The kernel specifies LUT table sizes in a separate property, however it
doesn't enforce it as a maximum. Some drivers implement max suze check
on their own in the atomic_check path. Other drivers simply ignore the
issue. Perform LUT size validation in the generic place.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
drivers/gpu/drm/drm_atomic_uapi.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
index dff1fdefcbeb..8489823a9773 100644
--- a/drivers/gpu/drm/drm_atomic_uapi.c
+++ b/drivers/gpu/drm/drm_atomic_uapi.c
@@ -413,10 +413,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
} else if (property == config->prop_vrr_enabled) {
state->vrr_enabled = val;
} else if (property == config->degamma_lut_property) {
+ const elem_size = sizeof(struct drm_color_lut);
+ u64 lut_size;
+
+ ret = drm_object_immutable_property_get_value(&crtc->base,
+ config->degamma_lut_size_property,
+ &lut_size);
+ if (ret)
+ return ret;
+
ret = drm_property_replace_blob_from_id(dev,
&state->degamma_lut,
val,
- -1, -1, sizeof(struct drm_color_lut),
+ elem_size * lut_size, -1, elem_size,
&replaced);
state->color_mgmt_changed |= replaced;
return ret;
@@ -429,10 +438,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
state->color_mgmt_changed |= replaced;
return ret;
} else if (property == config->gamma_lut_property) {
+ const elem_size = sizeof(struct drm_color_lut);
+ u64 lut_size;
+
+ ret = drm_object_immutable_property_get_value(&crtc->base,
+ config->gamma_lut_size_property,
+ &lut_size);
+ if (ret)
+ return ret;
+
ret = drm_property_replace_blob_from_id(dev,
&state->gamma_lut,
val,
- -1, -1, sizeof(struct drm_color_lut),
+ elem_size * lut_size, -1, elem_size,
&replaced);
state->color_mgmt_changed |= replaced;
return ret;
--
2.47.3Hi Dmitry,
kernel test robot noticed the following build errors:
[auto build test ERROR on 130343ee6bca9895c47d314467db7dd3dcc8bc35]
url: https://github.com/intel-lab-lkp/linux/commits/Dmitry-Baryshkov/drm-mode_object-add-drm_object_immutable_property_get_value/20251228-112526
base: 130343ee6bca9895c47d314467db7dd3dcc8bc35
patch link: https://lore.kernel.org/r/20251228-drm-fix-lut-checks-v2-3-50f5d1a260a7%40oss.qualcomm.com
patch subject: [PATCH v2 3/3] drm/atomic: verify that gamma/degamma LUTs are not too big
config: x86_64-rhel-9.4 (https://download.01.org/0day-ci/archive/20251229/202512290531.US56hi8Q-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251229/202512290531.US56hi8Q-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512290531.US56hi8Q-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/gpu/drm/drm_atomic_uapi.c: In function 'drm_atomic_crtc_set_property':
>> drivers/gpu/drm/drm_atomic_uapi.c:416:23: error: type defaults to 'int' in declaration of 'elem_size' [-Wimplicit-int]
416 | const elem_size = sizeof(struct drm_color_lut);
| ^~~~~~~~~
drivers/gpu/drm/drm_atomic_uapi.c:441:23: error: type defaults to 'int' in declaration of 'elem_size' [-Wimplicit-int]
441 | const elem_size = sizeof(struct drm_color_lut);
| ^~~~~~~~~
vim +416 drivers/gpu/drm/drm_atomic_uapi.c
395
396 static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
397 struct drm_crtc_state *state, struct drm_property *property,
398 uint64_t val)
399 {
400 struct drm_device *dev = crtc->dev;
401 struct drm_mode_config *config = &dev->mode_config;
402 bool replaced = false;
403 int ret;
404
405 if (property == config->prop_active)
406 state->active = val;
407 else if (property == config->prop_mode_id) {
408 struct drm_property_blob *mode =
409 drm_property_lookup_blob(dev, val);
410 ret = drm_atomic_set_mode_prop_for_crtc(state, mode);
411 drm_property_blob_put(mode);
412 return ret;
413 } else if (property == config->prop_vrr_enabled) {
