From nobody Tue Feb 10 13:16:45 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DADFD2046BA for ; Sun, 28 Dec 2025 03:24:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766892256; cv=none; b=M7xzvWTq30SUd40bsGwkOeulSzxlIo9qvgeXOMTuEKqcUFd42DNoRb8mzhkeaCHytm4BRx9Dmd/ayL+h0VtNmkbqJJkUoh3TmD0caC11+U7pKmMwQA29kU/d8OAkzVTvdRURHEeq/kC59SDGUpzui0zOBXESSq5/ADppDX/XuZU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766892256; c=relaxed/simple; bh=UkO7gGzz204YJlbpHl9qFMBJirNFYawZoOhKgADqEnM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=H5gQmFrNox6Bk6Jf4XtIbyUzzti29nDPPjwuuhKRwBIpQZ97qFF/rKeHQ2rcViIXsvgXC8FrR8s9JeffVkZom0FC1U/L6dtzyTdI0n1hO9PiLkGDJoJFzdMqVxbon6pUM8vl03qBNrP3LVKfPOR1QLmCNUe/T1MB7RaJe1deOKU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=nk4YVERI; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=anHwIDHF; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="nk4YVERI"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="anHwIDHF" Received: from pps.filterd (m0279867.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 5BS2wGPV1463480 for ; Sun, 28 Dec 2025 03:24:14 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= i/ZE9RtLemTsfDhGA7S/TMDUgGHbHWM5z3Ovm2RpDnU=; b=nk4YVERIVG+3upJx ei+/HxEVAlFjbJaZKgC+gi4qrF/RgWbK3OkH8B8FSvCGHk4gIokCNcVPNi5qvSvH s/W9rysqHTb6/hHqf8J/davH8C+JLaGIU6yzm1unSwDOkD3R+33IIYhrM+HBsBrG FcMEoI9i7Gn+qaNODDGfWbGjusapZDMZG0reKOTj4iJuGtZEjOE73dH09obpuInz C2WaqJzQJYzs4hc2V4NJjdHxtILSlOX/7+9kT/7MgVxirr+fNoFBqXm6/9H1AQAO KECpTS0sybHhT8TMPUt3bAlhIChRo1qZAHNX1jWTzUyT/1KCHBnTb+uFTegeOtle 0iaXdg== Received: from mail-qt1-f197.google.com (mail-qt1-f197.google.com [209.85.160.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4ba55e1sht-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sun, 28 Dec 2025 03:24:13 +0000 (GMT) Received: by mail-qt1-f197.google.com with SMTP id d75a77b69052e-4edb6a94873so159768521cf.0 for ; Sat, 27 Dec 2025 19:24:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1766892253; x=1767497053; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=i/ZE9RtLemTsfDhGA7S/TMDUgGHbHWM5z3Ovm2RpDnU=; b=anHwIDHF8E5BYMOnyw/Ka2sGAdqJzd/cnyqRZG8vxq7douihstsgaTaO9VdC/nh2On srP+I8Npne07Es9rYfWXvhvIlBbYmokesBtTcE9aZpSrXs0S97M0cfeq5NCtQRXnAaO+ 67LofFz4scoXjA/RBQhO3HyE+V5MMy92VCzPwXyMQVxDuUddwWEcVwTrhHOwZeeoSX1v 8RtZRMrTBrKn1gTYkcuZh5md7xE2Y0jff8LnlSYUZFc5BlhzUlL2QPTHegdQE3V01q7x /RS2yFflptePK/XXo0N24zG0rQ+IJ/dWgu6hGOICy+TJG7k/PbYqfCO0Gpjace/XyxX/ 5tAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766892253; x=1767497053; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=i/ZE9RtLemTsfDhGA7S/TMDUgGHbHWM5z3Ovm2RpDnU=; b=DfEJD/Xl0/ZyUewqhaRlaFhvc0rhS4/M1lACiA6q75HSbPF4xlu4A7QZwdZSwFqUmZ /A58s2WmAhbvUaDQrCdjJXl/gSnzhuKiZ1GRWegu9Z1elkFSebBnVGKKnva+VjdcdKle QjBTZHkeU+tLLYdbZo3k+yK/qwP4k71X/9sZQ09rz4hy1klcp5UTbqwESshefbS3arhD 0d5pVcK5fHaO6sUxTOkai+Pj0H2nRdnrdyIeaB9uGvWc0MGnOILLcEZ4cQPX0LX1lwZ/ 5IuP0SaZnZRPsjyWLipOyIN0zRnE36qwKxlSdOemXn3BuM0ZhnehbcDpkiZ6BIp1BpS5 FjZA== X-Forwarded-Encrypted: i=1; AJvYcCXn3LZm4LDBo5GwNdNqHD/3jsH6hu4uUoOpnnekwZEjmI2rSMviC0WluW4luKqtZW0elxb/v1m75Yt4as8=@vger.kernel.org X-Gm-Message-State: AOJu0Yy0xRilZ2EUhHeWrML1ujMJkwrZP1isba/A0emRjcRiwwntfiId /TQ7Jj2iqtSp4mBWauAUObf6ORFBWODnUZgP6D5nRE8/ABaswWLIcH7aSkOgMTZq74pULA2Yp4M rhbqC1jgexZkH+hH1ETe/2maUBzMRmTfe+aOFrRe24NlrJfOUz51HwmYzfC/OyrSHci0= X-Gm-Gg: