[PATCH v2 0/3] drm/atomic: restrict the size of of gamma / degamma LUTs

[PATCH v2 0/3] drm/atomic: restrict the size of of gamma / degamma LUTs

[Dmitry Baryshkov]

While picking up the Gamma correction patch for the msm driver I noticed
that kms_color@invalid-gamma-lut-sizes and
kms_color@invalid-degamma-lut-sizes tests fail. These tests attempt
submitting LUT tables greater than the size specified by the
corresponding property. The issue doesn't seem to be specific to msm
driver only. Add generic check that LUT size is not greater than the
size passed to drm_crtc_enable_color_mgmt().

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
Changes in v2:
- Fixed comments for drm_object_immutable_property_get_value(), changed
  it to use drm_WARN_ON (Thomas)
- Reordered arguments of drm_property_replace_blob_from_id(), moving
  max_size before expected_size (Thomas)
- Link to v1: https://lore.kernel.org/r/20251115-drm-fix-lut-checks-v1-0-3586f5855bc7@oss.qualcomm.com,
  resent at https://lore.kernel.org/all/20251210-drm-fix-lut-checks-v1-0-10ae38519f43@oss.qualcomm.com/

---
Dmitry Baryshkov (3):
      drm/mode_object: add drm_object_immutable_property_get_value()
      drm/atomic: add max_size check to drm_property_replace_blob_from_id()
      drm/atomic: verify that gamma/degamma LUTs are not too big

 .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c    | 18 ++++++------
 drivers/gpu/drm/drm_atomic_uapi.c                  | 32 ++++++++++++++++------
 drivers/gpu/drm/drm_mode_object.c                  | 25 +++++++++++++++++
 drivers/gpu/drm/drm_property.c                     | 11 ++++++++
 include/drm/drm_mode_object.h                      |  3 ++
 include/drm/drm_property.h                         |  1 +
 6 files changed, 73 insertions(+), 17 deletions(-)
---
base-commit: 130343ee6bca9895c47d314467db7dd3dcc8bc35
change-id: 20251114-drm-fix-lut-checks-4bb325e24110

Best regards,
-- 
With best wishes
Dmitry

[PATCH v2 1/3] drm/mode_object: add drm_object_immutable_property_get_value()

[Dmitry Baryshkov]

We have a helper to get property values for non-atomic drivers and
another one default property values for atomic drivers. In some cases we
need the ability to get value of immutable property, no matter what kind
of driver it is. Implement new property-related helper,
drm_object_immutable_property_get_value(), which lets the caller to get
the value of the immutable property.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
 drivers/gpu/drm/drm_mode_object.c | 25 +++++++++++++++++++++++++
 include/drm/drm_mode_object.h     |  3 +++
 2 files changed, 28 insertions(+)

diff --git a/drivers/gpu/drm/drm_mode_object.c b/drivers/gpu/drm/drm_mode_object.c
index b45d501b10c8..2d943a610b88 100644
--- a/drivers/gpu/drm/drm_mode_object.c
+++ b/drivers/gpu/drm/drm_mode_object.c
@@ -385,6 +385,31 @@ int drm_object_property_get_default_value(struct drm_mode_object *obj,
 }
 EXPORT_SYMBOL(drm_object_property_get_default_value);
 
+/**
+ * drm_object_immutable_property_get_value - retrieve the value of a property
+ * @obj: drm mode object to get property value from
+ * @property: property to retrieve
+ * @val: storage for the property value
+ *
+ * This function retrieves the software state of the given immutable property
+ * for the given mode object.
+ *
+ * This function can be called by both atomic and non-atomic drivers.
+ *
+ * Returns:
+ * Zero on success, error code on failure.
+ */
+int drm_object_immutable_property_get_value(struct drm_mode_object *obj,
+					    struct drm_property *property,
+					    uint64_t *val)
+{
+	if (drm_WARN_ON(property->dev, !(property->flags & DRM_MODE_PROP_IMMUTABLE)))
+		return -EINVAL;
+
+	return __drm_object_property_get_prop_value(obj, property, val);
+}
+EXPORT_SYMBOL(drm_object_immutable_property_get_value);
+
 /* helper for getconnector and getproperties ioctls */
 int drm_mode_object_get_properties(struct drm_mode_object *obj, bool atomic,
 				   bool plane_color_pipeline,
diff --git a/include/drm/drm_mode_object.h b/include/drm/drm_mode_object.h
index c68edbd126d0..44a0d6f8d01f 100644
--- a/include/drm/drm_mode_object.h
+++ b/include/drm/drm_mode_object.h
@@ -133,6 +133,9 @@ int drm_object_property_get_value(struct drm_mode_object *obj,
 int drm_object_property_get_default_value(struct drm_mode_object *obj,
 					  struct drm_property *property,
 					  uint64_t *val);
+int drm_object_immutable_property_get_value(struct drm_mode_object *obj,
+					    struct drm_property *property,
+					    uint64_t *val);
 