414 state->vrr_enabled = val;
415 } else if (property == config->degamma_lut_property) {
> 416 const elem_size = sizeof(struct drm_color_lut);
417 u64 lut_size;
418
419 ret = drm_object_immutable_property_get_value(&crtc->base,
420 config->degamma_lut_size_property,
421 &lut_size);
422 if (ret)
423 return ret;
424
425 ret = drm_property_replace_blob_from_id(dev,
426 &state->degamma_lut,
427 val,
428 elem_size * lut_size, -1, elem_size,
429 &replaced);
430 state->color_mgmt_changed |= replaced;
431 return ret;
432 } else if (property == config->ctm_property) {
433 ret = drm_property_replace_blob_from_id(dev,
434 &state->ctm,
435 val,
436 -1, sizeof(struct drm_color_ctm), -1,
437 &replaced);
438 state->color_mgmt_changed |= replaced;
439 return ret;
440 } else if (property == config->gamma_lut_property) {
441 const elem_size = sizeof(struct drm_color_lut);
442 u64 lut_size;
443
444 ret = drm_object_immutable_property_get_value(&crtc->base,
445 config->gamma_lut_size_property,
446 &lut_size);
447 if (ret)
448 return ret;
449
450 ret = drm_property_replace_blob_from_id(dev,
451 &state->gamma_lut,
452 val,
453 elem_size * lut_size, -1, elem_size,
454 &replaced);
455 state->color_mgmt_changed |= replaced;
456 return ret;
457 } else if (property == config->prop_out_fence_ptr) {
458 s32 __user *fence_ptr = u64_to_user_ptr(val);
459
460 if (!fence_ptr)
461 return 0;
462
463 if (put_user(-1, fence_ptr))
464 return -EFAULT;
465
466 set_out_fence_for_crtc(state->state, crtc, fence_ptr);
467 } else if (property == crtc->scaling_filter_property) {
468 state->scaling_filter = val;
469 } else if (property == crtc->sharpness_strength_property) {
470 state->sharpness_strength = val;
471 } else if (crtc->funcs->atomic_set_property) {
472 return crtc->funcs->atomic_set_property(crtc, state, property, val);
473 } else {
474 drm_dbg_atomic(crtc->dev,
475 "[CRTC:%d:%s] unknown property [PROP:%d:%s]\n",
476 crtc->base.id, crtc->name,
477 property->base.id, property->name);
478 return -EINVAL;
479 }
480
481 return 0;
482 }
483
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Hi Dmitry,
kernel test robot noticed the following build errors:
[auto build test ERROR on 130343ee6bca9895c47d314467db7dd3dcc8bc35]
url: https://github.com/intel-lab-lkp/linux/commits/Dmitry-Baryshkov/drm-mode_object-add-drm_object_immutable_property_get_value/20251228-112526
base: 130343ee6bca9895c47d314467db7dd3dcc8bc35
patch link: https://lore.kernel.org/r/20251228-drm-fix-lut-checks-v2-3-50f5d1a260a7%40oss.qualcomm.com
patch subject: [PATCH v2 3/3] drm/atomic: verify that gamma/degamma LUTs are not too big
config: x86_64-randconfig-071-20251228 (https://download.01.org/0day-ci/archive/20251228/202512282230.ryhYGLxv-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251228/202512282230.ryhYGLxv-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512282230.ryhYGLxv-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/gpu/drm/drm_atomic_uapi.c: In function 'drm_atomic_crtc_set_property':
>> drivers/gpu/drm/drm_atomic_uapi.c:416:23: error: type defaults to 'int' in declaration of 'elem_size' [-Wimplicit-int]
416 | const elem_size = sizeof(struct drm_color_lut);
| ^~~~~~~~~
drivers/gpu/drm/drm_atomic_uapi.c:441:23: error: type defaults to 'int' in declaration of 'elem_size' [-Wimplicit-int]
441 | const elem_size = sizeof(struct drm_color_lut);
| ^~~~~~~~~
vim +416 drivers/gpu/drm/drm_atomic_uapi.c
395
396 static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
397 struct drm_crtc_state *state, struct drm_property *property,
398 uint64_t val)
399 {
400 struct drm_device *dev = crtc->dev;
401 struct drm_mode_config *config = &dev->mode_config;
