[PATCH v3 0/3] drm/atomic: restrict the size of of gamma / degamma LUTs

[PATCH v3 0/3] drm/atomic: restrict the size of of gamma / degamma LUTs

[Dmitry Baryshkov]

While picking up the Gamma correction patch for the msm driver I noticed
that kms_color@invalid-gamma-lut-sizes and
kms_color@invalid-degamma-lut-sizes tests fail. These tests attempt
submitting LUT tables greater than the size specified by the
corresponding property. The issue doesn't seem to be specific to msm
driver only. Add generic check that LUT size is not greater than the
size passed to drm_crtc_enable_color_mgmt().

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
Changes in v3:
- Fixed elem_size type (LKP)
- Link to v2: https://lore.kernel.org/r/20251228-drm-fix-lut-checks-v2-0-50f5d1a260a7@oss.qualcomm.com

Changes in v2:
- Fixed comments for drm_object_immutable_property_get_value(), changed
  it to use drm_WARN_ON (Thomas)
- Reordered arguments of drm_property_replace_blob_from_id(), moving
  max_size before expected_size (Thomas)
- Link to v1: https://lore.kernel.org/r/20251115-drm-fix-lut-checks-v1-0-3586f5855bc7@oss.qualcomm.com,
  resent at https://lore.kernel.org/all/20251210-drm-fix-lut-checks-v1-0-10ae38519f43@oss.qualcomm.com/

---
Dmitry Baryshkov (3):
      drm/mode_object: add drm_object_immutable_property_get_value()
      drm/atomic: add max_size check to drm_property_replace_blob_from_id()
      drm/atomic: verify that gamma/degamma LUTs are not too big

 .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c    | 18 ++++++------
 drivers/gpu/drm/drm_atomic_uapi.c                  | 32 ++++++++++++++++------
 drivers/gpu/drm/drm_mode_object.c                  | 25 +++++++++++++++++
 drivers/gpu/drm/drm_property.c                     | 11 ++++++++
 include/drm/drm_mode_object.h                      |  3 ++
 include/drm/drm_property.h                         |  1 +
 6 files changed, 73 insertions(+), 17 deletions(-)
---
base-commit: 349d4efadc1f831ebc0b872ba1e3a2b7dd58b72b
change-id: 20251114-drm-fix-lut-checks-4bb325e24110

Best regards,
-- 
With best wishes
Dmitry

[PATCH v3 1/3] drm/mode_object: add drm_object_immutable_property_get_value()

[Dmitry Baryshkov]

We have a helper to get property values for non-atomic drivers and
another one default property values for atomic drivers. In some cases we
need the ability to get value of immutable property, no matter what kind
of driver it is. Implement new property-related helper,
drm_object_immutable_property_get_value(), which lets the caller to get
the value of the immutable property.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
 drivers/gpu/drm/drm_mode_object.c | 25 +++++++++++++++++++++++++
 include/drm/drm_mode_object.h     |  3 +++
 2 files changed, 28 insertions(+)

diff --git a/drivers/gpu/drm/drm_mode_object.c b/drivers/gpu/drm/drm_mode_object.c
index b45d501b10c8..2d943a610b88 100644
--- a/drivers/gpu/drm/drm_mode_object.c
+++ b/drivers/gpu/drm/drm_mode_object.c
@@ -385,6 +385,31 @@ int drm_object_property_get_default_value(struct drm_mode_object *obj,
 }
 EXPORT_SYMBOL(drm_object_property_get_default_value);
 
+/**
+ * drm_object_immutable_property_get_value - retrieve the value of a property
+ * @obj: drm mode object to get property value from
+ * @property: property to retrieve
+ * @val: storage for the property value
+ *
+ * This function retrieves the software state of the given immutable property
+ * for the given mode object.
+ *
+ * This function can be called by both atomic and non-atomic drivers.
+ *
+ * Returns:
+ * Zero on success, error code on failure.
+ */
+int drm_object_immutable_property_get_value(struct drm_mode_object *obj,
+					    struct drm_property *property,
+					    uint64_t *val)
+{
+	if (drm_WARN_ON(property->dev, !(property->flags & DRM_MODE_PROP_IMMUTABLE)))
+		return -EINVAL;
+
+	return __drm_object_property_get_prop_value(obj, property, val);
+}
+EXPORT_SYMBOL(drm_object_immutable_property_get_value);
+
 /* helper for getconnector and getproperties ioctls */
 int drm_mode_object_get_properties(struct drm_mode_object *obj, bool atomic,
 				   bool plane_color_pipeline,
diff --git a/include/drm/drm_mode_object.h b/include/drm/drm_mode_object.h
index c68edbd126d0..44a0d6f8d01f 100644
--- a/include/drm/drm_mode_object.h
+++ b/include/drm/drm_mode_object.h
@@ -133,6 +133,9 @@ int drm_object_property_get_value(struct drm_mode_object *obj,
 int drm_object_property_get_default_value(struct drm_mode_object *obj,
 					  struct drm_property *property,
 					  uint64_t *val);
+int drm_object_immutable_property_get_value(struct drm_mode_object *obj,
+					    struct drm_property *property,
+					    uint64_t *val);
 
