From nobody Tue Feb 10 01:31:36 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A6ED922FDEA for ; Tue, 6 Jan 2026 03:10:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767669008; cv=none; b=HuW6IwyzFqkMnS9iLP2KG81Yo9NvLIN7iAV+x6YL7d5UpUadE1T9WlgGZGkBTNLjAhPt8xHfCbyutCESA8YXqJtbbWBVD7r6poKxn2bxa9bwudLPDWDGUhmJs8n01UQwZwfflQOaok8AP98xeXZATkdgbX3E+3bdIza7lcWmbLk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767669008; c=relaxed/simple; bh=UkO7gGzz204YJlbpHl9qFMBJirNFYawZoOhKgADqEnM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=TgKz46trZMP5pJbTNQk1SS4RZgo64RpA4r46Z+vjbPAKz8NNroV3SAlKbNDGbBlmHgccGEuzBaBzXjzgMuGC2goy4Vkhm2mWNkD/CzzEGuI9Hh8yO+IMxhF28MLUaiFOCqP2hqBt3pNrt3dPeUaz9GuvJ6m/KEMkahVczsAV5r0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=iqVmyjmv; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=L5cNIwuQ; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="iqVmyjmv"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="L5cNIwuQ" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6060nKoT2886390 for ; Tue, 6 Jan 2026 03:10:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= i/ZE9RtLemTsfDhGA7S/TMDUgGHbHWM5z3Ovm2RpDnU=; b=iqVmyjmvarYskCET XopyhP7TvNVn+OSDbG75jjQMwgINvVjmVIEzP8R0yFt8oespgYd4BxiLUIjfVRdX 7N8QWATyHpn8Xct5g2HUw/gN3pLSEvg1PsbohufeiLNb4ZUjWlepY0ZMy6NGZHLp d0XXh7r1cYFKd1oK/2o27lnWm4jCfd3vtQTKMCYBEWKvAEjWsE1280BIFqLmlJf2 0QneHyHIemY8FmNpixW6Ze0gTLOrCpM3UfYlmHpETmxqxGAoTzeQEn0tJi3pMoTX K4wp6fWf44KSu7E5HRKeQxWMo1qaRIZRwYyHoP/XFv8GbWG/pe7fqQWsCL39/gbn ni4LpQ== Received: from mail-qv1-f70.google.com (mail-qv1-f70.google.com [209.85.219.70]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4bgpnd8h5s-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 06 Jan 2026 03:10:04 +0000 (GMT) Received: by mail-qv1-f70.google.com with SMTP id 6a1803df08f44-88a2f8e7d8dso15962586d6.1 for ; Mon, 05 Jan 2026 19:10:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1767669004; x=1768273804; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=i/ZE9RtLemTsfDhGA7S/TMDUgGHbHWM5z3Ovm2RpDnU=; b=L5cNIwuQoiKyatEx6nxkkbaFdht7fPW6NTE+eXTelQtUytjwQmCAE2M3QesOf27GXK S1S/6XoothjAW6lV5MR7G6IHvMgrr23NM9A7XeJbj6chvpb5S9T9NfXuyyndgt5gvcax 0mbbSfznT1QYkSOz+ATrp61wlBqZ82lw29o/OqPMwNx/lJC/Hn9zW9VM9hGddWIcuE4Z 2xx/Q6oulM5G93251tJXt7ohL5WzsUq4KdtAG2xzi9lIjUeE21g7cc6hfOCSh9UkLEFp o6cm8EPppC1YdD/y0P9Bi1pzgPhqB2Qo2LK6KuGr8iYqGp3VMmBIf5EFdKLhSVDiEck9 mN0w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767669004; x=1768273804; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=i/ZE9RtLemTsfDhGA7S/TMDUgGHbHWM5z3Ovm2RpDnU=; b=Yr7AG0e6gXUj2eYPbE2eRmmuD2PLDQuPD6aUNQ96kHr0a535nN6giWg0ztL6fOCphX Kk2K8zsrpWNAk89Iu6v1tDgyxtHw3ghU6wjwVFs91NdJwJr+StyUVvigoRxYfWvjTZxs g6DmCPc117W4wvcSZnohJcbU4sjMjt4fTMGb4ABaoFrA47zWXlkM/znSO/OHJGPOtGwd /fU4qgllRM6Wyj0b/NUIRNANxRP/k9/pIYKcBFEJv+2OsTOtjdHtNI4NTckuXi9y63GO PbE612fEYDvK7VVFL4hrgIap0HqQYZsbOW1F857iMh/lZQUKmL+pNEcPJf8sWmBgoqr6 C0ZQ== X-Forwarded-Encrypted: i=1; AJvYcCVP+bQJASE9Y2Nl42mBKSmSGzJbeKqec/ppuYTWT0GQGg8RSgHm1lmrEGBqNsR0+DW+S33aXadRIfxSbfg=@vger.kernel.org X-Gm-Message-State: AOJu0YxERlOjYErxDGF5dsP3FsXkFDyzb6WmxrgMsbkn6EXd9zLHMAMF d/Z1WgE1wSOrSA/3l8R8Sv291gWcrA+LvBR1QeDiEN5BCjH24LrOz/gPfqIy3F9QWvg0XWmgZEU EUwsYuiXka+PPU+mRCLnNku6ggUVDKcHUA6i5mo8CaR4gTF/0lWt1/02TteUbDuSUeeo= X-Gm-Gg: AY/fxX6r2sJmGeycdRYmKGRfKL1q0KMpapuK0ME33HhDqrgA/Xwr3/zvxC3rYw99FYS