From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 6A024EE3693 for ; Thu, 12 Feb 2026 15:04:40 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id A160F10E75A; Thu, 12 Feb 2026 15:04:39 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (1024-bit key; unprotected) header.d=foxmail.com header.i=@foxmail.com header.b="GY61PfCs"; dkim-atps=neutral Received: from out162-62-57-87.mail.qq.com (out162-62-57-87.mail.qq.com [162.62.57.87]) by gabe.freedesktop.org (Postfix) with ESMTPS id 2A8DC10E75A for ; Thu, 12 Feb 2026 15:04:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foxmail.com; s=s201512; t=1770908671; bh=69/IEsj8R31gocE8inaSyurdU6qgd06bg5RSPoK31Lo=; h=Subject:From:To:Cc:Date:In-Reply-To:References; b=GY61PfCsQm6V1r+OgxpkKGyr3VCtvPxjAiyIN8AmdSyugWwk0d4nawXxcUjoDnpXk hFQv8lJc2j2R00jrojnht3VKql51ChLkAI0h2I8Q4QGx6gLXbQizJRc5RNV0lCWD9h wO7Gn3yjx9ZdvYIXeH3nORkBS9M6D0Y8g033DmlI= Received: from [127.0.0.1] ([171.223.167.146]) by newxmesmtplogicsvrszb43-0.qq.com (NewEsmtp) with SMTP id 11C98AB5; Thu, 12 Feb 2026 23:04:28 +0800 X-QQ-mid: xmsmtpt1770908668tc9mvlaqu Message-ID: X-QQ-XMAILINFO: NwU6Bou9okj/1jn/WsVtrP0vu+h0WQkIEb4jjYwZW38J9AgktKgtZCtfgx+Oyb 4VtlOLiuS93cYBzZ7C4Zoh6X/uHPwFs1jf4iQ7jOrD1K0N5AftkAeHqVG2KwtX+K/g+fbj7/OyZS DiVTbJsU+AmGUywIUjZW2zwUjYO8ppyt3j2Xwqf8AFKApnxBaxkM1pTeu5f1XFttSvZH3k1S2E/C fZBVoUqXjx/kg18KhshJOk+0RtU9c7r2/QLJj4oKDY/HnmXLKL9+Ikw+Xa4rPGKiMOWUTTxxHaH/ 0RtlPJUTZ2Jp3LVt/3c7EA9hMk5+5uR3JU2Rqz5dlymOthAAaj3Burpz4ZzVl54Hd1L2DKvGIsdE d5rzaXvFkrKtLhG8KCHnKCb4Wqzo3ZfVhPjvwA2w6SoU/SVQ9CoJpPO/d0z6246fhH8C6ZzmM8cr q0rUhl5llyORvjBjDUpFyYDCCy5wY3Jo0UK34wnWcB2jc85tyNTH3yLolizX3BUT58Us4ILbhf/X 2guonx++rjH3yiKd4yosUEn+w/5nr9MC2yz0XI0+0P9UotTUp3Hypnj8BBPmiOShoVnWVj6JPDCQ UiXm5rjGK96GIyzYbrTHDrI30jG6RhDYLJxtWCaCbGoc4H1JZvM6yCtPEDCnOCExO81vWmzkNuCh wp/kRZxXhbET8RaVDQ/ZFYcimqnPMeX5SdahyfAqWDs91jSmi8lTyiIE/JZmidv1HhXYKQh2ee3D vzeFVNEcUvvfUDkkZz6isZhoi1J9GDe7cgrjiuI30j84rZ71H98mHl/+B3pmXg6txE6lFgLW6DoQ sksbmuBQ66/fsR7oNKL/nOy9/4QeKh4pSrC59p3Bq3tgvFzEKi1FERXRM0PvQcAIqzMRk8DhJIgL QBS4SAGQehnSEjHbJC+DVqllaE2bmigFpWMOblkS42dp5vX6dUtTj6ToDIamdstoYZxg40phkh+a AnZA7pfoFir1Ul6RYYe9ksBKo6hcyWWlvlmbZEeXMpaAzqwT3sRUu9q8OH0GyXM1plrnqEm2OWyD sz82r6sf38uk/WSeFcavyrFoTPNssRegsHRH1uDn+VXmr9Xrr3MyF2d2hAKGA= X-QQ-XMRINFO: MSVp+SPm3vtSI1QTLgDHQqIV1w2oNKDqfg== X-OQ-MSGID: Subject: Re: [PATCH] drm/vkms: fix gamma LUT size check From: Renjun Wang To: Louis Chauvet , hamohammed.sa@gmail.com, simona@ffwll.ch, melissa.srw@gmail.com, maarten.lankhorst@linux.intel.com, mripard@kernel.org, tzimmermann@suse.de, airlied@gmail.com Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Date: Thu, 12 Feb 2026 23:04:28 +0800 In-Reply-To: <5ee4e72c-0862-40b3-b47b-70ca5d8f89c1@bootlin.com> References: <5ee4e72c-0862-40b3-b47b-70ca5d8f89c1@bootlin.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.56.2-0+deb13u1 MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Hi Louis, Actually for a 64-bit machine, the value of sizeof(struct drm_color_lut) and sizeof(struct drm_color_lut*) is equal. But for 32-bit machine, it is not equal. The definition of struct=C2=A0 drm_color_lut shown as follows: struct drm_color_lut { __u16 red; __u16 green; __u16 blue; __u16 reserved; } There is one test case in igt-gpu-tools for gamma, and the 32-bit machine test results shown as below: before patch: # IGT_FORCE_DRIVER=3Dvkms ./kms_color --run-subtest gamma [241590.953610] Console: switching to colour dummy device 80x25 [241590.955637] [IGT] kms_color: executing IGT-Version: 2.3-NO-GIT (riscv32) (Linux: 6.18.7 riscv32) Using IGT_SRANDOM=3D1770864024 for randomisation Opened device: /dev/dri/card0 [241590.966858] [IGT] kms_color: starting subtest gamma Starting subtest: gamma [241590.968030] [IGT] kms_color: starting dynamic subtest pipe-A- Virtual-1 Starting dynamic subtest: pipe-A-Virtual-1 (kms_color:235) igt_kms-CRITICAL: Test assertion failure function igt_pipe_commit, file ../lib/igt_kms.c:4212: (kms_color:235) igt_kms-CRITICAL: Failed assertion: ret =3D=3D 0 (kms_color:235) igt_kms-CRITICAL: Last errno: 22, Invalid argument (kms_color:235) igt_kms-CRITICAL: error: -22 !=3D 0 Stack trace: not implemented Dynamic subtest pipe-A-Virtual-1 failed. after patch: # uname -a Linux buildroot 6.18.7 #2 SMP Mon Feb 9 15:22:27 CST 2026 riscv32 GNU/Linux # pwd /usr/libexec/igt-gpu-tools # lsmod|grep vkms vkms 53248 0 drm_shmem_helper 20480 2 vkms drm_client_lib 12288 1 vkms drm_kms_helper 122880 3 vkms,drm_shmem_helper,drm_client_lib drm 458752 5 vkms,drm_shmem_helper,drm_client_lib,drm_kms_helper # IGT_FORCE_DRIVER=3Dvkms ./kms_color --run-subtest gamma [ 111.981381] Console: switching to colour dummy device 80x25 [ 111.983078] [IGT] kms_color: executing IGT-Version: 2.3-NO-GIT (riscv32) (Linux: 6.18.7 riscv32) Using IGT_SRANDOM=3D1770864535 for randomisation Opened device: /dev/dri/card0 [ 111.992250] [IGT] kms_color: starting subtest gamma Starting subtest: gamma [ 111.993166] [IGT] kms_color: starting dynamic subtest pipe-A- Virtual-1 Starting dynamic subtest: pipe-A-Virtual-1 Dynamic subtest pipe-A-Virtual-1: SUCCESS (7.498s) [ 119.492455] [IGT] kms_color: finished subtest pipe-A-Virtual-1, SUCCESS Subtest gamma: SUCCESS (7.501s) [ 119.495286] [IGT] kms_color: finished subtest gamma, SUCCESS [ 119.497233] [IGT] kms_color: exiting, ret=3D0 [ 119.517787] Console: switching to colour frame buffer device 128x48 Best Regards, Renjun Wang On Fri, 2026-02-06 at 14:53 +0100, Louis Chauvet wrote: >=20 >=20 > On 2/4/26 15:15, Renjun Wang wrote: > > vkms_atomic_check() computed the gamma LUT entry count using > > sizeof(struct drm_color_lut *), which uses pointer size and > > can incorrectly reject or accept LUT sizes. Use > > drm_color_lut_size() instead to validate against VKMS_LUT_SIZE. > >=20 > > Signed-off-by: Renjun Wang >=20 > Reviewed-by: Louis Chauvet >=20 > Like for the YUV patch, were you able to reproduce it using a tool? >=20 > > --- > > =C2=A0 drivers/gpu/drm/vkms/vkms_drv.c | 4 ++-- > > =C2=A0 1 file changed, 2 insertions(+), 2 deletions(-) > >=20 > > diff --git a/drivers/gpu/drm/vkms/vkms_drv.c > > b/drivers/gpu/drm/vkms/vkms_drv.c > > index dd1402f43773..a09589949f48 100644 > > --- a/drivers/gpu/drm/vkms/vkms_drv.c > > +++ b/drivers/gpu/drm/vkms/vkms_drv.c > > @@ -17,6 +17,7 @@ > > =C2=A0 #include > > =C2=A0 #include > > =C2=A0 #include > > +#include > > =C2=A0 #include > > =C2=A0 #include > > =C2=A0 #include > > @@ -111,8 +112,7 @@ static int vkms_atomic_check(struct drm_device > > *dev, struct drm_atomic_state *st > > =C2=A0=C2=A0 if (!new_crtc_state->gamma_lut || !new_crtc_state- > > >color_mgmt_changed) > > =C2=A0=C2=A0 continue; > > =C2=A0=20 > > - if (new_crtc_state->gamma_lut->length / > > sizeof(struct drm_color_lut *) > > - =C2=A0=C2=A0=C2=A0 > VKMS_LUT_SIZE) > > + if (drm_color_lut_size(new_crtc_state->gamma_lut) > > > VKMS_LUT_SIZE) > > =C2=A0=C2=A0 return -EINVAL; > > =C2=A0=C2=A0 } > > =C2=A0=20