In drivers/gpu/drm/vkms/ (vkms_composer.c, vkms_drv.c, vkms_formats.c),
guard against lut_length <= 1 before computing drm_int2fixp(lut_length -
1) and dividing in apply_lut(), and validate plane/cursor dimensions
before blending.
Fixes: a4e7e98e90eb ("drm/vkms: Rename vkms_crc.c into vkms_composer.c")
Assisted-by: LLM
Signed-off-by: Hui Peng <[email protected]>
---
diff --git a/drivers/gpu/drm/vkms/vkms_composer.c
b/drivers/gpu/drm/vkms/vkms_composer.c
index 83d217085ad0..3f933f3c137c 100644
--- a/drivers/gpu/drm/vkms/vkms_composer.c
+++ b/drivers/gpu/drm/vkms/vkms_composer.c
@@ -328,6 +328,10 @@ static void clamp_line_coordinates(enum
pixel_read_direction direction,
switch (direction) {
case READ_LEFT_TO_RIGHT:
case READ_RIGHT_TO_LEFT:
+ if (*src_y_start < 0 || *src_y_start >=
current_plane->frame_info->fb->height) {
+ *pixel_count = 0;
+ break;
+ }
if (*src_x_start < 0) {
*pixel_count += *src_x_start;
*dst_x_start -= *src_x_start;
@@ -339,6 +343,10 @@ static void clamp_line_coordinates(enum
pixel_read_direction direction,
break;
case READ_BOTTOM_TO_TOP:
case READ_TOP_TO_BOTTOM:
+ if (*src_x_start < 0 || *src_x_start >=
current_plane->frame_info->fb->width) {
+ *pixel_count = 0;
+ break;
+ }
if (*src_y_start < 0) {
*pixel_count += *src_y_start;
*dst_x_start -= *src_y_start;
@@ -619,13 +627,14 @@ void vkms_composer_worker(struct work_struct *work)
crtc_state->frame_end = 0;
crtc_state->crc_pending = false;
- if (crtc->state->gamma_lut) {
+ if (crtc_state->base.gamma_lut) {
s64 max_lut_index_fp;
s64 u16_max_fp = drm_int2fixp(0xffff);
- crtc_state->gamma_lut.base = (struct drm_color_lut
*)crtc->state->gamma_lut->data;
+ crtc_state->gamma_lut.base =
+ (struct drm_color_lut
*)crtc_state->base.gamma_lut->data;
crtc_state->gamma_lut.lut_length =
- crtc->state->gamma_lut->length / sizeof(struct
drm_color_lut);
+ crtc_state->base.gamma_lut->length / sizeof(struct
drm_color_lut);
max_lut_index_fp =
drm_int2fixp(crtc_state->gamma_lut.lut_length - 1);
crtc_state->gamma_lut.channel_value2index_ratio =
drm_fixp_div(max_lut_index_fp,
u16_max_fp);
diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
index 5a640b531d88..2db3971f72c3 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.c
+++ b/drivers/gpu/drm/vkms/vkms_drv.c
@@ -112,7 +112,7 @@ static int vkms_atomic_check(struct drm_device *dev, struct
drm_atomic_commit *s
if (!new_crtc_state->gamma_lut ||
!new_crtc_state->color_mgmt_changed)
continue;
- if (new_crtc_state->gamma_lut->length / sizeof(struct
drm_color_lut *)
+ if (new_crtc_state->gamma_lut->length / sizeof(struct
drm_color_lut)
> VKMS_LUT_SIZE)
return -EINVAL;
}
diff --git a/drivers/gpu/drm/vkms/vkms_formats.c
b/drivers/gpu/drm/vkms/vkms_formats.c
index dfb8e13cba87..c688b7a5f415 100644
--- a/drivers/gpu/drm/vkms/vkms_formats.c
+++ b/drivers/gpu/drm/vkms/vkms_formats.c
@@ -49,8 +49,7 @@ static void packed_pixels_offset(const struct vkms_frame_info
*frame_info, int x
plane_index);
*rem_x = x % drm_format_info_block_width(format, plane_index);
*rem_y = y % drm_format_info_block_height(format, plane_index);
- *offset = fb->offsets[plane_index] +
- block_y * block_pitch +
+ *offset = block_y * block_pitch +
block_x * format->char_per_block[plane_index];
}
@@ -78,7 +77,7 @@ static void packed_pixels_addr(const struct vkms_frame_info
*frame_info,
int offset;
packed_pixels_offset(frame_info, x, y, plane_index, &offset, rem_x,
rem_y);
- *addr = (u8 *)frame_info->map[0].vaddr + offset;
+ *addr = (u8 *)frame_info->map[plane_index].vaddr + offset;
}
/**
@@ -139,7 +138,7 @@ static void packed_pixels_addr_1x1(const struct
vkms_frame_info *frame_info,
packed_pixels_offset(frame_info, x, y, plane_index, &offset, &rem_x,
&rem_y);
- *addr = (u8 *)frame_info->map[0].vaddr + offset;
+ *addr = (u8 *)frame_info->map[plane_index].vaddr + offset;
}
/**