lOXoSqos4nkPf8wrz1RdYCFVYzbVMOV9hfVLBTbjP1Xep3fqbHlrI1396szpPdEGYMaeDVDf8mD Md6IoIY9e+C5VE9640AZtlDiAhvGQoWAcVLf2ROfrXqBkqJvQ3BfirtB+hRIPt4YNj+4aDI6Lj6 0Eavl/iO6ZA9kPamb1tYgr2kmf1XRHGDVb+fze/Gn64u8dqAvk9MSGeNf26GKGvCqtZO3DwukJA eiLbkfQDZ0kReBUrCUuNE4nAUxDrjoSvAZtjmHPoPnOtPRHiNvwVtX8UoJSr4XHfvZ5h+X/yJtt ZGcgs+YO1zMKWGsRiOkcnOnfHA9pMitG7pxvml7t7h0cd/1xpF3FOtOqX7GIaMMAzMqi7EkBWFL rbjQ5qFy9XpHvqX897H4TvTAc= X-Received: by 2002:a05:6214:cc1:b0:88a:2444:36e9 with SMTP id 6a1803df08f44-89075edfd93mr23664656d6.67.1767669003708; Mon, 05 Jan 2026 19:10:03 -0800 (PST) X-Google-Smtp-Source: AGHT+IEUbEw4dDpAlA+E/+QDVLYJVJTnPodAKfEcOQtXRN1eWx9cl9lcmjGvedKs7jPeUnxVSlp1Pw== X-Received: by 2002:a05:6214:cc1:b0:88a:2444:36e9 with SMTP id 6a1803df08f44-89075edfd93mr23664366d6.67.1767669003155; Mon, 05 Jan 2026 19:10:03 -0800 (PST) Received: from umbar.lan (2001-14ba-a073-af00-264b-feff-fe8b-be8a.rev.dnainternet.fi. [2001:14ba:a073:af00:264b:feff:fe8b:be8a]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-59b65d0d22csm242869e87.37.2026.01.05.19.09.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Jan 2026 19:10:01 -0800 (PST) From: Dmitry Baryshkov Date: Tue, 06 Jan 2026 05:09:56 +0200 Subject: [PATCH v3 2/3] drm/atomic: add max_size check to drm_property_replace_blob_from_id() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260106-drm-fix-lut-checks-v3-2-f7f979eb73c8@oss.qualcomm.com> References: <20260106-drm-fix-lut-checks-v3-0-f7f979eb73c8@oss.qualcomm.com> In-Reply-To: <20260106-drm-fix-lut-checks-v3-0-f7f979eb73c8@oss.qualcomm.com> To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Harry Wentland , Leo Li , Rodrigo Siqueira , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, amd-gfx@lists.freedesktop.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=7371; i=dmitry.baryshkov@oss.qualcomm.com; h=from:subject:message-id; bh=UkO7gGzz204YJlbpHl9qFMBJirNFYawZoOhKgADqEnM=; b=owEBbQGS/pANAwAKAYs8ij4CKSjVAcsmYgBpXH0DDblUwoI2UVGbb37850iZL6ICDxF3WSFiv X6LDbNRXU6JATMEAAEKAB0WIQRMcISVXLJjVvC4lX+LPIo+Aiko1QUCaVx9AwAKCRCLPIo+Aiko 1dUSCACM5JnNkCjR7xv/Iuq1XrLGYxgx6TKOoOFudll5tDxgBqKKQbb4mlfGqVgBeUlvty1GBEJ KlkklAdBYvQwbJYewszXD4vGy66zGeW+Q+wLwyEcVd1LCJ/TGyS2JFikJpN05fyvGx6W276Lrzy iTzFiz5t5JsZ+Rj3N8J88N4qLN2MAle90PBMUYHKh++9hm64hfasrUn6u73XwnIjMyjkFg9dWIV 6YpwNU7C7ypvOkgpjEDQN8CcZU5IqbVAcPwPj24N+Z8/0+5QbxdVM9r608Oreb6VgpwOfVy/uUG 4NjwGCpUQGKAw6Q/w54N4SK2nT5JPprx60ZIVRbJ1cHSZoye X-Developer-Key: i=dmitry.baryshkov@oss.qualcomm.com; a=openpgp; fpr=8F88381DD5C873E4AE487DA5199BF1243632046A X-Proofpoint-ORIG-GUID: duFC3adBKpRCkJ5Hz2XWC2ERvwXdNxNN X-Proofpoint-GUID: duFC3adBKpRCkJ5Hz2XWC2ERvwXdNxNN X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMTA2MDAyNSBTYWx0ZWRfX5RZewTFRzSUD T7qeKV0twnRKAuflCk2kxIklWhDa6s9XoMxFVY9MiJ324HmkH/oqXGq8fMvLnk3Kukxv9NBdM7q 7fzwtqbvxD1Yq4aIEOD8STbWaStZ9PMDD4TdqBqlKjXDrljgsfMV+Xs0IRYp9/f4NrswM2oMt/5 UrJXgfghFFwp/0u7RJg6l9zz6fxlvkj1GjOPPXZqRuS0pzLKgg/b/Vpvv2S0JQGWEbN7N6PIw9B V6VrULpyMg5vF+nD5Pb5nwnzE2vM4QS3PzCUzlkHCoDdjBny6HOGrq+o44cAWV2ziaZbshru6Nn ewsOxD/dl/FkcM6Yd1SYhXZcT6GjZ9JIas2XnWHMnUBCsMI5fPhlsrMNHjZShtvW8wDNOfBg6Qx frMjknS/WjStgmT/JnwiuymUWiK2gcRbB2Dg7iHiWMb0EGxb8q2/GOQLoVQ1BePjFlgBgbrCslD ekCXf1q3n/1JP/56iPg== X-Authority-Analysis: v=2.4 cv=Jpz8bc4C c=1 sm=1 tr=0 ts=695c7d0c cx=c_pps a=oc9J++0uMp73DTRD5QyR2A==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=vUbySO9Y5rIA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=EUspDBNiAAAA:8 