[PATCH] drm/msm/dpu: add the missing GC block to the SM8750 DSPP catalog

[PATCH] drm/msm/dpu: add the missing GC block to the SM8750 DSPP catalog

[Qianhui Xu]

From: Xu Qianhui <xiaqinghuan@mail.ustc.edu.cn>

SM8750's DSPP sub-block description only lists PCC, but the hardware (and
the SM8650/SDM845 catalogs) also expose the gamma-correction block at
0x17c0.

dpu_crtc_create() only calls drm_crtc_enable_color_mgmt() when
dspp->sblk->gc.base is non-zero, so on SM8750 boards no CRTC advertised
GAMMA_LUT and userspace could not do night light/color temperature
adjustment, even though the hardware supports it.

Add the GC block to sm8750_dspp_sblk, matching the offset/version used by
the other DSPP catalogs.

Tested on Lenovo Legion Y700 Gen4 (TB322FC, SM8750P): GAMMA_LUT appears as
a CRTC property and changing it visibly shifts the color temperature.

Signed-off-by: Xu Qianhui <xiaqinghuan@mail.ustc.edu.cn>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
index 9a993cdfab..11dc08e4a4 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
@@ -428,6 +428,13 @@ static const struct dpu_dspp_sub_blks sdm845_dspp_sblk = {
 static const struct dpu_dspp_sub_blks sm8750_dspp_sblk = {
 	.pcc = {.name = "pcc", .base = 0x1700,
 		.len = 0x90, .version = 0x60000},
+	/*
+	 * SM8750 has the same GC block as SM8650/SDM845.  Without it
+	 * dpu_crtc.c does not call drm_crtc_enable_color_mgmt(), so no
+	 * CRTC exposes GAMMA_LUT (night light/color temperature).
+	 */
+	.gc = {.name = "gc", .base = 0x17c0,
+		.len = 0x40, .version = 0x10008},
 };
 
 /*************************************************************
-- 
2.53.0

Re: [PATCH] drm/msm/dpu: add the missing GC block to the SM8750 DSPP catalog

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] drm/msm/dpu: out-of-bounds read due to missing gamma_lut size check
- [High] drm/msm: GFP_KERNEL allocation in atomic_begin callback causes sleep in atomic context
--

commit 3f1bdbf4572ec65ee6d3f256b00cb20d05a40d96
Author: Xu Qianhui <xiaqinghuan@mail.ustc.edu.cn>

drm/msm/dpu: add the missing GC block to the SM8750 DSPP catalog

This commit adds the missing GC (gamma correction) sub-block to the SM8750 
DSPP catalog. This change enables the GAMMA_LUT property for CRTCs on SM8750 
boards, allowing userspace to perform night light and color temperature 
adjustments.

> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
> index 9a993cdfab856..11dc08e4a4846 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
> @@ -428,6 +428,13 @@ static const struct dpu_dspp_sub_blks sdm845_dspp_sblk = {
>  static const struct dpu_dspp_sub_blks sm8750_dspp_sblk = {
>  	.pcc = {.name = "pcc", .base = 0x1700,
>  		.len = 0x90, .version = 0x60000},
> +	/*
> +	 * SM8750 has the same GC block as SM8650/SDM845.  Without it
> +	 * dpu_crtc.c does not call drm_crtc_enable_color_mgmt(), so no
> +	 * CRTC exposes GAMMA_LUT (night light/color temperature).
> +	 */
> +	.gc = {.name = "gc", .base = 0x17c0,
> +		.len = 0x40, .version = 0x10008},

[Severity: High]
By exposing the GAMMA_LUT property to userspace here, does this code
overflow the lut array?

Looking at _dpu_crtc_get_gc_lut():

drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c:_dpu_crtc_get_gc_lut():
	/* Pack 1024 10-bit entries in 512 32-bit registers */
	for (i = 0; i < PGC_TBL_LEN; i++) {
		val_even = drm_color_lut_extract(lut[i * 2].green, 10);
		val_odd = drm_color_lut_extract(lut[i * 2 + 1].green, 10);

This loop unconditionally accesses up to 1024 elements of the user-provided
lut array. Because the DRM core allows blobs smaller than the property's
maximum size, and the driver's dpu_crtc_atomic_check() lacks a validation
check on the blob size, providing an undersized blob will cause an
out-of-bounds read here.

The read memory is then written to hardware registers (gc_lut->c0/c1/c2),
allowing a local attacker to leak adjacent kernel heap memory.

[Severity: High]
Can exposing the GC block trigger a sleep in an atomic context?

The DRM subsystem requires CRTC atomic callbacks to be non-sleeping, but
dpu_crtc_atomic_begin() calls into _dpu_crtc_setup_cp_blocks():

drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c:dpu_crtc_atomic_begin():
	_dpu_crtc_blend_setup(crtc);

	_dpu_crtc_setup_cp_blocks(crtc);

which performs a GFP_KERNEL allocation when state->gamma_lut is present:

drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c:_dpu_crtc_setup_cp_blocks():
			} else {
				gc_lut = kzalloc_obj(*gc_lut);
				if (!gc_lut)
					continue;
				_dpu_crtc_get_gc_lut(state, gc_lut);
				dspp->ops.setup_gc(dspp, gc_lut);
				kfree(gc_lut);
			}

The kzalloc_obj() macro implicitly uses GFP_KERNEL as its allocation flag.
GFP_KERNEL allocations can sleep (e.g., while waiting for memory reclaim or
I/O), which violates the atomic context constraints and will trigger
scheduling while atomic kernel warnings, system instability, or deadlocks.

>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013002124.332074-1-xiaqinghuan@mail.ustc.edu.cn?part=1

Re: [PATCH] drm/msm/dpu: add the missing GC block to the SM8750 DSPP catalog

[Qianhui Xu]

Hi,

Please drop this patch, it is a duplicate.  The same change is already in the
msm tree as

  3389406e6a03 ("drm/msm/dpu: Fix GAMMA LUT for sm8750 related DPUs")

applied on 2026-09-30 for v7.4.  I based my patch on v7.3-rc7, where the entry
is still missing, and I missed drm-msm-next while checking for existing work.
Sorry for the noise.

On sashiko's two findings:

- The missing gamma LUT size check is real, and pre-existing.  The DRM core
  passes max_size and expected_elem_size to drm_property_replace_blob_from_id()
  but no exact size, so a blob shorter than
  DPU_GAMMA_LUT_SIZE * sizeof(struct drm_color_lut) is accepted, and
  _dpu_crtc_get_gc_lut() then reads DPU_GAMMA_LUT_SIZE entries.  This affects
  every DPU platform that exposes the GC block (SDM845, SM8650, SM8750), not
  just the catalog entry in this patch.  I have just sent a patch that adds
  the size check to dpu_crtc_atomic_check().

- The GFP_KERNEL allocation in dpu_crtc_atomic_begin() (through
  _dpu_crtc_setup_cp_blocks()) is also pre-existing and independent of this
  patch.  I did not want to bundle it with the size fix; happy to follow up
  with a separate patch if that is wanted.

Thanks,
Xu Qianhui <xiaqinghuan@mail.ustc.edu.cn>