<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/gpu/drm/amd/display/amdgpu_dm, branch master</title>
<subtitle>Linux kernel source tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/'/>
<entry>
<title>Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux</title>
<updated>2026-09-06T03:45:18+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-09-06T03:45:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=1fc5a74b108fc90951890ec513ac81869f5eaff1'/>
<id>1fc5a74b108fc90951890ec513ac81869f5eaff1</id>
<content type='text'>
Pull kmalloc_obj conversions from Kees Cook:
 "Another run of the Coccinelle script for converting kmalloc()
  family of allocations to kmalloc_obj() via the existing rules
  in scripts/coccinelle/api/kmalloc_objs.cocci"

* tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  treewide: refresh kmalloc_obj() conversions
  drm/amd/display: Fix harmless type mismatch in allocation
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull kmalloc_obj conversions from Kees Cook:
 "Another run of the Coccinelle script for converting kmalloc()
  family of allocations to kmalloc_obj() via the existing rules
  in scripts/coccinelle/api/kmalloc_objs.cocci"

* tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  treewide: refresh kmalloc_obj() conversions
  drm/amd/display: Fix harmless type mismatch in allocation
</pre>
</div>
</content>
</entry>
<entry>
<title>treewide: refresh kmalloc_obj() conversions</title>
<updated>2026-09-05T04:37:00+00:00</updated>
<author>
<name>Kees Cook</name>
<email>kees+treewide@kernel.org</email>
</author>
<published>2026-09-02T22:31:14+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=3a2c4d55e32ad65efebdb6de44eef3bfa08bb49d'/>
<id>3a2c4d55e32ad65efebdb6de44eef3bfa08bb49d</id>
<content type='text'>
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci

This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.

Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.

Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook &lt;kees+treewide@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci

This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.

Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.

Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook &lt;kees+treewide@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'amd-drm-fixes-7.3-2026-09-03' of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes</title>
<updated>2026-09-04T10:34:31+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2026-09-04T07:04:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=7f78fe856eb64723c436c636a1479c27608aaced'/>
<id>7f78fe856eb64723c436c636a1479c27608aaced</id>
<content type='text'>
amd-drm-fixes-7.3-2026-09-03:

amdgpu:
- SR-IOV fix
- GFX8 fix
- MES queue reset fix
- GPUVM fixes
- DCN 6 warning fix
- DCN 3.5/3.6 fix
- DML fix
- Backlight fix
- Colorop fix
- DC get_estimated_bw() fix
- devcoredump fix
- Userq fixes
- APU PSP fix
- Cursor fix

amdkfd:
- MES queue eviction fix
- MQD debugfs fix

UAPI:
- Fix for drm_amdgpu_info_device with mixed 64 bit kernel and 32 bit userspace

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Link: https://patch.msgid.link/20260903174712.584320-1-alexander.deucher@amd.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
amd-drm-fixes-7.3-2026-09-03:

amdgpu:
- SR-IOV fix
- GFX8 fix
- MES queue reset fix
- GPUVM fixes
- DCN 6 warning fix
- DCN 3.5/3.6 fix
- DML fix
- Backlight fix
- Colorop fix
- DC get_estimated_bw() fix
- devcoredump fix
- Userq fixes
- APU PSP fix
- Cursor fix

amdkfd:
- MES queue eviction fix
- MQD debugfs fix

UAPI:
- Fix for drm_amdgpu_info_device with mixed 64 bit kernel and 32 bit userspace

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Link: https://patch.msgid.link/20260903174712.584320-1-alexander.deucher@amd.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/amd/display: use plane color_mgmt_changed to track colorop changes</title>
<updated>2026-09-03T07:11:28+00:00</updated>
<author>
<name>Melissa Wen</name>
<email>mwen@igalia.com</email>
</author>
<published>2026-08-07T11:56:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=88f8113ab118ed0e187331324d6b60c694b2e0e2'/>
<id>88f8113ab118ed0e187331324d6b60c694b2e0e2</id>
<content type='text'>
This is a resubmission of commit d79716401a95 ("drm/amd/display: use
plane color_mgmt_changed to track colorop changes") whose change was
reverted by commit 0461ba9a7994 ("Merge tag 'amd-drm-next-7.3-2026-07-02'
of https://gitlab.freedesktop.org/agd5f/linux into drm-next") during a
merge conflict resolution.