AY/fxX640a3nimMYCAZJJhi5tE2pIIkwdOQjhjXFjfhaay0UfINXrL65iKFar4N0CHw QVtOviFOUSt/YVWviyhjg5y/GW+9q/o2k+dKiK/cQBDAZl5MbPVB4xbl8kcPlQ2eYVp93BZe9VB WdAJMPd3xkL7iG0xH2LkPtQs+O0KFpRcizxLhsdoB+7Us8ok9LB/H+X11NQd1c01Ru80sIRmori S18YLj6UOdtmf85y48nJKyk4ZQP8+QuWmpI2blSEh97vm8TT6k2n9ZDd3xTLsDTyzlyyt0gHpUZ ko9370gAbW3Wig7GzAQURpvgap07dYDRUBez6UFPi2g3wjRhdOnLDEt5UjhYhOck54v0HXeWN0P Pa27kXY+gzbX+5vpKWGgrhIqKNqMEzeCFtjL9qn0yXw2qIq6yxUmldcqqtDBZXkS4VgAX9Q2hOF 7Joz47iorJRtjMAFdBQQ2ijag= X-Received: by 2002:a05:622a:5c91:b0:4ed:dcf0:6c42 with SMTP id d75a77b69052e-4f4abd8cb47mr445720531cf.40.1766892252924; Sat, 27 Dec 2025 19:24:12 -0800 (PST) X-Google-Smtp-Source: AGHT+IE7sI66qV0k9krxjZk/aTcw5Gnyitndlxx7LAdj3JhMqT0YeUPsGI0pydm0oPEQLn/B8b/b5w== X-Received: by 2002:a05:622a:5c91:b0:4ed:dcf0:6c42 with SMTP id d75a77b69052e-4f4abd8cb47mr445720401cf.40.1766892252510; Sat, 27 Dec 2025 19:24:12 -0800 (PST) Received: from umbar.lan (2001-14ba-a073-af00-264b-feff-fe8b-be8a.rev.dnainternet.fi. [2001:14ba:a073:af00:264b:feff:fe8b:be8a]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-3812262b36dsm72149561fa.30.2025.12.27.19.24.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 27 Dec 2025 19:24:11 -0800 (PST) From: Dmitry Baryshkov Date: Sun, 28 Dec 2025 05:24:06 +0200 Subject: [PATCH v2 2/3] drm/atomic: add max_size check to drm_property_replace_blob_from_id() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251228-drm-fix-lut-checks-v2-2-50f5d1a260a7@oss.qualcomm.com> References: <20251228-drm-fix-lut-checks-v2-0-50f5d1a260a7@oss.qualcomm.com> In-Reply-To: <20251228-drm-fix-lut-checks-v2-0-50f5d1a260a7@oss.qualcomm.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Harry Wentland , Leo Li , Rodrigo Siqueira , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, amd-gfx@lists.freedesktop.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=7371; i=dmitry.baryshkov@oss.qualcomm.com; h=from:subject:message-id; bh=UkO7gGzz204YJlbpHl9qFMBJirNFYawZoOhKgADqEnM=; b=owEBbQGS/pANAwAKAYs8ij4CKSjVAcsmYgBpUKLWPCn5iT0mGoXdl7QJ6E+apnQ7rMLHMGJk4 G9sECIFLGyJATMEAAEKAB0WIQRMcISVXLJjVvC4lX+LPIo+Aiko1QUCaVCi1gAKCRCLPIo+Aiko 1SctB/9QMqX9xOhN+slQMAqjpgPgfBziS0hh5u1jxZXi7HNFhxc3+/JyQ9eOUwrsExpScvJVr68 x9UzhN+X7/NQcX13Rta3rU4XT2+CFZQSPyf4nTkWfBfwBoLIQrZSRJKMIADXXxvxNCfrgO0DWIB ekeglW3oAcSJkcoAXQgcSy5utQak3jZmais2WMk5ZgsAP7JAbYGMzBoiGJTFoR/Dja1GKM6F0Sz 7Kl07Yxm7TQW+8+GjJXUFZyABXeX+HsXcPusv+eRG/zm6fGYbve5qE+84vzYNO/pUHvEciIjzry q6uIVF/AlSUouUR3hldSUi2smRuPKyCfyiWsvxgqJCh6kjxF X-Developer-Key: i=dmitry.baryshkov@oss.qualcomm.com; a=openpgp; fpr=8F88381DD5C873E4AE487DA5199BF1243632046A X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUxMjI4MDAyOSBTYWx0ZWRfXwxrVkrevv00F qvneoQRkN2MzsgUwJ51gXPFyAAcHDtwJalq18U9bGEhemHmfGauqzfYAAamCf4O/sv58rm90QCI 9gbsRpPmv9dk1PMn28wtF2c/0LtHO/S5QyiJTRHODW6d+A+HZ8U0gP0VG8B54oKUkGwhXeidQv6 S4xidmZPhXL1kdIVRYmr6oK0OLfLBJ2NDdZBzo5v/AgjkMd86YH8VUi8W2/mNxu9PVrdePrI/yY Bmowao3Ob808HEXfik1+WGLvUBnBty1Y/RHwTpru/v116YPIgOJK4SVovIzAC8K71FxBF8VxEr5 rbE5PTMcHfZUFIl0LidzwWmV0VuS68berfRMXOeCmF73NmPO5xNG9vxAJF0Lxdvv+s6OpDlt2Yf AcyFSYrV9Wj3P6C4rmEwlhc8VVrQOBGSEDYxTCpmVA6rwZtf1An7V6iBLR2jf3SWqo7L8PLAUPn +HjvYrFWxIKSc9/KTcQ== X-Authority-Analysis: v=2.4 cv=UMDQ3Sfy c=1 sm=1 tr=0 ts=6950a2dd cx=c_pps a=EVbN6Ke/fEF3bsl7X48z0g==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=wP3pNCr1ah4A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=EUspDBNiAAAA:8 