From:   Mark Yacoub <markyacoub@chromium.org>
To:     linux-mediatek@lists.infradead.org
Cc:     seanpaul@chromium.org, chunkuang.hu@kernel.org,
        p.zabel@pengutronix.de, matthias.bgg@gmail.com,
        jason-jh.lin@mediatek.com, tzungbi@google.com,
        Mark Yacoub <markyacoub@google.com>,
        Mark Yacoub <markyacoub@chromium.org>,
        David Airlie <airlied@linux.ie>,
        Daniel Vetter <daniel@ffwll.ch>,
        dri-devel@lists.freedesktop.org,
        linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: [PATCH] drm/mediatek: Validate the CRTC LUT size.
Date:   Wed,  8 Dec 2021 14:09:13 -0500
Message-Id: <20211208190921.128702-1-markyacoub@chromium.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Mark Yacoub <markyacoub@google.com>

[Why]
The user space can allocate a LUT of any size. We must validate that it
is the expected MTK_LUT_SIZE.

[How]
Bring the .atomic_check function internal to mediatek driver and check
that the new CRTC state LUT size is equal to MTK_LUT_SIZE.

Fixes igt@kms_color@pipe-A-invalid-gamma-lut-sizes
Tested on Jacuzzi (MTK)

Signed-off-by: Mark Yacoub <markyacoub@chromium.org>
---
 drivers/gpu/drm/mediatek/mtk_drm_drv.c | 40 +++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index f47801737b88f..82de83656d159 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -54,9 +54,47 @@ mtk_drm_mode_fb_create(struct drm_device *dev,
 	return drm_gem_fb_create(dev, file, cmd);
 }
 
+static bool is_lut_size_expected(const struct drm_device *dev,
+				 const struct drm_property_blob *lut)
+{
+	int len;
+
+	if (!lut)
+		return true;
+
+	len = drm_color_lut_size(lut);
+	if (len != MTK_LUT_SIZE) {
+		drm_dbg_state(dev, "Invalid LUT size; got %d, expected %d\n",
+			      len, MTK_LUT_SIZE);
+		return false;
+	}
+
+	return true;
+}
+
+static int mtk_drm_atomic_check(struct drm_device *dev,
+				struct drm_atomic_state *state)
+{
+	struct drm_crtc *crtc;
+	struct drm_crtc_state *new_crtc_state;
+	int ret, i;
+
+	ret = drm_atomic_helper_check(dev, state);
+	if (ret)
+		return ret;
+
+	for_each_new_crtc_in_state (state, crtc, new_crtc_state, i) {
+		if (!is_lut_size_expected(dev, new_crtc_state->degamma_lut) ||
+		    !is_lut_size_expected(dev, new_crtc_state->gamma_lut))
+			return -EINVAL;
+	}
+
+	return 0;
+}
+
 static const struct drm_mode_config_funcs mtk_drm_mode_config_funcs = {
 	.fb_create = mtk_drm_mode_fb_create,
-	.atomic_check = drm_atomic_helper_check,
+	.atomic_check = mtk_drm_atomic_check,
 	.atomic_commit = drm_atomic_helper_commit,
 };
 
-- 
2.34.1.400.ga245620fadb-goog