a=ySEUILROmfWDjamXepEA:9 a=QEXdDO2ut3YA:10 a=iYH6xdkBrDN1Jqds4HTS:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49 definitions=2026-01-05_02,2026-01-05_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 malwarescore=0 bulkscore=0 clxscore=1015 adultscore=0 phishscore=0 suspectscore=0 impostorscore=0 spamscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2512120000 definitions=main-2601060025 The function drm_property_replace_blob_from_id() allows checking whether the blob size is equal to a predefined value. In case of variable-size properties (like the gamma / degamma LUTs) we might want to check for the blob size against the maximum, allowing properties of the size lesser than the max supported by the hardware. Extend the function in order to support such checks. Signed-off-by: Dmitry Baryshkov Reviewed-by: Thomas Zimmermann --- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 18 +++++++++-----= ---- drivers/gpu/drm/drm_atomic_uapi.c | 14 ++++++-------- drivers/gpu/drm/drm_property.c | 11 +++++++++++ include/drm/drm_property.h | 1 + 4 files changed, 27 insertions(+), 17 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/driv= ers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c index 2e3ee78999d9..8c5912b59e19 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c @@ -1676,8 +1676,8 @@ dm_atomic_plane_set_property(struct drm_plane *plane, if (property =3D=3D adev->mode_info.plane_degamma_lut_property) { ret =3D drm_property_replace_blob_from_id(plane->dev, &dm_plane_state->degamma_lut, - val, -1, - sizeof(struct drm_color_lut), + val, + -1, -1, sizeof(struct drm_color_lut), &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; @@ -1695,15 +1695,15 @@ dm_atomic_plane_set_property(struct drm_plane *plan= e, ret =3D drm_property_replace_blob_from_id(plane->dev, &dm_plane_state->ctm, val, - sizeof(struct drm_color_ctm_3x4), -1, + -1, sizeof(struct drm_color_ctm_3x4), -1, &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; } else if (property =3D=3D adev->mode_info.plane_shaper_lut_property) { ret =3D drm_property_replace_blob_from_id(plane->dev, &dm_plane_state->shaper_lut, - val, -1, - sizeof(struct drm_color_lut), + val, + -1, -1, sizeof(struct drm_color_lut), &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; @@ -1715,16 +1715,16 @@ dm_atomic_plane_set_property(struct drm_plane *plan= e, } else if (property =3D=3D adev->mode_info.plane_lut3d_property) { ret =3D drm_property_replace_blob_from_id(plane->dev, &dm_plane_state->lut3d, - val, -1, - sizeof(struct drm_color_lut), + val, + -1, -1, sizeof(struct drm_color_lut), &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; } else if (property =3D=3D adev->mode_info.plane_blend_lut_property) { ret =3D drm_property_replace_blob_from_id(plane->dev, &dm_plane_state->blend_lut, - val, -1, - sizeof(struct drm_color_lut), + val, + -1, -1, sizeof(struct drm_color_lut), &replaced); dm_plane_state->base.color_mgmt_changed |=3D replaced; return ret; diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic= _uapi.c index 7320db4b8489..dff1fdefcbeb 100644 --- a/drivers/gpu/drm/drm_atomic_uapi.c +++ b/drivers/gpu/drm/drm_atomic_uapi.c @@ -416,7 +416,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc= *crtc, ret =3D drm_property_replace_blob_from_id(dev, &state->degamma_lut, val, - -1, sizeof(struct