 void drm_object_attach_property(struct drm_mode_object *obj,
 				struct drm_property *property,

-- 
2.47.3

[PATCH v3 2/3] drm/atomic: add max_size check to drm_property_replace_blob_from_id()

[Dmitry Baryshkov]

The function drm_property_replace_blob_from_id() allows checking whether
the blob size is equal to a predefined value. In case of variable-size
properties (like the gamma / degamma LUTs) we might want to check for
the blob size against the maximum, allowing properties of the size
lesser than the max supported by the hardware. Extend the function in
order to support such checks.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c    | 18 +++++++++---------
 drivers/gpu/drm/drm_atomic_uapi.c                      | 14 ++++++--------
 drivers/gpu/drm/drm_property.c                         | 11 +++++++++++
 include/drm/drm_property.h                             |  1 +
 4 files changed, 27 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
index 2e3ee78999d9..8c5912b59e19 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
@@ -1676,8 +1676,8 @@ dm_atomic_plane_set_property(struct drm_plane *plane,
 	if (property == adev->mode_info.plane_degamma_lut_property) {
 		ret = drm_property_replace_blob_from_id(plane->dev,
 							&dm_plane_state->degamma_lut,
-							val, -1,
-							sizeof(struct drm_color_lut),
+							val,
+							-1, -1, sizeof(struct drm_color_lut),
 							&replaced);
 		dm_plane_state->base.color_mgmt_changed |= replaced;
 		return ret;
@@ -1695,15 +1695,15 @@ dm_atomic_plane_set_property(struct drm_plane *plane,
 		ret = drm_property_replace_blob_from_id(plane->dev,
 							&dm_plane_state->ctm,
 							val,
-							sizeof(struct drm_color_ctm_3x4), -1,
+							-1, sizeof(struct drm_color_ctm_3x4), -1,
 							&replaced);
 		dm_plane_state->base.color_mgmt_changed |= replaced;
 		return ret;
 	} else if (property == adev->mode_info.plane_shaper_lut_property) {
 		ret = drm_property_replace_blob_from_id(plane->dev,
 							&dm_plane_state->shaper_lut,
-							val, -1,
-							sizeof(struct drm_color_lut),
+							val,
+							-1, -1, sizeof(struct drm_color_lut),
 							&replaced);
 		dm_plane_state->base.color_mgmt_changed |= replaced;
 		return ret;
@@ -1715,16 +1715,16 @@ dm_atomic_plane_set_property(struct drm_plane *plane,
 	} else if (property == adev->mode_info.plane_lut3d_property) {
 		ret = drm_property_replace_blob_from_id(plane->dev,
 							&dm_plane_state->lut3d,
-							val, -1,
-							sizeof(struct drm_color_lut),
+							val,
+							-1, -1, sizeof(struct drm_color_lut),
 							&replaced);
 		dm_plane_state->base.color_mgmt_changed |= replaced;
 		return ret;
 	} else if (property == adev->mode_info.plane_blend_lut_property) {
 		ret = drm_property_replace_blob_from_id(plane->dev,
 							&dm_plane_state->blend_lut,
-							val, -1,
-							sizeof(struct drm_color_lut),
+							val,
+							-1, -1, sizeof(struct drm_color_lut),
 							&replaced);
 		dm_plane_state->base.color_mgmt_changed |= replaced;
 		return ret;
diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
index 7320db4b8489..dff1fdefcbeb 100644
--- a/drivers/gpu/drm/drm_atomic_uapi.c
+++ b/drivers/gpu/drm/drm_atomic_uapi.c
@@ -416,7 +416,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
 		ret = drm_property_replace_blob_from_id(dev,
 					&state->degamma_lut,
 					val,
-					-1, sizeof(struct drm_color_lut),
+					-1, -1, sizeof(struct drm_color_lut),
 					&replaced);
 		state->color_mgmt_changed |= replaced;
 		return ret;
@@ -424,7 +424,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
 		ret = drm_property_replace_blob_from_id(dev,
 					&state->ctm,
 					val,
-					sizeof(struct drm_color_ctm), -1,
+					-1, sizeof(struct drm_color_ctm), -1,
 					&replaced);
 		state->color_mgmt_changed |= replaced;
 		return ret;
@@ -432,7 +432,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
 		ret = drm_property_replace_blob_from_id(dev,
 					&state->gamma_lut,
 					val,
-					-1, sizeof(struct drm_color_lut),
+					-1, -1, sizeof(struct drm_color_lut),
 					&replaced);
 		state->color_mgmt_changed |= replaced;
 		return ret;
@@ -587,8 +587,7 @@ static int drm_atomic_plane_set_property(struct drm_plane *plane,
 		ret = drm_property_replace_blob_from_id(dev,
 					&state->fb_damage_clips,
 					val,
-					-1,
-					sizeof(struct drm_mode_rect),
+					-1, -1, sizeof(struct drm_mode_rect),
 					&replaced);
 		return ret;
 	} else if (property == plane->scaling_filter_property) {
@@ -717,8 +716,7 @@ static int drm_atomic_color_set_data_property(struct drm_colorop *colorop,
 	return drm_property_replace_blob_from_id(colorop->dev,
 						 &state->data,
 						 val,
-						 size,
-						 elem_size,
+						 -1, size, elem_size,
 						 &replaced);
 }
 