 void drm_object_attach_property(struct drm_mode_object *obj,
 				struct drm_property *property,

-- 
2.47.3

[PATCH v2 2/3] drm/atomic: add max_size check to drm_property_replace_blob_from_id()

[Dmitry Baryshkov]

The function drm_property_replace_blob_from_id() allows checking whether
the blob size is equal to a predefined value. In case of variable-size
properties (like the gamma / degamma LUTs) we might want to check for
the blob size against the maximum, allowing properties of the size
lesser than the max supported by the hardware. Extend the function in
order to support such checks.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c    | 18 +++++++++---------
 drivers/gpu/drm/drm_atomic_uapi.c                      | 14 ++++++--------
 drivers/gpu/drm/drm_property.c                         | 11 +++++++++++
 include/drm/drm_property.h                             |  1 +
 4 files changed, 27 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
index 2e3ee78999d9..8c5912b59e19 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
@@ -1676,8 +1676,8 @@ dm_atomic_plane_set_property(struct drm_plane *plane,
 	if (property == adev->mode_info.plane_degamma_lut_property) {
 		ret = drm_property_replace_blob_from_id(plane->dev,
 							&dm_plane_state->degamma_lut,
-							val, -1,
-							sizeof(struct drm_color_lut),
+							val,
+							-1, -1, sizeof(struct drm_color_lut),
 							&replaced);
 		dm_plane_state->base.color_mgmt_changed |= replaced;
 		return ret;
@@ -1695,15 +1695,15 @@ dm_atomic_plane_set_property(struct drm_plane *plane,
 		ret = drm_property_replace_blob_from_id(plane->dev,
 							&dm_plane_state->ctm,
 							val,
-							sizeof(struct drm_color_ctm_3x4), -1,
+							-1, sizeof(struct drm_color_ctm_3x4), -1,
 							&replaced);
 		dm_plane_state->base.color_mgmt_changed |= replaced;
 		return ret;
 	} else if (property == adev->mode_info.plane_shaper_lut_property) {
 		ret = drm_property_replace_blob_from_id(plane->dev,
 							&dm_plane_state->shaper_lut,
-							val, -1,
-							sizeof(struct drm_color_lut),
+							val,
+							-1, -1, sizeof(struct drm_color_lut),
 							&replaced);
 		dm_plane_state->base.color_mgmt_changed |= replaced;
 		return ret;
@@ -1715,16 +1715,16 @@ dm_atomic_plane_set_property(struct drm_plane *plane,
 	} else if (property == adev->mode_info.plane_lut3d_property) {
 		ret = drm_property_replace_blob_from_id(plane->dev,
 							&dm_plane_state->lut3d,
-							val, -1,
-							sizeof(struct drm_color_lut),
+							val,
+							-1, -1, sizeof(struct drm_color_lut),
 							&replaced);
 		dm_plane_state->base.color_mgmt_changed |= replaced;
 		return ret;
 	} else if (property == adev->mode_info.plane_blend_lut_property) {
 		ret = drm_property_replace_blob_from_id(plane->dev,
 							&dm_plane_state->blend_lut,
-							val, -1,
-							sizeof(struct drm_color_lut),
+							val,
+							-1, -1, sizeof(struct drm_color_lut),
 							&replaced);
 		dm_plane_state->base.color_mgmt_changed |= replaced;
 		return ret;
diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
index 7320db4b8489..dff1fdefcbeb 100644
--- a/drivers/gpu/drm/drm_atomic_uapi.c
+++ b/drivers/gpu/drm/drm_atomic_uapi.c
@@ -416,7 +416,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
 		ret = drm_property_replace_blob_from_id(dev,
 					&state->degamma_lut,
 					val,
-					-1, sizeof(struct drm_color_lut),
+					-1, -1, sizeof(struct drm_color_lut),
 					&replaced);
 		state->color_mgmt_changed |= replaced;
 		return ret;
@@ -424,7 +424,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
 		ret = drm_property_replace_blob_from_id(dev,
 					&state->ctm,
 					val,
-					sizeof(struct drm_color_ctm), -1,
+					-1, sizeof(struct drm_color_ctm), -1,
 					&replaced);
 		state->color_mgmt_changed |= replaced;
 		return ret;
@@ -432,7 +432,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
 		ret = drm_property_replace_blob_from_id(dev,
 					&state->gamma_lut,
 					val,
-					-1, sizeof(struct drm_color_lut),
+					-1, -1, sizeof(struct drm_color_lut),
 					&replaced);
 		state->color_mgmt_changed |= replaced;
 		return ret;
@@ -587,8 +587,7 @@ static int drm_atomic_plane_set_property(struct drm_plane *plane,
 		ret = drm_property_replace_blob_from_id(dev,
 					&state->fb_damage_clips,
 					val,
-					-1,
-					sizeof(struct drm_mode_rect),
+					-1, -1, sizeof(struct drm_mode_rect),
 					&replaced);
 		return ret;
 	} else if (property == plane->scaling_filter_property) {
@@ -717,8 +716,7 @@ static int drm_atomic_color_set_data_property(struct drm_colorop *colorop,
 	return drm_property_replace_blob_from_id(colorop->dev,
 						 &state->data,
 						 val,
-						 size,
-						 elem_size,
+						 -1, size, elem_size,
 						 &replaced);
 }
 