Original commit message:

```
Ensure the driver tracks changes in any colorop property of a plane
color pipeline by using the same mechanism of CRTC color management and
update plane color blocks when any colorop property changes. It fixes an
issue observed on gamescope settings for night mode which is done via
shaper/3D-LUT updates.
```

Fixes: 0461ba9a7994 ("Merge tag 'amd-drm-next-7.3-2026-07-02' of https://gitlab.freedesktop.org/agd5f/linux into drm-next")
Acked-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Signed-off-by: Melissa Wen &lt;mwen@igalia.com&gt;
Link: https://patch.msgid.link/20260807115712.22423-1-mwen@igalia.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This is a resubmission of commit d79716401a95 ("drm/amd/display: use
plane color_mgmt_changed to track colorop changes") whose change was
reverted by commit 0461ba9a7994 ("Merge tag 'amd-drm-next-7.3-2026-07-02'
of https://gitlab.freedesktop.org/agd5f/linux into drm-next") during a
merge conflict resolution.

Original commit message:

```
Ensure the driver tracks changes in any colorop property of a plane
color pipeline by using the same mechanism of CRTC color management and
update plane color blocks when any colorop property changes. It fixes an
issue observed on gamescope settings for night mode which is done via
shaper/3D-LUT updates.
```

Fixes: 0461ba9a7994 ("Merge tag 'amd-drm-next-7.3-2026-07-02' of https://gitlab.freedesktop.org/agd5f/linux into drm-next")
Acked-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Signed-off-by: Melissa Wen &lt;mwen@igalia.com&gt;
Link: https://patch.msgid.link/20260807115712.22423-1-mwen@igalia.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/amd/display: Fix backlight control for luminance-capable OLED</title>
<updated>2026-09-02T20:51:47+00:00</updated>
<author>
<name>Roman Li</name>
<email>Roman.Li@amd.com</email>
</author>
<published>2026-08-21T16:19:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=5a67d2e055897a36acb4e48082986fb4a4eebdd3'/>
<id>5a67d2e055897a36acb4e48082986fb4a4eebdd3</id>
<content type='text'>
[WHY]
For some eDP panels VESA aux backlight control is necessary,
otherwise they stay black.

[HOW]
When AUX backlight control is used, select BACKLIGHT_CONTROL_VESA_AUX for
panels that advertise panel_luminance_control.

Reviewed-by: Hansen Dsouza &lt;hansen.dsouza@amd.com&gt;
Signed-off-by: Roman Li &lt;Roman.Li@amd.com&gt;
Signed-off-by: Alex Hung &lt;alex.hung@amd.com&gt;
Tested-by: Dan Wheeler &lt;daniel.wheeler@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
(cherry picked from commit 42f698bd061d76d5f4c84a195e465cfbeec775e4)
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[WHY]
For some eDP panels VESA aux backlight control is necessary,
otherwise they stay black.

[HOW]
When AUX backlight control is used, select BACKLIGHT_CONTROL_VESA_AUX for
panels that advertise panel_luminance_control.

Reviewed-by: Hansen Dsouza &lt;hansen.dsouza@amd.com&gt;
Signed-off-by: Roman Li &lt;Roman.Li@amd.com&gt;
Signed-off-by: Alex Hung &lt;alex.hung@amd.com&gt;
Tested-by: Dan Wheeler &lt;daniel.wheeler@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
(cherry picked from commit 42f698bd061d76d5f4c84a195e465cfbeec775e4)
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/amd/display: advertise PIXEL_NONE and PREMULTI blend mode for DCE</title>
<updated>2026-09-02T18:42:25+00:00</updated>
<author>
<name>Melissa Wen</name>
<email>mwen@igalia.com</email>
</author>
<published>2026-08-26T10:37:07+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=332ad707e38fb82dd998b4d0782c15579e5784f1'/>
<id>332ad707e38fb82dd998b4d0782c15579e5784f1</id>
<content type='text'>
DCE can support PREMULTI and COVERAGE blend mode depending on its
generation, however current driver implementation either doesn't expose
more than primary and cursor plane, or doesn't program registers for any
blend mode other than PIXEL_NONE. To fix the missing-blend-mode-prop
warning according to current DCE plane caps, create blend mode property
with PIXEL_NONE and PREMULTI for primary planes. As long as the
background is black and there is no overlay plane, PIXEL_NONE and
PREMULTI are equivalent, and PREMULTI has been the mandatory/default
mode for years, so keep it to avoid regressions.