drm_color_lut), + -1, -1, sizeof(struct drm_color_lut), &replaced); state->color_mgmt_changed |=3D replaced; return ret; @@ -424,7 +424,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc= *crtc, ret =3D drm_property_replace_blob_from_id(dev, &state->ctm, val, - sizeof(struct drm_color_ctm), -1, + -1, sizeof(struct drm_color_ctm), -1, &replaced); state->color_mgmt_changed |=3D replaced; return ret; @@ -432,7 +432,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc= *crtc, ret =3D drm_property_replace_blob_from_id(dev, &state->gamma_lut, val, - -1, sizeof(struct drm_color_lut), + -1, -1, sizeof(struct drm_color_lut), &replaced); state->color_mgmt_changed |=3D replaced; return ret; @@ -587,8 +587,7 @@ static int drm_atomic_plane_set_property(struct drm_pla= ne *plane, ret =3D drm_property_replace_blob_from_id(dev, &state->fb_damage_clips, val, - -1, - sizeof(struct drm_mode_rect), + -1, -1, sizeof(struct drm_mode_rect), &replaced); return ret; } else if (property =3D=3D plane->scaling_filter_property) { @@ -717,8 +716,7 @@ static int drm_atomic_color_set_data_property(struct dr= m_colorop *colorop, return drm_property_replace_blob_from_id(colorop->dev, &state->data, val, - size, - elem_size, + -1, size, elem_size, &replaced); } =20 @@ -876,7 +874,7 @@ static int drm_atomic_connector_set_property(struct drm= _connector *connector, ret =3D drm_property_replace_blob_from_id(dev, &state->hdr_output_metadata, val, - sizeof(struct hdr_output_metadata), -1, + -1, sizeof(struct hdr_output_metadata), -1, &replaced); return ret; } else if (property =3D=3D config->aspect_ratio_property) { diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c index 596272149a35..955fa960843b 100644 --- a/drivers/gpu/drm/drm_property.c +++ b/drivers/gpu/drm/drm_property.c @@ -757,6 +757,7 @@ EXPORT_SYMBOL(drm_property_replace_blob); * @dev: DRM device * @blob: a pointer to the member blob to be replaced * @blob_id: the id of the new blob to replace with + * @max_size: the maximum size of the blob property for variable-size blobs * @expected_size: expected size of the blob property * @expected_elem_size: expected size of an element in the blob property * @replaced: if the blob was in fact replaced @@ -771,6 +772,7 @@ EXPORT_SYMBOL(drm_property_replace_blob); int drm_property_replace_blob_from_id(struct drm_device *dev, struct drm_property_blob **blob, uint64_t blob_id, + ssize_t max_size, ssize_t expected_size, ssize_t expected_elem_size, bool *replaced) @@ -785,6 +787,15 @@ int drm_property_replace_blob_from_id(struct drm_devic= e *dev, return -EINVAL; } =20 + if (max_size > 0 && + new_blob->length > max_size) { + drm_dbg_atomic(dev, + "[BLOB:%d] length %zu greater than max %zu\n", + new_blob->base.id, new_blob->length, max_size); + drm_property_blob_put(new_blob); + return -EINVAL; + } + if (expected_size > 0 && new_blob->length !=3D expected_size) { drm_dbg_atomic(dev, diff --git a/include/drm/drm_property.h b/include/drm/drm_property.h index 082f29156b3e..aa49b5a42bb5 100644 --- a/include/drm/drm_property.h +++ b/include/drm/drm_property.h @@ -284,6 +284,7 @@ int drm_property_replace_blob_from_id(struct drm_device= *dev, uint64_t blob_id, ssize_t expected_size, ssize_t expected_elem_size, + ssize_t max_size, bool *replaced); int drm_property_replace_global_blob(struct drm_device *dev, struct drm_property_blob **replace, --=20 2.47.3