@@ -876,7 +874,7 @@ static int drm_atomic_connector_set_property(struct drm_connector *connector,
 		ret = drm_property_replace_blob_from_id(dev,
 				&state->hdr_output_metadata,
 				val,
-				sizeof(struct hdr_output_metadata), -1,
+				-1, sizeof(struct hdr_output_metadata), -1,
 				&replaced);
 		return ret;
 	} else if (property == config->aspect_ratio_property) {
diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
index 596272149a35..955fa960843b 100644
--- a/drivers/gpu/drm/drm_property.c
+++ b/drivers/gpu/drm/drm_property.c
@@ -757,6 +757,7 @@ EXPORT_SYMBOL(drm_property_replace_blob);
  * @dev: DRM device
  * @blob: a pointer to the member blob to be replaced
  * @blob_id: the id of the new blob to replace with
+ * @max_size: the maximum size of the blob property for variable-size blobs
  * @expected_size: expected size of the blob property
  * @expected_elem_size: expected size of an element in the blob property
  * @replaced: if the blob was in fact replaced
@@ -771,6 +772,7 @@ EXPORT_SYMBOL(drm_property_replace_blob);
 int drm_property_replace_blob_from_id(struct drm_device *dev,
 					 struct drm_property_blob **blob,
 					 uint64_t blob_id,
+					 ssize_t max_size,
 					 ssize_t expected_size,
 					 ssize_t expected_elem_size,
 					 bool *replaced)
@@ -785,6 +787,15 @@ int drm_property_replace_blob_from_id(struct drm_device *dev,
 			return -EINVAL;
 		}
 
+		if (max_size > 0 &&
+		    new_blob->length > max_size) {
+			drm_dbg_atomic(dev,
+				       "[BLOB:%d] length %zu greater than max %zu\n",
+				       new_blob->base.id, new_blob->length, max_size);
+			drm_property_blob_put(new_blob);
+			return -EINVAL;
+		}
+
 		if (expected_size > 0 &&
 		    new_blob->length != expected_size) {
 			drm_dbg_atomic(dev,
diff --git a/include/drm/drm_property.h b/include/drm/drm_property.h
index 082f29156b3e..aa49b5a42bb5 100644
--- a/include/drm/drm_property.h
+++ b/include/drm/drm_property.h
@@ -284,6 +284,7 @@ int drm_property_replace_blob_from_id(struct drm_device *dev,
 				      uint64_t blob_id,
 				      ssize_t expected_size,
 				      ssize_t expected_elem_size,
+				      ssize_t max_size,
 				      bool *replaced);
 int drm_property_replace_global_blob(struct drm_device *dev,
 				     struct drm_property_blob **replace,

-- 
2.47.3

[PATCH v2 3/3] drm/atomic: verify that gamma/degamma LUTs are not too big

[Dmitry Baryshkov]

