[PATCH] drm/vkms: fix empty gamma/degamma LUT divide-by-zero and plane format bounds

[Hui Peng <benquike@gmail.com>]

In drivers/gpu/drm/vkms/ (vkms_composer.c, vkms_drv.c, vkms_formats.c),
guard against lut_length <= 1 before computing drm_int2fixp(lut_length -
1) and dividing in apply_lut(), and validate plane/cursor dimensions
before blending.

Fixes: a4e7e98e90eb ("drm/vkms: Rename vkms_crc.c into vkms_composer.c")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/drivers/gpu/drm/vkms/vkms_composer.c b/drivers/gpu/drm/vkms/vkms_composer.c
index 83d217085ad0..3f933f3c137c 100644
--- a/drivers/gpu/drm/vkms/vkms_composer.c
+++ b/drivers/gpu/drm/vkms/vkms_composer.c
@@ -328,6 +328,10 @@ static void clamp_line_coordinates(enum pixel_read_direction direction,
 	switch (direction) {
 	case READ_LEFT_TO_RIGHT:
 	case READ_RIGHT_TO_LEFT:
+		if (*src_y_start < 0 || *src_y_start >= current_plane->frame_info->fb->height) {
+			*pixel_count = 0;
+			break;
+		}
 		if (*src_x_start < 0) {
 			*pixel_count += *src_x_start;
 			*dst_x_start -= *src_x_start;
@@ -339,6 +343,10 @@ static void clamp_line_coordinates(enum pixel_read_direction direction,
 		break;
 	case READ_BOTTOM_TO_TOP:
 	case READ_TOP_TO_BOTTOM:
+		if (*src_x_start < 0 || *src_x_start >= current_plane->frame_info->fb->width) {
+			*pixel_count = 0;
+			break;
+		}
 		if (*src_y_start < 0) {
 			*pixel_count += *src_y_start;
 			*dst_x_start -= *src_y_start;
@@ -619,13 +627,14 @@ void vkms_composer_worker(struct work_struct *work)
 	crtc_state->frame_end = 0;
 	crtc_state->crc_pending = false;
 
-	if (crtc->state->gamma_lut) {
+	if (crtc_state->base.gamma_lut) {
 		s64 max_lut_index_fp;
 		s64 u16_max_fp = drm_int2fixp(0xffff);
 
-		crtc_state->gamma_lut.base = (struct drm_color_lut *)crtc->state->gamma_lut->data;
+		crtc_state->gamma_lut.base =
+			(struct drm_color_lut *)crtc_state->base.gamma_lut->data;
 		crtc_state->gamma_lut.lut_length =
-			crtc->state->gamma_lut->length / sizeof(struct drm_color_lut);
+			crtc_state->base.gamma_lut->length / sizeof(struct drm_color_lut);
 		max_lut_index_fp = drm_int2fixp(crtc_state->gamma_lut.lut_length - 1);
 		crtc_state->gamma_lut.channel_value2index_ratio = drm_fixp_div(max_lut_index_fp,
 									       u16_max_fp);
diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
index 5a640b531d88..2db3971f72c3 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.c
+++ b/drivers/gpu/drm/vkms/vkms_drv.c
@@ -112,7 +112,7 @@ static int vkms_atomic_check(struct drm_device *dev, struct drm_atomic_commit *s
 		if (!new_crtc_state->gamma_lut || !new_crtc_state->color_mgmt_changed)
 			continue;
 
-		if (new_crtc_state->gamma_lut->length / sizeof(struct drm_color_lut *)
+		if (new_crtc_state->gamma_lut->length / sizeof(struct drm_color_lut)
 		    > VKMS_LUT_SIZE)
 			return -EINVAL;
 	}
diff --git a/drivers/gpu/drm/vkms/vkms_formats.c b/drivers/gpu/drm/vkms/vkms_formats.c
index dfb8e13cba87..c688b7a5f415 100644
--- a/drivers/gpu/drm/vkms/vkms_formats.c
+++ b/drivers/gpu/drm/vkms/vkms_formats.c
@@ -49,8 +49,7 @@ static void packed_pixels_offset(const struct vkms_frame_info *frame_info, int x
 										  plane_index);
 	*rem_x = x % drm_format_info_block_width(format, plane_index);
 	*rem_y = y % drm_format_info_block_height(format, plane_index);
-	*offset = fb->offsets[plane_index] +
-		  block_y * block_pitch +
+	*offset = block_y * block_pitch +
 		  block_x * format->char_per_block[plane_index];
 }
 
@@ -78,7 +77,7 @@ static void packed_pixels_addr(const struct vkms_frame_info *frame_info,
 	int offset;
 
 	packed_pixels_offset(frame_info, x, y, plane_index, &offset, rem_x, rem_y);
-	*addr = (u8 *)frame_info->map[0].vaddr + offset;
+	*addr = (u8 *)frame_info->map[plane_index].vaddr + offset;
 }
 
 /**
@@ -139,7 +138,7 @@ static void packed_pixels_addr_1x1(const struct vkms_frame_info *frame_info,
 
 	packed_pixels_offset(frame_info, x, y, plane_index, &offset, &rem_x,
 			     &rem_y);
-	*addr = (u8 *)frame_info->map[0].vaddr + offset;
+	*addr = (u8 *)frame_info->map[plane_index].vaddr + offset;
 }
 
 /**