@@ -876,7 +874,7 @@ static int drm_atomic_connector_set_property(struct drm_connector *connector,
 		ret = drm_property_replace_blob_from_id(dev,
 				&state->hdr_output_metadata,
 				val,
-				sizeof(struct hdr_output_metadata), -1,
+				-1, sizeof(struct hdr_output_metadata), -1,
 				&replaced);
 		return ret;
 	} else if (property == config->aspect_ratio_property) {
diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
index 596272149a35..955fa960843b 100644
--- a/drivers/gpu/drm/drm_property.c
+++ b/drivers/gpu/drm/drm_property.c
@@ -757,6 +757,7 @@ EXPORT_SYMBOL(drm_property_replace_blob);
  * @dev: DRM device
  * @blob: a pointer to the member blob to be replaced
  * @blob_id: the id of the new blob to replace with
+ * @max_size: the maximum size of the blob property for variable-size blobs
  * @expected_size: expected size of the blob property
  * @expected_elem_size: expected size of an element in the blob property
  * @replaced: if the blob was in fact replaced
@@ -771,6 +772,7 @@ EXPORT_SYMBOL(drm_property_replace_blob);
 int drm_property_replace_blob_from_id(struct drm_device *dev,
 					 struct drm_property_blob **blob,
 					 uint64_t blob_id,
+					 ssize_t max_size,
 					 ssize_t expected_size,
 					 ssize_t expected_elem_size,
 					 bool *replaced)
@@ -785,6 +787,15 @@ int drm_property_replace_blob_from_id(struct drm_device *dev,
 			return -EINVAL;
 		}
 
+		if (max_size > 0 &&
+		    new_blob->length > max_size) {
+			drm_dbg_atomic(dev,
+				       "[BLOB:%d] length %zu greater than max %zu\n",
+				       new_blob->base.id, new_blob->length, max_size);
+			drm_property_blob_put(new_blob);
+			return -EINVAL;
+		}
+
 		if (expected_size > 0 &&
 		    new_blob->length != expected_size) {
 			drm_dbg_atomic(dev,
diff --git a/include/drm/drm_property.h b/include/drm/drm_property.h
index 082f29156b3e..aa49b5a42bb5 100644
--- a/include/drm/drm_property.h
+++ b/include/drm/drm_property.h
@@ -284,6 +284,7 @@ int drm_property_replace_blob_from_id(struct drm_device *dev,
 				      uint64_t blob_id,
 				      ssize_t expected_size,
 				      ssize_t expected_elem_size,
+				      ssize_t max_size,
 				      bool *replaced);
 int drm_property_replace_global_blob(struct drm_device *dev,
 				     struct drm_property_blob **replace,