a=ySEUILROmfWDjamXepEA:9 a=QEXdDO2ut3YA:10 a=a_PwQJl-kcHnX1M80qC6:22 X-Proofpoint-ORIG-GUID: DdrL3R_ebvQGStCo8GUToLEEMcopTN-3 X-Proofpoint-GUID: DdrL3R_ebvQGStCo8GUToLEEMcopTN-3 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49 definitions=2025-12-28_01,2025-12-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 spamscore=0 lowpriorityscore=0 suspectscore=0 impostorscore=0 phishscore=0 adultscore=0 clxscore=1015 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2512120000 definitions=main-2512280029 The function drm_property_replace_blob_from_id() allows checking whether the blob size is equal to a predefined value. In case of variable-size properties (like the gamma / degamma LUTs) we might want to check for the blob size against the maximum, allowing properties of the size lesser than the max supported by the hardware. Extend the function in order to support such checks. Signed-off-by: Dmitry Baryshkov --- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 18 +++++++++-----= ---- drivers/gpu/drm/drm_atomic_uapi.c | 14 ++++++-------- drivers/gpu/drm/drm_property.c | 11 +++++++++++ include/drm/drm_property.h | 1 + 4 files changed, 27 insertions(+), 17 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/driv= ers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c index 2e3ee78999d9..8c5912b59e19 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c @@ -1676,8 +1676,8 @@ dm_atomic_plane_set_property(struct drm_plane *plane, if (property =3D=3D adev->mode_info.plane_degamma_lut_property) { ret =3D drm_property_replace_blob_from_id(plane->dev, &dm_plane_state->degamma_lut, - val, -1, - sizeof(struct drm_color_lut), + val, + -1, -1, sizeof(struct drm_color_lut), &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; @@ -1695,15 +1695,15 @@ dm_atomic_plane_set_property(struct drm_plane *plan= e, ret =3D drm_property_replace_blob_from_id(plane->dev, &dm_plane_state->ctm, val, - sizeof(struct drm_color_ctm_3x4), -1, + -1, sizeof(struct drm_color_ctm_3x4), -1, &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; } else if (property =3D=3D adev->mode_info.plane_shaper_lut_property) { ret =3D drm_property_replace_blob_from_id(plane->dev, &dm_plane_state->shaper_lut, - val, -1, - sizeof(struct drm_color_lut), + val, + -1, -1, sizeof(struct drm_color_lut), &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; @@ -1715,16 +1715,16 @@ dm_atomic_plane_set_property(struct drm_plane *plan= e, } else if (property =3D=3D adev->mode_info.plane_lut3d_property) { ret =3D drm_property_replace_blob_from_id(plane->dev, &dm_plane_state->lut3d, - val, -1, - sizeof(struct drm_color_lut), + val, + -1, -1, sizeof(struct drm_color_lut), &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; } else if (property =3D=3D adev->mode_info.plane_blend_lut_property) { ret =3D drm_property_replace_blob_from_id(plane->dev, &dm_plane_state->blend_lut, - val, -1, - sizeof(struct drm_color_lut), + val, + -1, -1, sizeof(struct drm_color_lut), &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic= _uapi.c index 7320db4b8489..dff1fdefcbeb 100644 --- a/drivers/gpu/drm/drm_atomic_uapi.c +++ b/drivers/gpu/drm/drm_atomic_uapi.c @@ -416,7 +416,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc= *crtc, ret =3D drm_property_replace_blob_from_id(dev, &state->degamma_lut, val, - -1, sizeof(struct