Fixes: 860e748bddcc ("drm: ensure blend mode supported if pixel format with alpha exposed")
Tested-by: Viktor Jägersküpper &lt;viktor_jaegerskuepper@freenet.de&gt;
Tested-by: Dan Wheeler &lt;daniel.wheeler@amd.com&gt; #v3
Reviewed-by: Timur Kristóf &lt;timur.kristof@gmail.com&gt;
Reviewed-by: Alex Hung &lt;alex.hung@amd.com&gt;
Reviewed-by: Leandro Ribeiro &lt;leandro.ribeiro@collabora.com&gt; #v2
Signed-off-by: Melissa Wen &lt;mwen@igalia.com&gt;
Link: https://patch.msgid.link/20260826104143.39077-4-mwen@igalia.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
DCE can support PREMULTI and COVERAGE blend mode depending on its
generation, however current driver implementation either doesn't expose
more than primary and cursor plane, or doesn't program registers for any
blend mode other than PIXEL_NONE. To fix the missing-blend-mode-prop
warning according to current DCE plane caps, create blend mode property
with PIXEL_NONE and PREMULTI for primary planes. As long as the
background is black and there is no overlay plane, PIXEL_NONE and
PREMULTI are equivalent, and PREMULTI has been the mandatory/default
mode for years, so keep it to avoid regressions.

Fixes: 860e748bddcc ("drm: ensure blend mode supported if pixel format with alpha exposed")
Tested-by: Viktor Jägersküpper &lt;viktor_jaegerskuepper@freenet.de&gt;
Tested-by: Dan Wheeler &lt;daniel.wheeler@amd.com&gt; #v3
Reviewed-by: Timur Kristóf &lt;timur.kristof@gmail.com&gt;
Reviewed-by: Alex Hung &lt;alex.hung@amd.com&gt;
Reviewed-by: Leandro Ribeiro &lt;leandro.ribeiro@collabora.com&gt; #v2
Signed-off-by: Melissa Wen &lt;mwen@igalia.com&gt;
Link: https://patch.msgid.link/20260826104143.39077-4-mwen@igalia.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/amd/display: fix missing blend-mode-prop warning for DCN</title>
<updated>2026-09-02T18:42:08+00:00</updated>
<author>
<name>Melissa Wen</name>
<email>mwen@igalia.com</email>
</author>
<published>2026-08-26T10:37:06+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=f0c75da0a6b4084e00cd6faefebcc976ffaccf52'/>
<id>f0c75da0a6b4084e00cd6faefebcc976ffaccf52</id>
<content type='text'>
validate_blend_mode_for_alpha_formats() warns when a plane supports
formats with alpha but doesn't expose the blend mode property. Fix this
by adding the same overlay plane blend modes to primary plane, since
they are all universal planes in DCN-generation. Cursor planes support
ARGB8888 format and CURSOR_MODE_COLOR_PRE_MULTIPLIED_ALPHA is set by
default (other color formats are not implemented), so only expose
support to PREMULTI, which is the default blend mode on DRM.