-- 
2.47.3

[PATCH v3 3/3] drm/atomic: verify that gamma/degamma LUTs are not too big

[Dmitry Baryshkov]

The kernel specifies LUT table sizes in a separate property, however it
doesn't enforce it as a maximum. Some drivers implement max suze check
on their own in the atomic_check path. Other drivers simply ignore the
issue. Perform LUT size validation in the generic place.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
 drivers/gpu/drm/drm_atomic_uapi.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
index dff1fdefcbeb..dc013a22bf26 100644
--- a/drivers/gpu/drm/drm_atomic_uapi.c
+++ b/drivers/gpu/drm/drm_atomic_uapi.c
@@ -413,10 +413,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
 	} else if (property == config->prop_vrr_enabled) {
 		state->vrr_enabled = val;
 	} else if (property == config->degamma_lut_property) {
+		const size_t elem_size = sizeof(struct drm_color_lut);
+		u64 lut_size;
+
+		ret = drm_object_immutable_property_get_value(&crtc->base,
+							      config->degamma_lut_size_property,
+							      &lut_size);
+		if (ret)
+			return ret;
+
 		ret = drm_property_replace_blob_from_id(dev,
 					&state->degamma_lut,
 					val,
-					-1, -1, sizeof(struct drm_color_lut),
+					elem_size * lut_size, -1, elem_size,
 					&replaced);
 		state->color_mgmt_changed |= replaced;
 		return ret;
@@ -429,10 +438,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
 		state->color_mgmt_changed |= replaced;
 		return ret;
 	} else if (property == config->gamma_lut_property) {
+		const size_t elem_size = sizeof(struct drm_color_lut);
+		u64 lut_size;
+
+		ret = drm_object_immutable_property_get_value(&crtc->base,
+							      config->gamma_lut_size_property,
+							      &lut_size);
+		if (ret)
+			return ret;
+
 		ret = drm_property_replace_blob_from_id(dev,
 					&state->gamma_lut,
 					val,
-					-1, -1, sizeof(struct drm_color_lut),
+					elem_size * lut_size, -1, elem_size,
 					&replaced);
 		state->color_mgmt_changed |= replaced;
 		return ret;

-- 
2.47.3

Re: [PATCH v3 1/3] drm/mode_object: add drm_object_immutable_property_get_value()

[Thomas Zimmermann]

Am 06.01.26 um 04:09 schrieb Dmitry Baryshkov:
> We have a helper to get property values for non-atomic drivers and
> another one default property values for atomic drivers. In some cases we
> need the ability to get value of immutable property, no matter what kind
> of driver it is. Implement new property-related helper,
> drm_object_immutable_property_get_value(), which lets the caller to get
> the value of the immutable property.
>
> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>

Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>

> ---
>   drivers/gpu/drm/drm_mode_object.c | 25 +++++++++++++++++++++++++
>   include/drm/drm_mode_object.h     |  3 +++
>   2 files changed, 28 insertions(+)
>
> diff --git a/drivers/gpu/drm/drm_mode_object.c b/drivers/gpu/drm/drm_mode_object.c
> index b45d501b10c8..2d943a610b88 100644
> --- a/drivers/gpu/drm/drm_mode_object.c
> +++ b/drivers/gpu/drm/drm_mode_object.c
> @@ -385,6 +385,31 @@ int drm_object_property_get_default_value(struct drm_mode_object *obj,
>   }
>   EXPORT_SYMBOL(drm_object_property_get_default_value);
>   
> +/**
> + * drm_object_immutable_property_get_value - retrieve the value of a property
> + * @obj: drm mode object to get property value from
> + * @property: property to retrieve
> + * @val: storage for the property value
> + *
> + * This function retrieves the software state of the given immutable property
> + * for the given mode object.
> + *
> + * This function can be called by both atomic and non-atomic drivers.
> + *
> + * Returns:
> + * Zero on success, error code on failure.
> + */
> +int drm_object_immutable_property_get_value(struct drm_mode_object *obj,
> +					    struct drm_property *property,
> +					    uint64_t *val)
> +{
> +	if (drm_WARN_ON(property->dev, !(property->flags & DRM_MODE_PROP_IMMUTABLE)))
> +		return -EINVAL;
> +
> +	return __drm_object_property_get_prop_value(obj, property, val);
> +}
> +EXPORT_SYMBOL(drm_object_immutable_property_get_value);
> +
>   /* helper for getconnector and getproperties ioctls */
>   int drm_mode_object_get_properties(struct drm_mode_object *obj, bool atomic,
>   				   bool plane_color_pipeline,
> diff --git a/include/drm/drm_mode_object.h b/include/drm/drm_mode_object.h
> index c68edbd126d0..44a0d6f8d01f 100644
> --- a/include/drm/drm_mode_object.h
> +++ b/include/drm/drm_mode_object.h
> @@ -133,6 +133,9 @@ int drm_object_property_get_value(struct drm_mode_object *obj,
>   int drm_object_property_get_default_value(struct drm_mode_object *obj,
>   					  struct drm_property *property,
>   					  uint64_t *val);
> +int drm_object_immutable_property_get_value(struct drm_mode_object *obj,
> +					    struct drm_property *property,
> +					    uint64_t *val);
>   
>   void drm_object_attach_property(struct drm_mode_object *obj,
>   				struct drm_property *property,
>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

