From nobody Wed Dec 17 00:14:33 2025 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 594AD32A3F1 for ; Wed, 10 Dec 2025 19:43:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765395788; cv=none; b=pbvpgBMcWqfQNl/a/I64/xoaQnjsT4NOLMbp/OLadw5NHoFBUsV6geti+sl8ogz4zwiKJVxBMrlm5AoBpBGvbPoIlEQzwKvJTg2+QHw4sK7skJxrQV+GE9G5Ruu4jPcsva6kTKFpajePr2cWbzSL++70Fih+7Lx/OzpeUqEPBjw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765395788; c=relaxed/simple; bh=zXvnGnGuLkJqi0K2ojfpmFIykU/bxtYPAL0lpdGu0vw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=f1LRh+0TN6XGzpNbIkAXC+9j6lnUa7h3T6YQjUlG2QMLIXG6U3W0Asl/PC7Ye/jPf9rzYKOgWJa4Qbou88IRigbW7fogkkrjYczXSa1ZqUj3NnZA653eOgMsNdap3GMrx2e5V8y9hdVoZklHKRjs7vRr1UBBJkgwcXPqAiGj4PI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=lTRSnU1i; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=X7nFPiEq; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="lTRSnU1i"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="X7nFPiEq" Received: from pps.filterd (m0279866.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 5BAIR2WB2821975 for ; Wed, 10 Dec 2025 19:43:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= CJryTvBlX1l57AzfpPj3XJrxYhHGAfPLn56090dAH44=; b=lTRSnU1i0vaTfyq4 3AYYl1nR2GHA0sXeRvnwjbSE8SKEqcdQC0HlsWjN14/H36AUiIEqMQN4UIeZU0iS 3foSkMk9wXr1gT9rfP7N/1hPM+XfkNX48vZ2FC6kBklbEFjWFyyrdHhEK/PYqClu c20UnZyhK2mo6qnl+3RJ/u2pLWS6YXXPruaXYweXDjYfRASMLeDZ8J1VhQ9CvN3O UUVVCSWbFSDks2bZIdFTIkpp6qZeI8bNaAdiCIC4iOF1xegW+vfdWMu2af9q6jzR CVjo80IbOjodSAcuc057xJaXEUNwDdUX0X0HiMdBp8v0GB38B6oIzaYRYlTvnbFB uPEW7g== Received: from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4aydea0ete-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 10 Dec 2025 19:43:04 +0000 (GMT) Received: by mail-qt1-f199.google.com with SMTP id d75a77b69052e-4efef582d65so3415371cf.3 for ; Wed, 10 Dec 2025 11:43:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1765395783; x=1766000583; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=CJryTvBlX1l57AzfpPj3XJrxYhHGAfPLn56090dAH44=; b=X7nFPiEqSfpdMvpvBbicFjfX2avS31FnB57V3QKj+4tc+AGju/oGwoIx6IoaCOqyZJ BiO0NtAIDFdMCbwdiWIQyPtWIYF2k3a5r31lzXbUjGiIBtd/V9gA9ir3u5fVJl5Y/NND BcafaEiBMT5gnYCWznPdN1h6LTxFMUFaLpQLdfgB8ewZiLIbn7mL07xCZ+nSIsY7Y/FQ 7Yiaa2EfBRfN60cm6IXzQWa7ruVAo0pdqxMMgYVO2ryBDUCqwnbd5+Y5WUIZrI57XQPS bOITt4l+I46iZlwrhcgFdd8n9uS2FuVAzY6AVzjyo7p40nkDURycmMZ5BarOtKTb4Mk0 JIbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765395783; x=1766000583; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=CJryTvBlX1l57AzfpPj3XJrxYhHGAfPLn56090dAH44=; b=C6mrtFs98HhJ9W6djz4U8U7KWr0WihsO+9u5dH6dpXl2aRn3/ViK8OP4z/kouj34Ft mrB7Qw7ITabaym7BE9SIgLmZXjQFl+cESDxiG0G4QebqKI3kFUQmqyoWV9/WCqLQp/uJ A23UYAM0PYkyRBs/7LSzyQYtxfyN4nDfAzDywTpDKiSxb/mz0BQ+GdAJU92M9LkgN6sp 2AuiATXrZw84u9XngUPhmv7J0qJ6KwEzHXk9zX0LjpgR9cK8yb7VjafZO8PavCOeQWs4 B0nVwQVCScsK7Ol3eHwFk1ix0eisNJHn08BVK5qUgChIC58pVFh0NjCVppSJh/3YTaPE icvw== X-Forwarded-Encrypted: i=1; AJvYcCXSxT7EDyrdS7WnNjcM8Yziy98EbagvA+pCw2u5nqhP90mT5qe7lnn/8zJZxWvuS7J1D3wNdPYU5syTMqo=@vger.kernel.org