vkms_atomic_check() computed the gamma LUT entry count using
sizeof(struct drm_color_lut *), which uses pointer size and
can incorrectly reject or accept LUT sizes. Use
drm_color_lut_size() instead to validate against VKMS_LUT_SIZE.

Signed-off-by: Renjun Wang <renjunw0@foxmail.com>
---
 drivers/gpu/drm/vkms/vkms_drv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
index dd1402f43773..a09589949f48 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.c
+++ b/drivers/gpu/drm/vkms/vkms_drv.c
@@ -17,6 +17,7 @@
 #include <drm/drm_gem.h>
 #include <drm/drm_atomic.h>
 #include <drm/drm_atomic_helper.h>
+#include <drm/drm_color_mgmt.h>
 #include <drm/drm_drv.h>
 #include <drm/drm_fbdev_shmem.h>
 #include <drm/drm_file.h>
@@ -111,8 +112,7 @@ static int vkms_atomic_check(struct drm_device *dev, struct drm_atomic_state *st
 		if (!new_crtc_state->gamma_lut || !new_crtc_state->color_mgmt_changed)
 			continue;
 
-		if (new_crtc_state->gamma_lut->length / sizeof(struct drm_color_lut *)
-		    > VKMS_LUT_SIZE)
+		if (drm_color_lut_size(new_crtc_state->gamma_lut) > VKMS_LUT_SIZE)
 			return -EINVAL;
 	}
 
-- 
2.47.3

On 2/4/26 15:15, Renjun Wang wrote:
> vkms_atomic_check() computed the gamma LUT entry count using
> sizeof(struct drm_color_lut *), which uses pointer size and
> can incorrectly reject or accept LUT sizes. Use
> drm_color_lut_size() instead to validate against VKMS_LUT_SIZE.
> 
> Signed-off-by: Renjun Wang <renjunw0@foxmail.com>

Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>

Like for the YUV patch, were you able to reproduce it using a tool?

> ---
>   drivers/gpu/drm/vkms/vkms_drv.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
> index dd1402f43773..a09589949f48 100644
> --- a/drivers/gpu/drm/vkms/vkms_drv.c
> +++ b/drivers/gpu/drm/vkms/vkms_drv.c
> @@ -17,6 +17,7 @@
>   #include <drm/drm_gem.h>
>   #include <drm/drm_atomic.h>
>   #include <drm/drm_atomic_helper.h>
> +#include <drm/drm_color_mgmt.h>
>   #include <drm/drm_drv.h>
>   #include <drm/drm_fbdev_shmem.h>
>   #include <drm/drm_file.h>
> @@ -111,8 +112,7 @@ static int vkms_atomic_check(struct drm_device *dev, struct drm_atomic_state *st
>   		if (!new_crtc_state->gamma_lut || !new_crtc_state->color_mgmt_changed)
>   			continue;
>   
> -		if (new_crtc_state->gamma_lut->length / sizeof(struct drm_color_lut *)
> -		    > VKMS_LUT_SIZE)
> +		if (drm_color_lut_size(new_crtc_state->gamma_lut) > VKMS_LUT_SIZE)
>   			return -EINVAL;
>   	}
>