Skip to content

Commit ca59e33

Browse files
lumaglumag
committed
drm/atomic: add max_size check to drm_property_replace_blob_from_id()
The function drm_property_replace_blob_from_id() allows checking whether the blob size is equal to a predefined value. In case of variable-size properties (like the gamma / degamma LUTs) we might want to check for the blob size against the maximum, allowing properties of the size lesser than the max supported by the hardware. Extend the function in order to support such checks. Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260106-drm-fix-lut-checks-v3-2-f7f979eb73c8@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
1 parent 66c9c0c commit ca59e33

4 files changed

Lines changed: 27 additions & 17 deletions

File tree

‎drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1676,8 +1676,8 @@ dm_atomic_plane_set_property(struct drm_plane *plane,
16761676
if (property == adev->mode_info.plane_degamma_lut_property) {
16771677
ret = drm_property_replace_blob_from_id(plane->dev,
16781678
&dm_plane_state->degamma_lut,
1679-
val, -1,
1680-
sizeof(struct drm_color_lut),
1679+
val,
1680+
-1, -1, sizeof(struct drm_color_lut),
16811681
&replaced);
16821682
dm_plane_state->base.color_mgmt_changed |= replaced;
16831683
return ret;
@@ -1695,15 +1695,15 @@ dm_atomic_plane_set_property(struct drm_plane *plane,
16951695
ret = drm_property_replace_blob_from_id(plane->dev,
16961696
&dm_plane_state->ctm,
16971697
val,
1698-
sizeof(struct drm_color_ctm_3x4), -1,
1698+
-1, sizeof(struct drm_color_ctm_3x4), -1,
16991699
&replaced);
17001700
dm_plane_state->base.color_mgmt_changed |= replaced;
17011701
return ret;
17021702
} else if (property == adev->mode_info.plane_shaper_lut_property) {
17031703
ret = drm_property_replace_blob_from_id(plane->dev,
17041704
&dm_plane_state->shaper_lut,
1705-
val, -1,
1706-
sizeof(struct drm_color_lut),
1705+
val,
1706+
-1, -1, sizeof(struct drm_color_lut),
17071707
&replaced);
17081708
dm_plane_state->base.color_mgmt_changed |= replaced;
17091709
return ret;
@@ -1715,16 +1715,16 @@ dm_atomic_plane_set_property(struct drm_plane *plane,
17151715
} else if (property == adev->mode_info.plane_lut3d_property) {
17161716
ret = drm_property_replace_blob_from_id(plane->dev,
17171717
&dm_plane_state->lut3d,
1718-
val, -1,
1719-
sizeof(struct drm_color_lut),
1718+
val,
1719+
-1, -1, sizeof(struct drm_color_lut),
17201720
&replaced);
17211721
dm_plane_state->base.color_mgmt_changed |= replaced;
17221722
return ret;
17231723
} else if (property == adev->mode_info.plane_blend_lut_property) {
17241724
ret = drm_property_replace_blob_from_id(plane->dev,
17251725
&dm_plane_state->blend_lut,
1726-
val, -1,
1727-
sizeof(struct drm_color_lut),
1726+
val,
1727+
-1, -1, sizeof(struct drm_color_lut),
17281728
&replaced);
17291729
dm_plane_state->base.color_mgmt_changed |= replaced;
17301730
return ret;