drm_color_lut), + -1, -1, sizeof(struct drm_color_lut), &replaced); state->color_mgmt_changed |=3D replaced; return ret; @@ -424,7 +424,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc= *crtc, ret =3D drm_property_replace_blob_from_id(dev, &state->ctm, val, - sizeof(struct drm_color_ctm), -1, + -1, sizeof(struct drm_color_ctm), -1, &replaced); state->color_mgmt_changed |=3D replaced; return ret; @@ -432,7 +432,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc= *crtc, ret =3D drm_property_replace_blob_from_id(dev, &state->gamma_lut, val, - -1, sizeof(struct drm_color_lut), + -1, -1, sizeof(struct drm_color_lut), &replaced); state->color_mgmt_changed |=3D replaced; return ret; @@ -587,8 +587,7 @@ static int drm_atomic_plane_set_property(struct drm_pla= ne *plane, ret =3D drm_property_replace_blob_from_id(dev, &state->fb_damage_clips, val, - -1, - sizeof(struct drm_mode_rect), + -1, -1, sizeof(struct drm_mode_rect), &replaced); return ret; } else if (property =3D=3D plane->scaling_filter_property) { @@ -717,8 +716,7 @@ static int drm_atomic_color_set_data_property(struct dr= m_colorop *colorop, return drm_property_replace_blob_from_id(colorop->dev, &state->data, val, - size, - elem_size, + -1, size, elem_size, &replaced); } =20 @@ -876,7 +874,7 @@ static int drm_atomic_connector_set_property(struct drm= _connector *connector, ret =3D drm_property_replace_blob_from_id(dev, &state->hdr_output_metadata, val, - sizeof(struct hdr_output_metadata), -1, + -1, sizeof(struct hdr_output_metadata), -1, &replaced); return ret; } else if (property =3D=3D config->aspect_ratio_property) { diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c index 596272149a35..955fa960843b 100644 --- a/drivers/gpu/drm/drm_property.c +++ b/drivers/gpu/drm/drm_property.c @@ -757,6 +757,7 @@ EXPORT_SYMBOL(drm_property_replace_blob); * @dev: DRM device * @blob: a pointer to the member blob to be replaced * @blob_id: the id of the new blob to replace with + * @max_size: the maximum size of the blob property for variable-size blobs * @expected_size: expected size of the blob property * @expected_elem_size: expected size of an element in the blob property * @replaced: if the blob was in fact replaced @@ -771,6 +772,7 @@ EXPORT_SYMBOL(drm_property_replace_blob); int drm_property_replace_blob_from_id(struct drm_device *dev, struct drm_property_blob **blob, uint64_t blob_id, + ssize_t max_size, ssize_t expected_size, ssize_t expected_elem_size, bool *replaced) @@ -785,6 +787,15 @@ int drm_property_replace_blob_from_id(struct drm_devic= e *dev, return -EINVAL; } =20 + if (max_size > 0 && + new_blob->length > max_size) { + drm_dbg_atomic(dev, + "[BLOB:%d] length %zu greater than max %zu\n", + new_blob->base.id, new_blob->length, max_size); + drm_property_blob_put(new_blob); + return -EINVAL; + } + if (expected_size > 0 && new_blob->length !=3D expected_size) { drm_dbg_atomic(dev, diff --git a/include/drm/drm_property.h b/include/drm/drm_property.h index 082f29156b3e..aa49b5a42bb5 100644 --- a/include/drm/drm_property.h +++ b/include/drm/drm_property.h @@ -284,6 +284,7 @@ int drm_property_replace_blob_from_id(struct drm_device= *dev, uint64_t blob_id, ssize_t expected_size, ssize_t expected_elem_size, + ssize_t max_size, bool *replaced); int drm_property_replace_global_blob(struct drm_device *dev, struct drm_property_blob **replace, --=20 2.47.3