402 bool replaced = false;
403 int ret;
404
405 if (property == config->prop_active)
406 state->active = val;
407 else if (property == config->prop_mode_id) {
408 struct drm_property_blob *mode =
409 drm_property_lookup_blob(dev, val);
410 ret = drm_atomic_set_mode_prop_for_crtc(state, mode);
411 drm_property_blob_put(mode);
412 return ret;
413 } else if (property == config->prop_vrr_enabled) {
414 state->vrr_enabled = val;
415 } else if (property == config->degamma_lut_property) {
> 416 const elem_size = sizeof(struct drm_color_lut);
417 u64 lut_size;
418
419 ret = drm_object_immutable_property_get_value(&crtc->base,
420 config->degamma_lut_size_property,
421 &lut_size);
422 if (ret)
423 return ret;
424
425 ret = drm_property_replace_blob_from_id(dev,
426 &state->degamma_lut,
427 val,
428 elem_size * lut_size, -1, elem_size,
429 &replaced);
430 state->color_mgmt_changed |= replaced;
431 return ret;
432 } else if (property == config->ctm_property) {
433 ret = drm_property_replace_blob_from_id(dev,
434 &state->ctm,
435 val,
436 -1, sizeof(struct drm_color_ctm), -1,
437 &replaced);
438 state->color_mgmt_changed |= replaced;
439 return ret;
440 } else if (property == config->gamma_lut_property) {
441 const elem_size = sizeof(struct drm_color_lut);
442 u64 lut_size;
443
444 ret = drm_object_immutable_property_get_value(&crtc->base,
445 config->gamma_lut_size_property,
446 &lut_size);
447 if (ret)
448 return ret;
449
450 ret = drm_property_replace_blob_from_id(dev,
451 &state->gamma_lut,
452 val,
453 elem_size * lut_size, -1, elem_size,
454 &replaced);
455 state->color_mgmt_changed |= replaced;
456 return ret;
457 } else if (property == config->prop_out_fence_ptr) {
458 s32 __user *fence_ptr = u64_to_user_ptr(val);
459
460 if (!fence_ptr)
461 return 0;
462
463 if (put_user(-1, fence_ptr))
464 return -EFAULT;
465
466 set_out_fence_for_crtc(state->state, crtc, fence_ptr);
467 } else if (property == crtc->scaling_filter_property) {
468 state->scaling_filter = val;
469 } else if (property == crtc->sharpness_strength_property) {
470 state->sharpness_strength = val;
471 } else if (crtc->funcs->atomic_set_property) {
472 return crtc->funcs->atomic_set_property(crtc, state, property, val);
473 } else {
474 drm_dbg_atomic(crtc->dev,
475 "[CRTC:%d:%s] unknown property [PROP:%d:%s]\n",
476 crtc->base.id, crtc->name,
477 property->base.id, property->name);
478 return -EINVAL;
479 }
480
481 return 0;
482 }
483
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Hi Dmitry,
kernel test robot noticed the following build errors:
[auto build test ERROR on 130343ee6bca9895c47d314467db7dd3dcc8bc35]
url: https://github.com/intel-lab-lkp/linux/commits/Dmitry-Baryshkov/drm-mode_object-add-drm_object_immutable_property_get_value/20251228-112526
base: 130343ee6bca9895c47d314467db7dd3dcc8bc35
patch link: https://lore.kernel.org/r/20251228-drm-fix-lut-checks-v2-3-50f5d1a260a7%40oss.qualcomm.com
patch subject: [PATCH v2 3/3] drm/atomic: verify that gamma/degamma LUTs are not too big
config: x86_64-randconfig-076-20251228 (https://download.01.org/0day-ci/archive/20251228/202512282045.vcM3bTwk-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251228/202512282045.vcM3bTwk-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512282045.vcM3bTwk-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/gpu/drm/drm_atomic_uapi.c:416:9: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int]
416 | const elem_size = sizeof(struct drm_color_lut);
| ~~~~~ ^
| int
drivers/gpu/drm/drm_atomic_uapi.c:441:9: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int]
441 | const elem_size = sizeof(struct drm_color_lut);
| ~~~~~ ^
| int
2 errors generated.