‎drivers/gpu/drm/drm_atomic_uapi.c‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -416,23 +416,23 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
416416
ret = drm_property_replace_blob_from_id(dev,
417417
&state->degamma_lut,
418418
val,
419-
-1, sizeof(struct drm_color_lut),
419+
-1, -1, sizeof(struct drm_color_lut),
420420
&replaced);
421421
state->color_mgmt_changed |= replaced;
422422
return ret;
423423
} else if (property == config->ctm_property) {
424424
ret = drm_property_replace_blob_from_id(dev,
425425
&state->ctm,
426426
val,
427-
sizeof(struct drm_color_ctm), -1,
427+
-1, sizeof(struct drm_color_ctm), -1,
428428
&replaced);
429429
state->color_mgmt_changed |= replaced;
430430
return ret;
431431
} else if (property == config->gamma_lut_property) {
432432
ret = drm_property_replace_blob_from_id(dev,
433433
&state->gamma_lut,
434434
val,
435-
-1, sizeof(struct drm_color_lut),
435+
-1, -1, sizeof(struct drm_color_lut),
436436
&replaced);
437437
state->color_mgmt_changed |= replaced;
438438
return ret;
@@ -587,8 +587,7 @@ static int drm_atomic_plane_set_property(struct drm_plane *plane,
587587
ret = drm_property_replace_blob_from_id(dev,
588588
&state->fb_damage_clips,
589589
val,
590-
-1,
591-
sizeof(struct drm_mode_rect),
590+
-1, -1, sizeof(struct drm_mode_rect),
592591
&replaced);
593592
return ret;
594593
} else if (property == plane->scaling_filter_property) {
@@ -717,8 +716,7 @@ static int drm_atomic_color_set_data_property(struct drm_colorop *colorop,
717716
return drm_property_replace_blob_from_id(colorop->dev,
718717
&state->data,
719718
val,
720-
size,
721-
elem_size,
719+
-1, size, elem_size,
722720
&replaced);
723721
}
724722

@@ -876,7 +874,7 @@ static int drm_atomic_connector_set_property(struct drm_connector *connector,
876874
ret = drm_property_replace_blob_from_id(dev,
877875
&state->hdr_output_metadata,
878876
val,
879-
sizeof(struct hdr_output_metadata), -1,
877+
-1, sizeof(struct hdr_output_metadata), -1,
880878
&replaced);
881879
return ret;
882880
} else if (property == config->aspect_ratio_property) {

‎drivers/gpu/drm/drm_property.c‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -757,6 +757,7 @@ EXPORT_SYMBOL(drm_property_replace_blob);
757757
* @dev: DRM device
758758
* @blob: a pointer to the member blob to be replaced
759759
* @blob_id: the id of the new blob to replace with
760+
* @max_size: the maximum size of the blob property for variable-size blobs
760761
* @expected_size: expected size of the blob property
761762
* @expected_elem_size: expected size of an element in the blob property
762763
* @replaced: if the blob was in fact replaced
@@ -771,6 +772,7 @@ EXPORT_SYMBOL(drm_property_replace_blob);
771772
int drm_property_replace_blob_from_id(struct drm_device *dev,
772773
struct drm_property_blob **blob,
773774
uint64_t blob_id,
775+
ssize_t max_size,
774776
ssize_t expected_size,
775777
ssize_t expected_elem_size,
776778
bool *replaced)
@@ -785,6 +787,15 @@ int drm_property_replace_blob_from_id(struct drm_device *dev,
785787
return -EINVAL;
786788
}
787789

790+
if (max_size > 0 &&
791+
new_blob->length > max_size) {
792+
drm_dbg_atomic(dev,
793+
"[BLOB:%d] length %zu greater than max %zu\n",
794+
new_blob->base.id, new_blob->length, max_size);
795+
drm_property_blob_put(new_blob);
796+
return -EINVAL;
797+
}
798+
788799
if (expected_size > 0 &&
789800
new_blob->length != expected_size) {
790801
drm_dbg_atomic(dev,

‎include/drm/drm_property.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -284,6 +284,7 @@ int drm_property_replace_blob_from_id(struct drm_device *dev,
284284
uint64_t blob_id,
285285
ssize_t expected_size,
286286
ssize_t expected_elem_size,
287+
ssize_t max_size,
287288
bool *replaced);
288289
int drm_property_replace_global_blob(struct drm_device *dev,
289290
struct drm_property_blob **replace,

0 commit comments

Comments
 (0)