Re: [PATCH 2/2] drm/i915/color: Add YUV buffer support on HDR planes

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Adding INTEL_PLANE_CB_CSC_FF to the color pipeline arrays increases their size beyond the MAX_COLOROP limit, causing a stack buffer overflow.
--

--- Patch [2]: [PATCH 2/2] drm/i915/color: Add YUV buffer support on HDR planes ---
commit 659bb21b3ebb587a758df27788a2ccbde4332e70
Author: Chaitanya Kumar Borah <[email protected]>

drm/i915/color: Add YUV buffer support on HDR planes

This commit adds the INTEL_PLANE_CB_CSC_FF (fixed function CSC) color
block as the first stage for HDR planes to enable YUV-to-RGB color space
conversion. It also updates the CSC programming logic to account for the
color pipeline programming.

> diff --git a/drivers/gpu/drm/i915/display/intel_color_pipeline.c b/drivers/gpu/drm/i915/display/intel_color_pipeline.c
> index 38cfd6ed585d0..3f76b8d80430b 100644
> --- a/drivers/gpu/drm/i915/display/intel_color_pipeline.c
> +++ b/drivers/gpu/drm/i915/display/intel_color_pipeline.c
> @@ -31,6 +31,7 @@ static const struct drm_colorop_funcs intel_colorop_funcs = {
>   * the pipeline totally unusable.
>   */
>  static const enum intel_color_block xe3plpd_primary_plane_pipeline[] = {
> +	INTEL_PLANE_CB_CSC_FF,
>  	INTEL_PLANE_CB_PRE_CSC_LUT,
>  	INTEL_PLANE_CB_CSC,
>  	INTEL_PLANE_CB_3DLUT,
> @@ -38,6 +39,7 @@ static const enum intel_color_block xe3plpd_primary_plane_pipeline[] = {
>  };

[Severity: Critical]
By adding this element, xe3plpd_primary_plane_pipeline now has 5 elements.
However, MAX_COLOROP is still defined as 4 in this file.

When initializing the pipeline in _intel_color_pipeline_plane_init(), the local
colorop array is sized using MAX_COLOROP:

	struct intel_colorop *colorop[MAX_COLOROP];
	...
	if (plane_has_3dlut(display, pipe, plane)) {
		pipeline = xe3plpd_primary_plane_pipeline;
		pipeline_len = ARRAY_SIZE(xe3plpd_primary_plane_pipeline);
	}
	...
	for (i = 0; i < pipeline_len; i++) {
		colorop[i] = intel_color_pipeline_plane_add_colorop(plane, prev,
								    pipeline[i]);

Since pipeline_len evaluates to 5 for xe3plpd_primary_plane_pipeline, does this
loop overflow the colorop[] stack array on the final iteration?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2