The kernel specifies LUT table sizes in a separate property, however it
doesn't enforce it as a maximum. Some drivers implement max suze check
on their own in the atomic_check path. Other drivers simply ignore the
issue. Perform LUT size validation in the generic place.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
 drivers/gpu/drm/drm_atomic_uapi.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
index dff1fdefcbeb..8489823a9773 100644
--- a/drivers/gpu/drm/drm_atomic_uapi.c
+++ b/drivers/gpu/drm/drm_atomic_uapi.c
@@ -413,10 +413,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
 	} else if (property == config->prop_vrr_enabled) {
 		state->vrr_enabled = val;
 	} else if (property == config->degamma_lut_property) {
+		const elem_size = sizeof(struct drm_color_lut);
+		u64 lut_size;
+
+		ret = drm_object_immutable_property_get_value(&crtc->base,
+							      config->degamma_lut_size_property,
+							      &lut_size);
+		if (ret)
+			return ret;
+
 		ret = drm_property_replace_blob_from_id(dev,
 					&state->degamma_lut,
 					val,
-					-1, -1, sizeof(struct drm_color_lut),
+					elem_size * lut_size, -1, elem_size,
 					&replaced);
 		state->color_mgmt_changed |= replaced;
 		return ret;
@@ -429,10 +438,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
 		state->color_mgmt_changed |= replaced;
 		return ret;
 	} else if (property == config->gamma_lut_property) {
+		const elem_size = sizeof(struct drm_color_lut);
+		u64 lut_size;
+
+		ret = drm_object_immutable_property_get_value(&crtc->base,
+							      config->gamma_lut_size_property,
+							      &lut_size);
+		if (ret)
+			return ret;
+
 		ret = drm_property_replace_blob_from_id(dev,
 					&state->gamma_lut,
 					val,
-					-1, -1, sizeof(struct drm_color_lut),
+					elem_size * lut_size, -1, elem_size,
 					&replaced);
 		state->color_mgmt_changed |= replaced;
 		return ret;

-- 
2.47.3

Re: [PATCH v2 3/3] drm/atomic: verify that gamma/degamma LUTs are not too big

[kernel test robot]

Hi Dmitry,

kernel test robot noticed the following build errors:

[auto build test ERROR on 130343ee6bca9895c47d314467db7dd3dcc8bc35]

url:    https://github.com/intel-lab-lkp/linux/commits/Dmitry-Baryshkov/drm-mode_object-add-drm_object_immutable_property_get_value/20251228-112526
base:   130343ee6bca9895c47d314467db7dd3dcc8bc35
patch link:    https://lore.kernel.org/r/20251228-drm-fix-lut-checks-v2-3-50f5d1a260a7%40oss.qualcomm.com
patch subject: [PATCH v2 3/3] drm/atomic: verify that gamma/degamma LUTs are not too big
config: x86_64-randconfig-076-20251228 (https://download.01.org/0day-ci/archive/20251228/202512282045.vcM3bTwk-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251228/202512282045.vcM3bTwk-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512282045.vcM3bTwk-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/gpu/drm/drm_atomic_uapi.c:416:9: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int]
     416 |                 const elem_size = sizeof(struct drm_color_lut);
         |                 ~~~~~ ^
         |                 int
   drivers/gpu/drm/drm_atomic_uapi.c:441:9: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int]
     441 |                 const elem_size = sizeof(struct drm_color_lut);
         |                 ~~~~~ ^
         |                 int
   2 errors generated.