Re: [PATCH v3 2/3] drm/atomic: add max_size check to drm_property_replace_blob_from_id()

[Thomas Zimmermann]

Am 06.01.26 um 04:09 schrieb Dmitry Baryshkov:
> The function drm_property_replace_blob_from_id() allows checking whether
> the blob size is equal to a predefined value. In case of variable-size
> properties (like the gamma / degamma LUTs) we might want to check for
> the blob size against the maximum, allowing properties of the size
> lesser than the max supported by the hardware. Extend the function in
> order to support such checks.
>
> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>

Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>

> ---
>   .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c    | 18 +++++++++---------
>   drivers/gpu/drm/drm_atomic_uapi.c                      | 14 ++++++--------
>   drivers/gpu/drm/drm_property.c                         | 11 +++++++++++
>   include/drm/drm_property.h                             |  1 +
>   4 files changed, 27 insertions(+), 17 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
> index 2e3ee78999d9..8c5912b59e19 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
> @@ -1676,8 +1676,8 @@ dm_atomic_plane_set_property(struct drm_plane *plane,
>   	if (property == adev->mode_info.plane_degamma_lut_property) {
>   		ret = drm_property_replace_blob_from_id(plane->dev,
>   							&dm_plane_state->degamma_lut,
> -							val, -1,
> -							sizeof(struct drm_color_lut),
> +							val,
> +							-1, -1, sizeof(struct drm_color_lut),
>   							&replaced);
>   		dm_plane_state->base.color_mgmt_changed |= replaced;
>   		return ret;
> @@ -1695,15 +1695,15 @@ dm_atomic_plane_set_property(struct drm_plane *plane,
>   		ret = drm_property_replace_blob_from_id(plane->dev,
>   							&dm_plane_state->ctm,
>   							val,
> -							sizeof(struct drm_color_ctm_3x4), -1,
> +							-1, sizeof(struct drm_color_ctm_3x4), -1,
>   							&replaced);
>   		dm_plane_state->base.color_mgmt_changed |= replaced;
>   		return ret;
>   	} else if (property == adev->mode_info.plane_shaper_lut_property) {
>   		ret = drm_property_replace_blob_from_id(plane->dev,
>   							&dm_plane_state->shaper_lut,
> -							val, -1,
> -							sizeof(struct drm_color_lut),
> +							val,
> +							-1, -1, sizeof(struct drm_color_lut),
>   							&replaced);
>   		dm_plane_state->base.color_mgmt_changed |= replaced;
>   		return ret;
> @@ -1715,16 +1715,16 @@ dm_atomic_plane_set_property(struct drm_plane *plane,
>   	} else if (property == adev->mode_info.plane_lut3d_property) {
>   		ret = drm_property_replace_blob_from_id(plane->dev,
>   							&dm_plane_state->lut3d,
> -							val, -1,
> -							sizeof(struct drm_color_lut),
> +							val,
> +							-1, -1, sizeof(struct drm_color_lut),
>   							&replaced);
>   		dm_plane_state->base.color_mgmt_changed |= replaced;
>   		return ret;
>   	} else if (property == adev->mode_info.plane_blend_lut_property) {
>   		ret = drm_property_replace_blob_from_id(plane->dev,
>   							&dm_plane_state->blend_lut,
> -							val, -1,
> -							sizeof(struct drm_color_lut),
> +							val,
> +							-1, -1, sizeof(struct drm_color_lut),
>   							&replaced);
>   		dm_plane_state->base.color_mgmt_changed |= replaced;
>   		return ret;
> diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
> index 7320db4b8489..dff1fdefcbeb 100644
> --- a/drivers/gpu/drm/drm_atomic_uapi.c
> +++ b/drivers/gpu/drm/drm_atomic_uapi.c
> @@ -416,7 +416,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
>   		ret = drm_property_replace_blob_from_id(dev,
>   					&state->degamma_lut,
>   					val,
> -					-1, sizeof(struct drm_color_lut),
> +					-1, -1, sizeof(struct drm_color_lut),
>   					&replaced);
>   		state->color_mgmt_changed |= replaced;
>   		return ret;