Fixes: 860e748bddcc ("drm: ensure blend mode supported if pixel format with alpha exposed")
Tested-by: Mikhail Gavrilov &lt;mikhail.v.gavrilov@gmail.com&gt;
Tested-by: Dan Wheeler &lt;daniel.wheeler@amd.com&gt;
Reviewed-by: Timur Kristóf &lt;timur.kristof@gmail.com&gt;
Reviewed-by: Alex Hung &lt;alex.hung@amd.com&gt;
Reviewed-by: Leandro Ribeiro &lt;leandro.ribeiro@collabora.com&gt;
Signed-off-by: Melissa Wen &lt;mwen@igalia.com&gt;
Link: https://patch.msgid.link/20260826104143.39077-3-mwen@igalia.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
validate_blend_mode_for_alpha_formats() warns when a plane supports
formats with alpha but doesn't expose the blend mode property. Fix this
by adding the same overlay plane blend modes to primary plane, since
they are all universal planes in DCN-generation. Cursor planes support
ARGB8888 format and CURSOR_MODE_COLOR_PRE_MULTIPLIED_ALPHA is set by
default (other color formats are not implemented), so only expose
support to PREMULTI, which is the default blend mode on DRM.

Fixes: 860e748bddcc ("drm: ensure blend mode supported if pixel format with alpha exposed")
Tested-by: Mikhail Gavrilov &lt;mikhail.v.gavrilov@gmail.com&gt;
Tested-by: Dan Wheeler &lt;daniel.wheeler@amd.com&gt;
Reviewed-by: Timur Kristóf &lt;timur.kristof@gmail.com&gt;
Reviewed-by: Alex Hung &lt;alex.hung@amd.com&gt;
Reviewed-by: Leandro Ribeiro &lt;leandro.ribeiro@collabora.com&gt;
Signed-off-by: Melissa Wen &lt;mwen@igalia.com&gt;
Link: https://patch.msgid.link/20260826104143.39077-3-mwen@igalia.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/amd/display: fix dc_lock leak on GPU reset error paths</title>
<updated>2026-08-25T22:24:30+00:00</updated>
<author>
<name>Linkai Gong</name>
<email>gonglinkai@kylinos.cn</email>
</author>
<published>2026-08-19T05:47:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=92a9eebd2a1f892fe482154d83f9f1626bc73d3b'/>
<id>92a9eebd2a1f892fe482154d83f9f1626bc73d3b</id>
<content type='text'>
On GPU reset, dm_suspend() takes dc_lock and leaves it for dm_resume()
to drop. If amdgpu_dm_commit_zero_streams() or dm_dmub_hw_init() fails,
the function returns with the lock still held. The matching resume path
is then skipped, so every later dc_lock take hangs.

Release the cached DC state and unlock before returning the error.

Fixes: 3cf7a0bc87f0 ("drm/amd/display: Catch failures for amdgpu_dm_commit_zero_streams()")
Fixes: 2b6943df5413 ("drm/amd/display: Pass up errors for reset GPU that fails to init HW")
Cc: stable@vger.kernel.org
Signed-off-by: Linkai Gong &lt;gonglinkai@kylinos.cn&gt;
Reviewed-by: Mario Limonciello &lt;mario.limonciello@amd.com&gt;
Signed-off-by: Mario Limonciello &lt;mario.limonciello@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
On GPU reset, dm_suspend() takes dc_lock and leaves it for dm_resume()
to drop. If amdgpu_dm_commit_zero_streams() or dm_dmub_hw_init() fails,
the function returns with the lock still held. The matching resume path
is then skipped, so every later dc_lock take hangs.

Release the cached DC state and unlock before returning the error.

Fixes: 3cf7a0bc87f0 ("drm/amd/display: Catch failures for amdgpu_dm_commit_zero_streams()")
Fixes: 2b6943df5413 ("drm/amd/display: Pass up errors for reset GPU that fails to init HW")
Cc: stable@vger.kernel.org
Signed-off-by: Linkai Gong &lt;gonglinkai@kylinos.cn&gt;
Reviewed-by: Mario Limonciello &lt;mario.limonciello@amd.com&gt;
Signed-off-by: Mario Limonciello &lt;mario.limonciello@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/amd/display: Log details when failing to register HPD IRQ</title>
<updated>2026-08-25T22:21:24+00:00</updated>
<author>
<name>Timur Kristóf</name>
<email>timur.kristof@gmail.com</email>
</author>
<published>2026-08-21T21:50:59+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=9e8bcfde0039238e904b4e720e66b7f4fbf82c0e'/>
<id>9e8bcfde0039238e904b4e720e66b7f4fbf82c0e</id>
<content type='text'>
This should help diagnose HPD IRQ related issues in the future.