vim +/int +416 drivers/gpu/drm/drm_atomic_uapi.c

   395	
   396	static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
   397			struct drm_crtc_state *state, struct drm_property *property,
   398			uint64_t val)
   399	{
   400		struct drm_device *dev = crtc->dev;
   401		struct drm_mode_config *config = &dev->mode_config;
   402		bool replaced = false;
   403		int ret;
   404	
   405		if (property == config->prop_active)
   406			state->active = val;
   407		else if (property == config->prop_mode_id) {
   408			struct drm_property_blob *mode =
   409				drm_property_lookup_blob(dev, val);
   410			ret = drm_atomic_set_mode_prop_for_crtc(state, mode);
   411			drm_property_blob_put(mode);
   412			return ret;
   413		} else if (property == config->prop_vrr_enabled) {
   414			state->vrr_enabled = val;
   415		} else if (property == config->degamma_lut_property) {
 > 416			const elem_size = sizeof(struct drm_color_lut);
   417			u64 lut_size;
   418	
   419			ret = drm_object_immutable_property_get_value(&crtc->base,
   420								      config->degamma_lut_size_property,
   421								      &lut_size);
   422			if (ret)
   423				return ret;
   424	
   425			ret = drm_property_replace_blob_from_id(dev,
   426						&state->degamma_lut,
   427						val,
   428						elem_size * lut_size, -1, elem_size,
   429						&replaced);
   430			state->color_mgmt_changed |= replaced;
   431			return ret;
   432		} else if (property == config->ctm_property) {
   433			ret = drm_property_replace_blob_from_id(dev,
   434						&state->ctm,
   435						val,
   436						-1, sizeof(struct drm_color_ctm), -1,
   437						&replaced);
   438			state->color_mgmt_changed |= replaced;
   439			return ret;
   440		} else if (property == config->gamma_lut_property) {
   441			const elem_size = sizeof(struct drm_color_lut);
   442			u64 lut_size;
   443	
   444			ret = drm_object_immutable_property_get_value(&crtc->base,
   445								      config->gamma_lut_size_property,
   446								      &lut_size);
   447			if (ret)
   448				return ret;
   449	
   450			ret = drm_property_replace_blob_from_id(dev,
   451						&state->gamma_lut,
   452						val,
   453						elem_size * lut_size, -1, elem_size,
   454						&replaced);
   455			state->color_mgmt_changed |= replaced;
   456			return ret;
   457		} else if (property == config->prop_out_fence_ptr) {
   458			s32 __user *fence_ptr = u64_to_user_ptr(val);
   459	
   460			if (!fence_ptr)
   461				return 0;
   462	
   463			if (put_user(-1, fence_ptr))
   464				return -EFAULT;
   465	
   466			set_out_fence_for_crtc(state->state, crtc, fence_ptr);
   467		} else if (property == crtc->scaling_filter_property) {
   468			state->scaling_filter = val;
   469		} else if (property == crtc->sharpness_strength_property) {
   470			state->sharpness_strength = val;
   471		} else if (crtc->funcs->atomic_set_property) {
   472			return crtc->funcs->atomic_set_property(crtc, state, property, val);
   473		} else {
   474			drm_dbg_atomic(crtc->dev,
   475				       "[CRTC:%d:%s] unknown property [PROP:%d:%s]\n",
   476				       crtc->base.id, crtc->name,
   477				       property->base.id, property->name);
   478			return -EINVAL;
   479		}
   480	
   481		return 0;
   482	}
   483	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v2 3/3] drm/atomic: verify that gamma/degamma LUTs are not too big

[kernel test robot]

Hi Dmitry,

kernel test robot noticed the following build errors:

[auto build test ERROR on 130343ee6bca9895c47d314467db7dd3dcc8bc35]

url:    https://github.com/intel-lab-lkp/linux/commits/Dmitry-Baryshkov/drm-mode_object-add-drm_object_immutable_property_get_value/20251228-112526
base:   130343ee6bca9895c47d314467db7dd3dcc8bc35
patch link:    https://lore.kernel.org/r/20251228-drm-fix-lut-checks-v2-3-50f5d1a260a7%40oss.qualcomm.com
patch subject: [PATCH v2 3/3] drm/atomic: verify that gamma/degamma LUTs are not too big
config: x86_64-randconfig-071-20251228 (https://download.01.org/0day-ci/archive/20251228/202512282230.ryhYGLxv-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251228/202512282230.ryhYGLxv-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512282230.ryhYGLxv-lkp@intel.com/

All errors (new ones prefixed by >>):

   drivers/gpu/drm/drm_atomic_uapi.c: In function 'drm_atomic_crtc_set_property':
>> drivers/gpu/drm/drm_atomic_uapi.c:416:23: error: type defaults to 'int' in declaration of 'elem_size' [-Wimplicit-int]
     416 |                 const elem_size = sizeof(struct drm_color_lut);
         |                       ^~~~~~~~~
   drivers/gpu/drm/drm_atomic_uapi.c:441:23: error: type defaults to 'int' in declaration of 'elem_size' [-Wimplicit-int]
     441 |                 const elem_size = sizeof(struct drm_color_lut);
         |                       ^~~~~~~~~


