[PATCH v2] drm/mediatek: Validate gamma_lut size

[PATCH v2] drm/mediatek: Validate gamma_lut size

[Fei Shao]

The DRM core checks that a gamma_lut blob is aligned to
sizeof(struct drm_color_lut) and at most GAMMA_LUT_SIZE entries, so
shorter blobs still reach the driver. mtk_aal_gamma_set() and
mtk_gamma_set() read up to the fixed hardware LUT size, which is an OOB
read when the blob is shorter.

Add mtk_crtc_atomic_check() and reject gamma_lut if its entry count does
not match crtc->gamma_size.

Fixes: 2f3f4dda747c ("drm/mediatek: Add gamma correction.")
Signed-off-by: Fei Shao <fshao@chromium.org>
---

Changes in v2:
- Use drm_color_lut_size() and check against crtc->gamma_size, which
  mtk_crtc_create() already sets for the pipeline. This drops the
  ddp_comp[] loop and avoids the NULL conn_routes slot before enable.
- Move mtk_crtc_atomic_check() before mtk_crtc_atomic_begin() so the
  patch applies cleanly both to linux-next (next-20261104) and on top of
  the mediatek-drm restructuring series.
  https://lore.kernel.org/r/20260714114414.184512-1-angelogioacchino.delregno@collabora.com

 drivers/gpu/drm/mediatek/mtk_crtc.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/gpu/drm/mediatek/mtk_crtc.c b/drivers/gpu/drm/mediatek/mtk_crtc.c
index 2920f3198ef6..67c2288ab8e0 100644
--- a/drivers/gpu/drm/mediatek/mtk_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_crtc.c
@@ -841,6 +841,17 @@ static void mtk_crtc_atomic_disable(struct drm_crtc *crtc,
 	mtk_crtc->enabled = false;
 }
 
+static int mtk_crtc_atomic_check(struct drm_crtc *crtc, struct drm_atomic_commit *state)
+{
+	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+	struct drm_property_blob *gamma_lut = crtc_state->gamma_lut;
+
+	if (gamma_lut && drm_color_lut_size(gamma_lut) != crtc->gamma_size)
+		return -EINVAL;
+
+	return 0;
+}
+
 static void mtk_crtc_atomic_begin(struct drm_crtc *crtc,
 				  struct drm_atomic_commit *state)
 {
@@ -895,6 +906,7 @@ static const struct drm_crtc_helper_funcs mtk_crtc_helper_funcs = {
 	.mode_fixup	= mtk_crtc_mode_fixup,
 	.mode_set_nofb	= mtk_crtc_mode_set_nofb,
 	.mode_valid	= mtk_crtc_mode_valid,
+	.atomic_check	= mtk_crtc_atomic_check,
 	.atomic_begin	= mtk_crtc_atomic_begin,
 	.atomic_flush	= mtk_crtc_atomic_flush,
 	.atomic_enable	= mtk_crtc_atomic_enable,
-- 
2.56.0.455.g6c5a503b38-goog

Re: [PATCH v2] drm/mediatek: Validate gamma_lut size

[AngeloGioacchino Del Regno]

On 11/6/26 11:39, Fei Shao wrote:
> The DRM core checks that a gamma_lut blob is aligned to
> sizeof(struct drm_color_lut) and at most GAMMA_LUT_SIZE entries, so
> shorter blobs still reach the driver. mtk_aal_gamma_set() and
> mtk_gamma_set() read up to the fixed hardware LUT size, which is an OOB
> read when the blob is shorter.
> 
> Add mtk_crtc_atomic_check() and reject gamma_lut if its entry count does
> not match crtc->gamma_size.
> 
> Fixes: 2f3f4dda747c ("drm/mediatek: Add gamma correction.")
> Signed-off-by: Fei Shao <fshao@chromium.org>

Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>