Re: [PATCH] drm/mediatek: Validate gamma_lut size

[AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>]

On 11/5/26 10:10, Fei Shao wrote:
> The DRM core only checks that a GAMMA_LUT blob size is a multiple of
> sizeof(struct drm_color_lut), not that its entry count matches the
> hardware LUT size. mtk_gamma_set() and mtk_aal_gamma_set() then read
> the blob up to the hardware LUT size, which is an OOB read when the blob
> is shorter.
> 
> Add mtk_crtc_atomic_check() and reject gamma_lut with invalid length.
> 
> Fixes: 2f3f4dda747c ("drm/mediatek: Add gamma correction.")
> Signed-off-by: Fei Shao <fshao@chromium.org>
> ---
> 
>   drivers/gpu/drm/mediatek/mtk_crtc.c | 21 +++++++++++++++++++++
>   1 file changed, 21 insertions(+)
> 
> diff --git a/drivers/gpu/drm/mediatek/mtk_crtc.c b/drivers/gpu/drm/mediatek/mtk_crtc.c
> index 2920f3198ef6..fd9b51fd00ea 100644
> --- a/drivers/gpu/drm/mediatek/mtk_crtc.c
> +++ b/drivers/gpu/drm/mediatek/mtk_crtc.c
> @@ -880,6 +880,26 @@ static void mtk_crtc_atomic_flush(struct drm_crtc *crtc,
>   	mtk_crtc_update_config(mtk_crtc, !!mtk_crtc->event);
>   }
>   
> +static int mtk_crtc_atomic_check(struct drm_crtc *crtc, struct drm_atomic_commit *state)
> +{
> +	struct mtk_crtc *mtk_crtc = to_mtk_crtc(crtc);
> +	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
> +	struct drm_property_blob *gamma_lut = crtc_state->gamma_lut;
> +	unsigned int lut_size;
> +	int i;
> +
> +	if (!gamma_lut)
> +		return 0;
> +
> +	for (i = 0; i < mtk_crtc->ddp_comp_nr; i++) {

Yet another iterator in an array of components, slowing down this driver...

I know it's not merged yet, but please, do it on top of my restructuring for
mediatek-drm...

Cheers,
Angelo

> +		lut_size = mtk_ddp_gamma_get_lut_size(mtk_crtc->ddp_comp[i]);
> +		if (lut_size && gamma_lut->length != lut_size * sizeof(struct drm_color_lut))
> +			return -EINVAL;
> +	}
> +
> +	return 0;
> +}
> +
>   static const struct drm_crtc_funcs mtk_crtc_funcs = {
>   	.set_config		= drm_atomic_helper_set_config,
>   	.page_flip		= drm_atomic_helper_page_flip,
> @@ -899,6 +919,7 @@ static const struct drm_crtc_helper_funcs mtk_crtc_helper_funcs = {
>   	.atomic_flush	= mtk_crtc_atomic_flush,
>   	.atomic_enable	= mtk_crtc_atomic_enable,
>   	.atomic_disable	= mtk_crtc_atomic_disable,
> +	.atomic_check	= mtk_crtc_atomic_check,
>   };
>   
>   static int mtk_crtc_init(struct drm_device *drm, struct mtk_crtc *mtk_crtc,