vim +416 drivers/gpu/drm/drm_atomic_uapi.c

   395	
   396	static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
   397			struct drm_crtc_state *state, struct drm_property *property,
   398			uint64_t val)
   399	{
   400		struct drm_device *dev = crtc->dev;
   401		struct drm_mode_config *config = &dev->mode_config;
   402		bool replaced = false;
   403		int ret;
   404	
   405		if (property == config->prop_active)
   406			state->active = val;
   407		else if (property == config->prop_mode_id) {
   408			struct drm_property_blob *mode =
   409				drm_property_lookup_blob(dev, val);
   410			ret = drm_atomic_set_mode_prop_for_crtc(state, mode);
   411			drm_property_blob_put(mode);
   412			return ret;
   413		} else if (property == config->prop_vrr_enabled) {
   414			state->vrr_enabled = val;
   415		} else if (property == config->degamma_lut_property) {
 > 416			const elem_size = sizeof(struct drm_color_lut);
   417			u64 lut_size;
   418	
   419			ret = drm_object_immutable_property_get_value(&crtc->base,
   420								      config->degamma_lut_size_property,
   421								      &lut_size);
   422			if (ret)
   423				return ret;
   424	
   425			ret = drm_property_replace_blob_from_id(dev,
   426						&state->degamma_lut,
   427						val,
   428						elem_size * lut_size, -1, elem_size,
   429						&replaced);
   430			state->color_mgmt_changed |= replaced;
   431			return ret;
   432		} else if (property == config->ctm_property) {
   433			ret = drm_property_replace_blob_from_id(dev,
   434						&state->ctm,
   435						val,
   436						-1, sizeof(struct drm_color_ctm), -1,
   437						&replaced);
   438			state->color_mgmt_changed |= replaced;
   439			return ret;
   440		} else if (property == config->gamma_lut_property) {
   441			const elem_size = sizeof(struct drm_color_lut);
   442			u64 lut_size;
   443	
   444			ret = drm_object_immutable_property_get_value(&crtc->base,
   445								      config->gamma_lut_size_property,
   446								      &lut_size);
   447			if (ret)
   448				return ret;
   449	
   450			ret = drm_property_replace_blob_from_id(dev,
   451						&state->gamma_lut,
   452						val,
   453						elem_size * lut_size, -1, elem_size,
   454						&replaced);
   455			state->color_mgmt_changed |= replaced;
   456			return ret;
   457		} else if (property == config->prop_out_fence_ptr) {
   458			s32 __user *fence_ptr = u64_to_user_ptr(val);
   459	
   460			if (!fence_ptr)
   461				return 0;
   462	
   463			if (put_user(-1, fence_ptr))
   464				return -EFAULT;
   465	
   466			set_out_fence_for_crtc(state->state, crtc, fence_ptr);
   467		} else if (property == crtc->scaling_filter_property) {
   468			state->scaling_filter = val;
   469		} else if (property == crtc->sharpness_strength_property) {
   470			state->sharpness_strength = val;
   471		} else if (crtc->funcs->atomic_set_property) {
   472			return crtc->funcs->atomic_set_property(crtc, state, property, val);
   473		} else {
   474			drm_dbg_atomic(crtc->dev,
   475				       "[CRTC:%d:%s] unknown property [PROP:%d:%s]\n",
   476				       crtc->base.id, crtc->name,
   477				       property->base.id, property->name);
   478			return -EINVAL;
   479		}
   480	
   481		return 0;
   482	}
   483	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v2 3/3] drm/atomic: verify that gamma/degamma LUTs are not too big

[kernel test robot]

Hi Dmitry,

kernel test robot noticed the following build errors:

[auto build test ERROR on 130343ee6bca9895c47d314467db7dd3dcc8bc35]

url:    https://github.com/intel-lab-lkp/linux/commits/Dmitry-Baryshkov/drm-mode_object-add-drm_object_immutable_property_get_value/20251228-112526
base:   130343ee6bca9895c47d314467db7dd3dcc8bc35
patch link:    https://lore.kernel.org/r/20251228-drm-fix-lut-checks-v2-3-50f5d1a260a7%40oss.qualcomm.com
patch subject: [PATCH v2 3/3] drm/atomic: verify that gamma/degamma LUTs are not too big
config: x86_64-rhel-9.4 (https://download.01.org/0day-ci/archive/20251229/202512290531.US56hi8Q-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251229/202512290531.US56hi8Q-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512290531.US56hi8Q-lkp@intel.com/