vim +/int +416 drivers/gpu/drm/drm_atomic_uapi.c
395
396 static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
397 struct drm_crtc_state *state, struct drm_property *property,
398 uint64_t val)
399 {
400 struct drm_device *dev = crtc->dev;
401 struct drm_mode_config *config = &dev->mode_config;
402 bool replaced = false;
403 int ret;
404
405 if (property == config->prop_active)
406 state->active = val;
407 else if (property == config->prop_mode_id) {
408 struct drm_property_blob *mode =
409 drm_property_lookup_blob(dev, val);
410 ret = drm_atomic_set_mode_prop_for_crtc(state, mode);
411 drm_property_blob_put(mode);
412 return ret;
413 } else if (property == config->prop_vrr_enabled) {
414 state->vrr_enabled = val;
415 } else if (property == config->degamma_lut_property) {
> 416 const elem_size = sizeof(struct drm_color_lut);
417 u64 lut_size;
418
419 ret = drm_object_immutable_property_get_value(&crtc->base,
420 config->degamma_lut_size_property,
421 &lut_size);
422 if (ret)
423 return ret;
424
425 ret = drm_property_replace_blob_from_id(dev,
426 &state->degamma_lut,
427 val,
428 elem_size * lut_size, -1, elem_size,
429 &replaced);
430 state->color_mgmt_changed |= replaced;
431 return ret;
432 } else if (property == config->ctm_property) {
433 ret = drm_property_replace_blob_from_id(dev,
434 &state->ctm,
435 val,
436 -1, sizeof(struct drm_color_ctm), -1,
437 &replaced);
438 state->color_mgmt_changed |= replaced;
439 return ret;
440 } else if (property == config->gamma_lut_property) {
441 const elem_size = sizeof(struct drm_color_lut);
442 u64 lut_size;
443
444 ret = drm_object_immutable_property_get_value(&crtc->base,
445 config->gamma_lut_size_property,
446 &lut_size);
447 if (ret)
448 return ret;
449
450 ret = drm_property_replace_blob_from_id(dev,
451 &state->gamma_lut,
452 val,
453 elem_size * lut_size, -1, elem_size,
454 &replaced);
455 state->color_mgmt_changed |= replaced;
456 return ret;
457 } else if (property == config->prop_out_fence_ptr) {
458 s32 __user *fence_ptr = u64_to_user_ptr(val);
459
460 if (!fence_ptr)
461 return 0;
462
463 if (put_user(-1, fence_ptr))
464 return -EFAULT;
465
466 set_out_fence_for_crtc(state->state, crtc, fence_ptr);
467 } else if (property == crtc->scaling_filter_property) {
468 state->scaling_filter = val;
469 } else if (property == crtc->sharpness_strength_property) {
470 state->sharpness_strength = val;
471 } else if (crtc->funcs->atomic_set_property) {
472 return crtc->funcs->atomic_set_property(crtc, state, property, val);
473 } else {
474 drm_dbg_atomic(crtc->dev,
475 "[CRTC:%d:%s] unknown property [PROP:%d:%s]\n",
476 crtc->base.id, crtc->name,
477 property->base.id, property->name);
478 return -EINVAL;
479 }
480
481 return 0;
482 }
483
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
© 2016 - 2026 Red Hat, Inc.