X-Gm-Message-State: AOJu0Yy7sNTn5r0kucy1L68T6Y4UvihaEDnw0Sz20zkAtL4UnmocNuwC rG0XwOR1Ay0GAbDIkNgDW26KCB6p4qls37NlcXDgV22QCtP7hJJxrtI13iWUI5IdL3zLXpMsy66 QMh8GoGQthfQCkG4HPvM8V7Xr5n6RkjyqXNe+8fQ5sRU7RiGzIbSJpb5+v3KwutDlEPPSBzm/us k= X-Gm-Gg: ASbGncunlrR6LvV256XDPfuCfySnlxlZr2JkiMzwpdLlnRvNUZJ4nLx1PIQe6Dw/Twe pMscTw7xfk/OyQfIVj0m89VLgHs4qem61we/dsxoDXeCo3PNZ4DMyWtzOXVxrm8kOkZII15Guhf qxFnDKgoD3iAZKexckEMfvW67C2nEOhNJdoqxmGb9Et0FEWM0yLpKyGPoNI3AYHJkW8lgGOecN+ ZbS4Q79Cmu+WfWNbF5Yqsu+2VVRtAqk4AQ4QoWARDtu9eSJMVDaA5OkVzyga5XWaPxfSPfqpMJU 1kkgXuNEZbEVaGXjOPMR7Wwi7azItFSEmTRX50CkBgt+DmGVW37tLr2fZ7umqnYgLAzzpn/jGV8 T/DsCRaqcyVt/NDb9KEGRK6xbEw2BLJhfKbcgO7vnscbLo8MmWDO3MOPNWdULL0RrkQcfiKAQiK YIdd8rzmo5eUmxRZE94ehP+IM= X-Received: by 2002:ac8:7d55:0:b0:4ee:4214:31ff with SMTP id d75a77b69052e-4f1b19b8b5fmr49320531cf.13.1765395783131; Wed, 10 Dec 2025 11:43:03 -0800 (PST) X-Google-Smtp-Source: AGHT+IEQ66cvFY+gHoHakPOhKpYFUXPMD6XwUSTwI51XcWdr5cXocJ30W0NicrfCRBTS4xmf43T1uA== X-Received: by 2002:ac8:7d55:0:b0:4ee:4214:31ff with SMTP id d75a77b69052e-4f1b19b8b5fmr49320261cf.13.1765395782720; Wed, 10 Dec 2025 11:43:02 -0800 (PST) Received: from umbar.lan (2001-14ba-a073-af00-264b-feff-fe8b-be8a.rev.dnainternet.fi. [2001:14ba:a073:af00:264b:feff:fe8b:be8a]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-598f3199e93sm104845e87.96.2025.12.10.11.43.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 10 Dec 2025 11:43:02 -0800 (PST) From: Dmitry Baryshkov Date: Wed, 10 Dec 2025 21:42:58 +0200 Subject: [PATCH RESEND 2/3] drm/atomic: add max_size check to drm_property_replace_blob_from_id() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251210-drm-fix-lut-checks-v1-2-10ae38519f43@oss.qualcomm.com> References: <20251210-drm-fix-lut-checks-v1-0-10ae38519f43@oss.qualcomm.com> In-Reply-To: <20251210-drm-fix-lut-checks-v1-0-10ae38519f43@oss.qualcomm.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Harry Wentland , Leo Li , Rodrigo Siqueira , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, amd-gfx@lists.freedesktop.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=6121; i=dmitry.baryshkov@oss.qualcomm.com; h=from:subject:message-id; bh=zXvnGnGuLkJqi0K2ojfpmFIykU/bxtYPAL0lpdGu0vw=; b=owEBbQGS/pANAwAKAYs8ij4CKSjVAcsmYgBpOc1CmLYcBrr3riLWAvi2Gop6rn00DEG4zQih2 Oc56Y4tzmuJATMEAAEKAB0WIQRMcISVXLJjVvC4lX+LPIo+Aiko1QUCaTnNQgAKCRCLPIo+Aiko 1XvACACa655mfgnTtUZoUiPqQNxFW6hpO7DVJlW8zUp5qJ0u71eRqIL2M4IUKYoRRuyiBQK4T33 qdS2qMrK9YAuKO4HD9SdrHg/yw8xqt5FgouNRN3IR0+QCk4agYDEmVPyfLHalKHyoM61dwqQ0rN AGwKIz+fNF7ygJnt5ofSDXZlncubwfMUsiZf90wQgFus5onXi/uORPIRPgbFBVyWJe/1uV565vn IUUybaXJgD1+BpX6Fp1pDXAPu8jkgn8aRfiNHu8AmPF7hshFM2fR1dvG+A72JINpVbfv1xt4rNp buRLFAlK+CN7eAxd5yiQkW949nPGHl58puTrqSTcynqNedHn X-Developer-Key: i=dmitry.baryshkov@oss.qualcomm.com; a=openpgp; fpr=8F88381DD5C873E4AE487DA5199BF1243632046A X-Proofpoint-ORIG-GUID: C5CuWn25RPJx8zVE-OLpWvWo6FPIqNW3 X-Authority-Analysis: v=2.4 cv=ZO/aWH7b c=1 sm=1 tr=0 ts=6939cd48 cx=c_pps a=WeENfcodrlLV9YRTxbY/uA==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=wP3pNCr1ah4A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=EUspDBNiAAAA:8 a=L8DPiWb6BhtAijwQbtEA:9 a=QEXdDO2ut3YA:10 a=kacYvNCVWA4VmyqE58fU:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUxMjEwMDE2MSBTYWx0ZWRfX+ZbrQeWiKsJL yI9e6mD6lZ10Go3i55K6DBL17Zf47um02ogX66D+Y5LnrPxd62nFWMSSD9g3oGa4B0inxYNs4SK ArPq8ZoPXHurnBpfCi7uw0IVaZijvJ7G+Bmkil7Hx0ofXM+Wj7niY0Asckxkrz5PD2dHUN8wmDQ hh49fkTlJoPf37TaQhcOk12Bw25rfanMI9zodTTc7Jxsy3onS5uf4HSnCuSZwdZxbi1xM6/VzPK 2hRWsN/vROBghgfaeM669qosebBZieIpS4KcaihagWyFN51Ncu661rgjhnc/4aDxURli47VrAOx zUqDhiLMZtrxAYyZRKcytY3LP5i7vB5/YX55qFQak3g7wFtP+zNih9baUw4YNH7Yn/3dn46aE9U pK7Y8wEKo4AFrkTuitAqYG0ayyULeg== X-Proofpoint-GUID: C5CuWn25RPJx8zVE-OLpWvWo6FPIqNW3 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49 definitions=2025-12-10_02,2025-12-09_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 spamscore=0 adultscore=0 phishscore=0 malwarescore=0 bulkscore=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2510240001 definitions=main-2512100161 The function drm_property_replace_blob_from_id() allows checking whether the blob size is equal to a predefined value. In case of variable-size properties (like the gamma / degamma LUTs) we might want to check for the blob size against the maximum, allowing properties of the size lesser than the max supported by the hardware. Extend the function in order to support such checks. Signed-off-by: Dmitry Baryshkov --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 5 +++++ drivers/gpu/drm/drm_atomic_uapi.c | 7 +++++-- drivers/gpu/drm/drm_property.c | 11 +++++++++++ include/drm/drm_property.h | 1 + 4 files changed, 22 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/driv= ers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c index e027798ece03..d19631b5d9e1 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c @@ -1677,6 +1677,7 @@ dm_atomic_plane_set_property(struct drm_plane *plane, &dm_plane_state->degamma_lut, val, -1, sizeof(struct drm_color_lut), + 0, &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; @@ -1695,6 +1696,7 @@ dm_atomic_plane_set_property(struct drm_plane *plane, &dm_plane_state->ctm, val, sizeof(struct drm_color_ctm_3x4), -1, + 0, &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; @@ -1703,6 +1705,7 @@ dm_atomic_plane_set_property(struct drm_plane *plane, &dm_plane_state->shaper_lut, val, -1, sizeof(struct drm_color_lut), + 0, &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; @@ -1716,6 +1719,7 @@ dm_atomic_plane_set_property(struct drm_plane *plane, &dm_plane_state->lut3d, val, -1, sizeof(struct drm_color_lut), + 0, &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; @@ -1724,6 +1728,7 @@ dm_atomic_plane_set_property(struct drm_plane *plane, &dm_plane_state->blend_lut, val, -1, sizeof(struct drm_color_lut), + 0, &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic= _uapi.c index 85dbdaa4a2e2..7d2076f1006e 100644 --- a/drivers/gpu/drm/drm_atomic_uapi.c +++ b/drivers/gpu/drm/drm_atomic_uapi.c @@ -388,6 +388,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc= *crtc, &state->degamma_lut, val, -1, sizeof(struct drm_color_lut), + 0, &replaced); state->color_mgmt_changed |=3D replaced; return ret; @@ -395,7 +396,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc= *crtc, ret =3D drm_property_replace_blob_from_id(dev, &state->ctm, val, - sizeof(struct drm_color_ctm), -1, + sizeof(struct drm_color_ctm), -1, 0, &replaced); state->color_mgmt_changed |=3D replaced; return ret; @@ -404,6 +405,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc= *crtc, &state->gamma_lut, val, -1, sizeof(struct drm_color_lut), + 0, &replaced); state->color_mgmt_changed |=3D replaced; return ret; @@ -546,6 +548,7 @@ static int drm_atomic_plane_set_property(struct drm_pla= ne *plane, val, -1, sizeof(struct drm_mode_rect), + 0, &replaced); return ret; } else if (property =3D=3D plane->scaling_filter_property) { @@ -741,7 +744,7 @@ static int drm_atomic_connector_set_property(struct drm= _connector *connector, ret =3D drm_property_replace_blob_from_id(dev, &state->hdr_output_metadata, val, - sizeof(struct hdr_output_metadata), -1, + sizeof(struct hdr_output_metadata), -1, 0, &replaced); return ret; } else if (property =3D=3D config->aspect_ratio_property) { diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c index 596272149a35..5befe443135d 100644 --- a/drivers/gpu/drm/drm_property.c +++ b/drivers/gpu/drm/drm_property.c @@ -759,6 +759,7 @@ EXPORT_SYMBOL(drm_property_replace_blob); * @blob_id: the id of the new blob to replace with * @expected_size: expected size of the blob property * @expected_elem_size: expected size of an element in the blob property + * @max_size: the maximum size of the blob property for variable-size blobs * @replaced: if the blob was in fact replaced * * Look up the new blob from id, take its reference, check expected sizes = of @@ -773,6 +774,7 @@ int drm_property_replace_blob_from_id(struct drm_device= *dev, uint64_t blob_id, ssize_t expected_size, ssize_t expected_elem_size, + ssize_t max_size, bool *replaced) { struct drm_property_blob *new_blob =3D NULL; @@ -801,6 +803,15 @@ int drm_property_replace_blob_from_id(struct drm_devic= e *dev, drm_property_blob_put(new_blob); return -EINVAL; } + + if (max_size > 0 && + new_blob->length > max_size) { + drm_dbg_atomic(dev, + "[BLOB:%d] length %zu greater than max %zu\n", + new_blob->base.id, new_blob->length, max_size); + drm_property_blob_put(new_blob); + return -EINVAL; + } } =20 *replaced |=3D drm_property_replace_blob(blob, new_blob); diff --git a/include/drm/drm_property.h b/include/drm/drm_property.h index 082f29156b3e..aa49b5a42bb5 100644 --- a/include/drm/drm_property.h +++ b/include/drm/drm_property.h @@ -284,6 +284,7 @@ int drm_property_replace_blob_from_id(struct drm_device= *dev, uint64_t blob_id, ssize_t expected_size, ssize_t expected_elem_size, + ssize_t max_size, bool *replaced); int drm_property_replace_global_blob(struct drm_device *dev, struct drm_property_blob **replace, --=20 2.47.3