All errors (new ones prefixed by >>):

   drivers/gpu/drm/drm_atomic_uapi.c: In function 'drm_atomic_crtc_set_property':
>> drivers/gpu/drm/drm_atomic_uapi.c:416:23: error: type defaults to 'int' in declaration of 'elem_size' [-Wimplicit-int]
     416 |                 const elem_size = sizeof(struct drm_color_lut);
         |                       ^~~~~~~~~
   drivers/gpu/drm/drm_atomic_uapi.c:441:23: error: type defaults to 'int' in declaration of 'elem_size' [-Wimplicit-int]
     441 |                 const elem_size = sizeof(struct drm_color_lut);
         |                       ^~~~~~~~~


vim +416 drivers/gpu/drm/drm_atomic_uapi.c

   395	
   396	static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
   397			struct drm_crtc_state *state, struct drm_property *property,
   398			uint64_t val)
   399	{
   400		struct drm_device *dev = crtc->dev;
   401		struct drm_mode_config *config = &dev->mode_config;
   402		bool replaced = false;
   403		int ret;
   404	
   405		if (property == config->prop_active)
   406			state->active = val;
   407		else if (property == config->prop_mode_id) {
   408			struct drm_property_blob *mode =
   409				drm_property_lookup_blob(dev, val);
   410			ret = drm_atomic_set_mode_prop_for_crtc(state, mode);
   411			drm_property_blob_put(mode);
   412			return ret;
   413		} else if (property == config->prop_vrr_enabled) {
   414			state->vrr_enabled = val;
   415		} else if (property == config->degamma_lut_property) {
 > 416			const elem_size = sizeof(struct drm_color_lut);
   417			u64 lut_size;
   418	
   419			ret = drm_object_immutable_property_get_value(&crtc->base,
   420								      config->degamma_lut_size_property,
   421								      &lut_size);
   422			if (ret)
   423				return ret;
   424	
   425			ret = drm_property_replace_blob_from_id(dev,
   426						&state->degamma_lut,
   427						val,
   428						elem_size * lut_size, -1, elem_size,
   429						&replaced);
   430			state->color_mgmt_changed |= replaced;
   431			return ret;
   432		} else if (property == config->ctm_property) {
   433			ret = drm_property_replace_blob_from_id(dev,
   434						&state->ctm,
   435						val,
   436						-1, sizeof(struct drm_color_ctm), -1,
   437						&replaced);
   438			state->color_mgmt_changed |= replaced;
   439			return ret;
   440		} else if (property == config->gamma_lut_property) {
   441			const elem_size = sizeof(struct drm_color_lut);
   442			u64 lut_size;
   443	
   444			ret = drm_object_immutable_property_get_value(&crtc->base,
   445								      config->gamma_lut_size_property,
   446								      &lut_size);
   447			if (ret)
   448				return ret;
   449	
   450			ret = drm_property_replace_blob_from_id(dev,
   451						&state->gamma_lut,
   452						val,
   453						elem_size * lut_size, -1, elem_size,
   454						&replaced);
   455			state->color_mgmt_changed |= replaced;
   456			return ret;
   457		} else if (property == config->prop_out_fence_ptr) {
   458			s32 __user *fence_ptr = u64_to_user_ptr(val);
   459	
   460			if (!fence_ptr)
   461				return 0;
   462	
   463			if (put_user(-1, fence_ptr))
   464				return -EFAULT;
   465	
   466			set_out_fence_for_crtc(state->state, crtc, fence_ptr);
   467		} else if (property == crtc->scaling_filter_property) {
   468			state->scaling_filter = val;
   469		} else if (property == crtc->sharpness_strength_property) {
   470			state->sharpness_strength = val;
   471		} else if (crtc->funcs->atomic_set_property) {
   472			return crtc->funcs->atomic_set_property(crtc, state, property, val);
   473		} else {
   474			drm_dbg_atomic(crtc->dev,
   475				       "[CRTC:%d:%s] unknown property [PROP:%d:%s]\n",
   476				       crtc->base.id, crtc->name,
   477				       property->base.id, property->name);
   478			return -EINVAL;
   479		}
   480	
   481		return 0;
   482	}
   483	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki