drm/atomic: verify that gamma/degamma LUTs are not too big

The kernel specifies LUT table sizes in a separate property, however it
doesn't enforce it as a maximum. Some drivers implement max size check
on their own in the atomic_check path. Other drivers simply ignore the
issue. Perform LUT size validation in the generic place.

Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260106-drm-fix-lut-checks-v3-3-f7f979eb73c8@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>

diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
index dff1fdefcbeb87ea127e517401556f51e36cb38f..dc013a22bf265512a4fa1edf0ae90931ff0d35e6 100644 (file)
--- a/drivers/gpu/drm/drm_atomic_uapi.c
+++ b/drivers/gpu/drm/drm_atomic_uapi.c
@@ -413,10 +413,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
        } else if (property == config->prop_vrr_enabled) {
                state->vrr_enabled = val;
        } else if (property == config->degamma_lut_property) {
+               const size_t elem_size = sizeof(struct drm_color_lut);
+               u64 lut_size;
+
+               ret = drm_object_immutable_property_get_value(&crtc->base,
+                                                             config->degamma_lut_size_property,
+                                                             &lut_size);
+               if (ret)
+                       return ret;
+
                ret = drm_property_replace_blob_from_id(dev,
                                        &state->degamma_lut,
                                        val,
-                                       -1, -1, sizeof(struct drm_color_lut),
+                                       elem_size * lut_size, -1, elem_size,
                                        &replaced);
                state->color_mgmt_changed |= replaced;
                return ret;
@@ -429,10 +438,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
                state->color_mgmt_changed |= replaced;
                return ret;
        } else if (property == config->gamma_lut_property) {
+               const size_t elem_size = sizeof(struct drm_color_lut);
+               u64 lut_size;
+
+               ret = drm_object_immutable_property_get_value(&crtc->base,
+                                                             config->gamma_lut_size_property,
+                                                             &lut_size);
+               if (ret)
+                       return ret;
+
                ret = drm_property_replace_blob_from_id(dev,
                                        &state->gamma_lut,
                                        val,
-                                       -1, -1, sizeof(struct drm_color_lut),
+                                       elem_size * lut_size, -1, elem_size,
                                        &replaced);
                state->color_mgmt_changed |= replaced;
                return ret;