> @@ -424,7 +424,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
>   		ret = drm_property_replace_blob_from_id(dev,
>   					&state->ctm,
>   					val,
> -					sizeof(struct drm_color_ctm), -1,
> +					-1, sizeof(struct drm_color_ctm), -1,
>   					&replaced);
>   		state->color_mgmt_changed |= replaced;
>   		return ret;
> @@ -432,7 +432,7 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
>   		ret = drm_property_replace_blob_from_id(dev,
>   					&state->gamma_lut,
>   					val,
> -					-1, sizeof(struct drm_color_lut),
> +					-1, -1, sizeof(struct drm_color_lut),
>   					&replaced);
>   		state->color_mgmt_changed |= replaced;
>   		return ret;
> @@ -587,8 +587,7 @@ static int drm_atomic_plane_set_property(struct drm_plane *plane,
>   		ret = drm_property_replace_blob_from_id(dev,
>   					&state->fb_damage_clips,
>   					val,
> -					-1,
> -					sizeof(struct drm_mode_rect),
> +					-1, -1, sizeof(struct drm_mode_rect),
>   					&replaced);
>   		return ret;
>   	} else if (property == plane->scaling_filter_property) {
> @@ -717,8 +716,7 @@ static int drm_atomic_color_set_data_property(struct drm_colorop *colorop,
>   	return drm_property_replace_blob_from_id(colorop->dev,
>   						 &state->data,
>   						 val,
> -						 size,
> -						 elem_size,
> +						 -1, size, elem_size,
>   						 &replaced);
>   }
>   
> @@ -876,7 +874,7 @@ static int drm_atomic_connector_set_property(struct drm_connector *connector,
>   		ret = drm_property_replace_blob_from_id(dev,
>   				&state->hdr_output_metadata,
>   				val,
> -				sizeof(struct hdr_output_metadata), -1,
> +				-1, sizeof(struct hdr_output_metadata), -1,
>   				&replaced);
>   		return ret;
>   	} else if (property == config->aspect_ratio_property) {
> diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
> index 596272149a35..955fa960843b 100644
> --- a/drivers/gpu/drm/drm_property.c
> +++ b/drivers/gpu/drm/drm_property.c
> @@ -757,6 +757,7 @@ EXPORT_SYMBOL(drm_property_replace_blob);
>    * @dev: DRM device
>    * @blob: a pointer to the member blob to be replaced
>    * @blob_id: the id of the new blob to replace with
> + * @max_size: the maximum size of the blob property for variable-size blobs
>    * @expected_size: expected size of the blob property
>    * @expected_elem_size: expected size of an element in the blob property
>    * @replaced: if the blob was in fact replaced
> @@ -771,6 +772,7 @@ EXPORT_SYMBOL(drm_property_replace_blob);
>   int drm_property_replace_blob_from_id(struct drm_device *dev,
>   					 struct drm_property_blob **blob,
>   					 uint64_t blob_id,
> +					 ssize_t max_size,
>   					 ssize_t expected_size,
>   					 ssize_t expected_elem_size,
>   					 bool *replaced)
> @@ -785,6 +787,15 @@ int drm_property_replace_blob_from_id(struct drm_device *dev,
>   			return -EINVAL;
>   		}
>   
> +		if (max_size > 0 &&
> +		    new_blob->length > max_size) {
> +			drm_dbg_atomic(dev,
> +				       "[BLOB:%d] length %zu greater than max %zu\n",
> +				       new_blob->base.id, new_blob->length, max_size);
> +			drm_property_blob_put(new_blob);
> +			return -EINVAL;
> +		}
> +
>   		if (expected_size > 0 &&
>   		    new_blob->length != expected_size) {
>   			drm_dbg_atomic(dev,
> diff --git a/include/drm/drm_property.h b/include/drm/drm_property.h
> index 082f29156b3e..aa49b5a42bb5 100644
> --- a/include/drm/drm_property.h
> +++ b/include/drm/drm_property.h
> @@ -284,6 +284,7 @@ int drm_property_replace_blob_from_id(struct drm_device *dev,
>   				      uint64_t blob_id,
>   				      ssize_t expected_size,
>   				      ssize_t expected_elem_size,
> +				      ssize_t max_size,
>   				      bool *replaced);
>   int drm_property_replace_global_blob(struct drm_device *dev,
>   				     struct drm_property_blob **replace,
>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

Re: [PATCH v3 3/3] drm/atomic: verify that gamma/degamma LUTs are not too big

[Thomas Zimmermann]

Am 06.01.26 um 04:09 schrieb Dmitry Baryshkov:
> The kernel specifies LUT table sizes in a separate property, however it
> doesn't enforce it as a maximum. Some drivers implement max suze check

s/suze/size

> on their own in the atomic_check path. Other drivers simply ignore the
> issue. Perform LUT size validation in the generic place.
>
> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>

Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>

> ---
>   drivers/gpu/drm/drm_atomic_uapi.c | 22 ++++++++++++++++++++--
>   1 file changed, 20 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
> index dff1fdefcbeb..dc013a22bf26 100644
> --- a/drivers/gpu/drm/drm_atomic_uapi.c
> +++ b/drivers/gpu/drm/drm_atomic_uapi.c
> @@ -413,10 +413,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
>   	} else if (property == config->prop_vrr_enabled) {
>   		state->vrr_enabled = val;
>   	} else if (property == config->degamma_lut_property) {
> +		const size_t elem_size = sizeof(struct drm_color_lut);
> +		u64 lut_size;
> +
> +		ret = drm_object_immutable_property_get_value(&crtc->base,
> +							      config->degamma_lut_size_property,
> +							      &lut_size);
> +		if (ret)
> +			return ret;
> +
>   		ret = drm_property_replace_blob_from_id(dev,
>   					&state->degamma_lut,
>   					val,
> -					-1, -1, sizeof(struct drm_color_lut),
> +					elem_size * lut_size, -1, elem_size,
>   					&replaced);
>   		state->color_mgmt_changed |= replaced;
>   		return ret;
> @@ -429,10 +438,19 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
>   		state->color_mgmt_changed |= replaced;
>   		return ret;
>   	} else if (property == config->gamma_lut_property) {
> +		const size_t elem_size = sizeof(struct drm_color_lut);
> +		u64 lut_size;
> +
> +		ret = drm_object_immutable_property_get_value(&crtc->base,
> +							      config->gamma_lut_size_property,
> +							      &lut_size);
> +		if (ret)
> +			return ret;
> +
>   		ret = drm_property_replace_blob_from_id(dev,
>   					&state->gamma_lut,
>   					val,
> -					-1, -1, sizeof(struct drm_color_lut),
> +					elem_size * lut_size, -1, elem_size,
>   					&replaced);
>   		state->color_mgmt_changed |= replaced;
>   		return ret;
>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

Re: [PATCH v3 0/3] drm/atomic: restrict the size of of gamma / degamma LUTs

[Dmitry Baryshkov]

On Tue, 06 Jan 2026 05:09:54 +0200, Dmitry Baryshkov wrote:
> While picking up the Gamma correction patch for the msm driver I noticed
> that kms_color@invalid-gamma-lut-sizes and
> kms_color@invalid-degamma-lut-sizes tests fail. These tests attempt
> submitting LUT tables greater than the size specified by the
> corresponding property. The issue doesn't seem to be specific to msm
> driver only. Add generic check that LUT size is not greater than the
> size passed to drm_crtc_enable_color_mgmt().
> 
> [...]

Applied to drm-misc-next, thanks!

[1/3] drm/mode_object: add drm_object_immutable_property_get_value()
      commit: 66c9c0cfe765af7f30eac880da0fa047aea8617d
[2/3] drm/atomic: add max_size check to drm_property_replace_blob_from_id()
      commit: ca59e33f5a1f642d13ae0e558fdbdd9aaa9fe203
[3/3] drm/atomic: verify that gamma/degamma LUTs are not too big
      commit: cea6e6e8717e81de266aa496f44088b2b960aa32

Best regards,
-- 
With best wishes
Dmitry