Gamma LUT size is being computed wrongly, dividing blob size by sizeof(struct drm_color_lut *). But the blob is an array of struct drm_color_lut.
Replace sizeof(struct drm_color_lut *) with sizeof(struct drm_color_lut), properly validating the userspace gamma LUT size. Issue caught by Sashiko bot: https://sashiko.dev/#/patchset/[email protected]?part=1 Reported-by: Sashiko <[email protected]> Reviewed-by: Robert Mader <[email protected]> Tested-by: Robert Mader <[email protected]> Signed-off-by: Leandro Ribeiro <[email protected]> --- drivers/gpu/drm/vkms/vkms_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c index 86a8a95694fd..28b99511f186 100644 --- a/drivers/gpu/drm/vkms/vkms_drv.c +++ b/drivers/gpu/drm/vkms/vkms_drv.c @@ -112,7 +112,7 @@ static int vkms_atomic_check(struct drm_device *dev, struct drm_atomic_commit *s if (!new_crtc_state->gamma_lut || !new_crtc_state->color_mgmt_changed) continue; - if (new_crtc_state->gamma_lut->length / sizeof(struct drm_color_lut *) + if (new_crtc_state->gamma_lut->length / sizeof(struct drm_color_lut) > VKMS_GAMMA_LUT_SIZE) return -EINVAL; } -- 2.56.0
