tn3399_openwrt/target/linux/bcm27xx/patches-5.15/950-0571-drm-vc4-Validate-the-size-of-the-gamma_lut.patch

From 38ff187b7bb7524a6c8040c76889637068723f35 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.com>
Date: Wed, 10 Nov 2021 16:36:12 +0000
Subject: [PATCH] drm/vc4: Validate the size of the gamma_lut

Add a check to vc4_hvs_gamma_check to ensure a new non-empty
gamma LUT is of the correct length before accepting it.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
---
 drivers/gpu/drm/vc4/vc4_hvs.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/drivers/gpu/drm/vc4/vc4_hvs.c
+++ b/drivers/gpu/drm/vc4/vc4_hvs.c
@@ -561,6 +561,16 @@ static int vc4_hvs_gamma_check(struct dr
 	if (!crtc_state->color_mgmt_changed)
 		return 0;
 
+	if (crtc_state->gamma_lut) {
+		unsigned int len = drm_color_lut_size(crtc_state->gamma_lut);
+
+		if (len != crtc->gamma_size) {
+			DRM_DEBUG_KMS("Invalid LUT size; got %u, expected %u\n",
+				      len, crtc->gamma_size);
+			return -EINVAL;
+		}
+	}
+
 	connector = vc4_get_crtc_connector(crtc, crtc_state);
 	if (!connector)
 		return -EINVAL;