Skip to contentSkip to conversation

drm/mediatek: Validate gamma_lut size

PATCH In review Fei Shao 3 participants 3 messages Nov 6 – Nov 11

Subsystems (3)
DRM drivers Arm MediaTek DRM drivers for MediaTek
lore
Share & tools
lore

Fei Shao

author
#0 lore raw

PATCH v2 1/1 drm/mediatek: Validate gamma_lut size

The DRM core checks that a gamma_lut blob is aligned to sizeof(struct drm_color_lut) and at most GAMMA_LUT_SIZE entries, so shorter blobs still reach the driver. mtk_aal_gamma_set() and mtk_gamma_set() read up to the fixed hardware LUT size, which is an OOB read when the blob is shorter.

Add mtk_crtc_atomic_check() and reject gamma_lut if its entry count does not match crtc->gamma_size.

Fixes 2f3f4dda747c ("drm/mediatek: Add gamma correction.")
Signed-off-by Fei Shao <[email protected]>

---

Changes in v2:
- Use drm_color_lut_size() and check against crtc->gamma_size, which mtk_crtc_create() already sets for the pipeline. This drops the ddp_comp[] loop and avoids the NULL conn_routes slot before enable.
- Move mtk_crtc_atomic_check() before mtk_crtc_atomic_begin() so the patch applies cleanly both to linux-next (next-20261104) and on top of the mediatek-drm restructuring series.
https://lore.kernel.org/r/[email protected]

 drivers/gpu/drm/mediatek/mtk_crtc.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)
drivers/gpu/drm/mediatek/mtk_crtc.c +12 -0
index 2920f3198ef6..67c2288ab8e0 100644
@@ -841,6 +841,17 @@ static void mtk_crtc_atomic_disable(struct drm_crtc *crtc,
 	mtk_crtc->enabled = false;
 }
 
+static int mtk_crtc_atomic_check(struct drm_crtc *crtc, struct drm_atomic_commit *state)
+{
+	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+	struct drm_property_blob *gamma_lut = crtc_state->gamma_lut;
+
+	if (gamma_lut && drm_color_lut_size(gamma_lut) != crtc->gamma_size)
+		return -EINVAL;
+
+	return 0;
+}
+
 static void mtk_crtc_atomic_begin(struct drm_crtc *crtc,
 				  struct drm_atomic_commit *state)
 {

@@ -895,6 +906,7 @@ static const struct drm_crtc_helper_funcs mtk_crtc_helper_funcs = {
 	.mode_fixup	= mtk_crtc_mode_fixup,
 	.mode_set_nofb	= mtk_crtc_mode_set_nofb,
 	.mode_valid	= mtk_crtc_mode_valid,
+	.atomic_check	= mtk_crtc_atomic_check,
 	.atomic_begin	= mtk_crtc_atomic_begin,
 	.atomic_flush	= mtk_crtc_atomic_flush,
 	.atomic_enable	= mtk_crtc_atomic_enable,
Signature · 1 line
2.56.0.455.g6c5a503b38-goog
maintainer Reviewed-by on v2 1/1
#1 lore raw
Quoted 11 lines · Fei Shao

The DRM core checks that a gamma_lut blob is aligned to sizeof(struct drm_color_lut) and at most GAMMA_LUT_SIZE entries, so shorter blobs still reach the driver. mtk_aal_gamma_set() and mtk_gamma_set() read up to the fixed hardware LUT size, which is an OOB read when the blob is shorter.

Add mtk_crtc_atomic_check() and reject gamma_lut if its entry count does not match crtc->gamma_size.

Fixes 2f3f4dda747c ("drm/mediatek: Add gamma correction.")
Signed-off-by Fei Shao <[email protected]>
Reviewed-by AngeloGioacchino Del Regno <[email protected]>
Reviewed-by on v2 1/1
#2 lore raw
In reply to Fei Shao
Quoted 8 lines · Fei Shao

The DRM core checks that a gamma_lut blob is aligned to sizeof(struct drm_color_lut) and at most GAMMA_LUT_SIZE entries, so shorter blobs still reach the driver. mtk_aal_gamma_set() and mtk_gamma_set() read up to the fixed hardware LUT size, which is an OOB read when the blob is shorter.

Add mtk_crtc_atomic_check() and reject gamma_lut if its entry count does not match crtc->gamma_size.

Reviewed-by CK Hu <[email protected]>
Quoted 4 lines
Fixes 2f3f4dda747c ("drm/mediatek: Add gamma correction.")
Signed-off-by Fei Shao <[email protected]>

---