpoint-GUID: rybvVQAcoR91n1gVQlDaFbDSWjwx-9gp X-Proofpoint-ORIG-GUID: rybvVQAcoR91n1gVQlDaFbDSWjwx-9gp X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49 definitions=2025-11-15_01,2025-11-13_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 clxscore=1015 spamscore=0 adultscore=0 impostorscore=0 bulkscore=0 malwarescore=0 suspectscore=0 priorityscore=1501 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2510240001 definitions=main-2511150028 The function drm_property_replace_blob_from_id() allows checking whether the blob size is equal to a predefined value. In case of variable-size properties (like the gamma / degamma LUTs) we might want to check for the blob size against the maximum, allowing properties of the size lesser than the max supported by the hardware. Extend the function in order to support such checks. Signed-off-by: Dmitry Baryshkov --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 5 +++++ drivers/gpu/drm/drm_atomic_uapi.c | 7 +++++-- drivers/gpu/drm/drm_property.c | 11 +++++++++++ include/drm/drm_property.h | 1 + 4 files changed, 22 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/driv= ers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c index e027798ece03226338a4ff6ca9e06eb77436bac4..d19631b5d9e1237849e081b156d= 23b933848faef 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c @@ -1677,6 +1677,7 @@ dm_atomic_plane_set_property(struct drm_plane *plane, &dm_plane_state->degamma_lut, val, -1, sizeof(struct drm_color_lut), + 0, &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; @@ -1695,6 +1696,7 @@ dm_atomic_plane_set_property(struct drm_plane *plane, &dm_plane_state->ctm, val, sizeof(struct drm_color_ctm_3x4), -1, + 0, &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; @@ -1703,6 +1705,7 @@ dm_atomic_plane_set_property(struct drm_plane *plane, &dm_plane_state->shaper_lut, val, -1, sizeof(struct drm_color_lut), + 0, &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; @@ -1716,6 +1719,7 @@ dm_atomic_plane_set_property(struct drm_plane *plane, &dm_plane_state->lut3d, val, -1, sizeof(struct drm_color_lut), + 0, &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; @@ -1724,6 +1728,7 @@ dm_atomic_plane_set_property(struct drm_plane *plane, &dm_plane_state->blend_lut, val, -1, sizeof(struct drm_color_lut), + 0, &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic= _uapi.c index 85dbdaa4a2e25878c953b9b41539c8566d55c6d9..7d2076f1006e976de73c898a838= ceb4b5c4370e4 100644 --- a/drivers/gpu/drm/drm_atomic_uapi.c +++ b/drivers/gpu/drm/drm_atomic_uapi.c @@ -388,6 +388,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc= *crtc, &state->degamma_lut, val, -1, sizeof(struct drm_color_lut), + 0, &replaced); state->color_mgmt_changed |=3D replaced; return ret; @@ -395,7 +396,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc= *crtc, ret =3D drm_property_replace_blob_from_id(dev, &state->ctm, val, - sizeof(struct drm_color_ctm), -1, + sizeof(struct drm_color_ctm), -1, 0, &replaced); state->color_mgmt_changed |=3D replaced; return ret; @@ -404,6 +405,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc= *crtc, &state->gamma_lut, val, -1, sizeof(struct drm_color_lut), + 0, &replaced); state->color_mgmt_changed |=3D replaced; return ret; @@ -546,6 +548,7 @@ static int drm_atomic_plane_set_property(struct drm_pla= ne *plane, val, -1, sizeof(struct drm_mode_rect), + 0, &replaced); return ret; } else if (property =3D=3D plane->scaling_filter_property) { @@ -741,7 +744,7 @@ static int drm_atomic_connector_set_property(struct drm= _connector *connector, ret =3D drm_property_replace_blob_from_id(dev, &state->hdr_output_metadata, val, - sizeof(struct hdr_output_metadata), -1, + sizeof(struct hdr_output_metadata), -1, 0, &replaced); return ret; } else if (property =3D=3D config->aspect_ratio_property) { diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c index 596272149a3599130186a470e5a5a3c1150b377d..5befe443135d3861289183d1b6f= a1ac0e5e46515 100644 --- a/drivers/gpu/drm/drm_property.c +++ b/drivers/gpu/drm/drm_property.c @@ -759,6 +759,7 @@ EXPORT_SYMBOL(drm_property_replace_blob); * @blob_id: the id of the new blob to replace with * @expected_size: expected size of the blob property * @expected_elem_size: expected size of an element in the blob property + * @max_size: the maximum size of the blob property for variable-size blobs * @replaced: if the blob was in fact replaced * * Look up the new blob from id, take its reference, check expected sizes = of @@ -773,6 +774,7 @@ int drm_property_replace_blob_from_id(struct drm_device= *dev, uint64_t blob_id, ssize_t expected_size, ssize_t expected_elem_size, + ssize_t max_size, bool *replaced) { struct drm_property_blob *new_blob =3D NULL; @@ -801,6 +803,15 @@ int drm_property_replace_blob_from_id(struct drm_devic= e *dev, drm_property_blob_put(new_blob); return -EINVAL; } + + if (max_size > 0 && + new_blob->length > max_size) { + drm_dbg_atomic(dev, + "[BLOB:%d] length %zu greater than max %zu\n", + new_blob->base.id, new_blob->length, max_size); + drm_property_blob_put(new_blob); + return -EINVAL; + } } =20 *replaced |=3D drm_property_replace_blob(blob, new_blob); diff --git a/include/drm/drm_property.h b/include/drm/drm_property.h index 082f29156b3e3fd2de0d6a3864022388cd61e17d..aa49b5a42bb56d9331d8d3397b1= 50e33aae67451 100644 --- a/include/drm/drm_property.h +++ b/include/drm/drm_property.h @@ -284,6 +284,7 @@ int drm_property_replace_blob_from_id(struct drm_device= *dev, uint64_t blob_id, ssize_t expected_size, ssize_t expected_elem_size, + ssize_t max_size, bool *replaced); int drm_property_replace_global_blob(struct drm_device *dev, struct drm_property_blob **replace, --=20 2.47.3