Signed-off-by: Timur Kristóf &lt;timur.kristof@gmail.com&gt;
Reviewed-by: Mario Limonciello (AMD) &lt;superm1@kernel.org&gt;
Link: https://patch.msgid.link/20260821215059.312868-2-timur.kristof@gmail.com
Signed-off-by: Mario Limonciello &lt;mario.limonciello@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This should help diagnose HPD IRQ related issues in the future.

Signed-off-by: Timur Kristóf &lt;timur.kristof@gmail.com&gt;
Reviewed-by: Mario Limonciello (AMD) &lt;superm1@kernel.org&gt;
Link: https://patch.msgid.link/20260821215059.312868-2-timur.kristof@gmail.com
Signed-off-by: Mario Limonciello &lt;mario.limonciello@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/amd/display: validate plane degamma LUT size for private color prop</title>
<updated>2026-08-19T14:14:55+00:00</updated>
<author>
<name>Harry Wentland</name>
<email>harry.wentland@amd.com</email>
</author>
<published>2026-08-04T21:04:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=e4c3ab59021e7c146a84b6671f0d530972bd58b4'/>
<id>e4c3ab59021e7c146a84b6671f0d530972bd58b4</id>
<content type='text'>
Unlike the CRTC degamma path, which is guarded by
amdgpu_dm_verify_lut_sizes(), the per-plane degamma LUT size was never
validated before use. __set_dm_plane_degamma() passed the user-supplied
size straight into __is_lut_linear() and, for a non-linear LUT, into
__set_input_tf() -&gt; __drm_lut_to_dc_gamma(), the latter always iterating
MAX_COLOR_LUT_ENTRIES entries regardless of the actual LUT size.

A malformed AMD_PLANE_DEGAMMA_LUT blob (e.g. a single entry) could thus
trigger a divide-by-zero in __is_lut_linear() or an out-of-bounds read in
__drm_lut_to_dc_gamma(). Reject any plane degamma LUT whose size does not
match MAX_COLOR_LUT_ENTRIES, mirroring the invariant the code already
asserts a few lines below (and which the CRTC path enforces).

The AMD_PLANE_DEGAMMA_LUT property is only exposed on builds with
AMD_PRIVATE_COLOR defined.

Fixes: 980f8710075a ("drm/amd/display: add plane degamma TF and LUT support")
Cc: stable@vger.kernel.org
Signed-off-by: Harry Wentland &lt;harry.wentland@amd.com&gt;
Reviewed-by: Melissa Wen &lt;mwen@igalia.com&gt;
Tested-by: Daniel Wheeler &lt;daniel.wheeler@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Unlike the CRTC degamma path, which is guarded by
amdgpu_dm_verify_lut_sizes(), the per-plane degamma LUT size was never
validated before use. __set_dm_plane_degamma() passed the user-supplied
size straight into __is_lut_linear() and, for a non-linear LUT, into
__set_input_tf() -&gt; __drm_lut_to_dc_gamma(), the latter always iterating
MAX_COLOR_LUT_ENTRIES entries regardless of the actual LUT size.

A malformed AMD_PLANE_DEGAMMA_LUT blob (e.g. a single entry) could thus
trigger a divide-by-zero in __is_lut_linear() or an out-of-bounds read in
__drm_lut_to_dc_gamma(). Reject any plane degamma LUT whose size does not
match MAX_COLOR_LUT_ENTRIES, mirroring the invariant the code already
asserts a few lines below (and which the CRTC path enforces).

The AMD_PLANE_DEGAMMA_LUT property is only exposed on builds with
AMD_PRIVATE_COLOR defined.

Fixes: 980f8710075a ("drm/amd/display: add plane degamma TF and LUT support")
Cc: stable@vger.kernel.org
Signed-off-by: Harry Wentland &lt;harry.wentland@amd.com&gt;
Reviewed-by: Melissa Wen &lt;mwen@igalia.com&gt;
Tested-by: Daniel Wheeler &lt;daniel.wheeler@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
