Re: [PATCH v3 7/7] drm/amd/display: allow individual colorop changes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Potential NULL pointer dereference when accessing `blob->length` in `__set_dm_plane_colorop_3x4_matrix` if the data blob is NULL.
--

commit f99935be74382989d52703e3315aeec4d0efd059
Author: Melissa Wen <mwen@igalia.com>

drm/amd/display: allow individual colorop changes

Change all colorop helpers to get the committed state if there's no new
state for a given colorop. This allows userspace to modify a single
property of a colorop without resubmitting the whole color pipeline by
falling back to colorop settings from the committed state.

> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
> index 2d91d88a45742..51bd937153d41 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c

[ ... ]

> @@ -1561,43 +1550,37 @@ __set_dm_plane_colorop_3x4_matrix(struct drm_plane_state *plane_state,

[ ... ]

> +	if (colorop_state->bypass) {
> +		dc_plane_state->gamut_remap_matrix.enable_remap = false;
> +		dc_plane_state->input_csc_color_matrix.enable_adjustment = false;
> +		return 0;
> +	}
> +
> +	drm_dbg(dev, "3x4 matrix colorop with ID: %d\n", colorop->base.id);
> +	blob = colorop_state->data;
> +	if (blob->length == sizeof(struct drm_color_ctm_3x4)) {

[Severity: Critical]
This is a pre-existing issue, but could this lead to a NULL pointer 
dereference if the data blob is missing?

If userspace configures a 3x4 matrix colorop with bypass set to false but
doesn't provide a valid data blob, the DRM core might leave colorop_state->data
as NULL. Dereferencing blob->length here without checking if blob is valid
would then crash the system. 

Should __set_dm_plane_colorop_3x4_matrix() explicitly check if blob is not NULL
before attempting to access its length?

> +		ctm = (struct drm_color_ctm_3x4 *) blob->data;
> +		__drm_ctm_3x4_to_dc_matrix(ctm, dc_plane_state->gamut_remap_matrix.matrix);
> +		dc_plane_state->gamut_remap_matrix.enable_remap = true;
> +		dc_plane_state->input_csc_color_matrix.enable_adjustment = false;
> +	} else {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260609121230.1358786-1-mwen@igalia.com?part=7