[PATCH 0/1] drm/blend: size zpos array to active planes instead of total

[PATCH 0/1] drm/blend: size zpos array to active planes instead of total

[Gustavo Piaz Da Silva]

drm_atomic_helper_crtc_normalize_zpos() allocates a temporary
array sized by dev->mode_config.num_total_plane, which counts
all planes registered on the device. The function only operates
on planes active on the given CRTC, as described by
crtc_state->plane_mask.

Replace num_total_plane with hweight32(crtc_state->plane_mask)
to size the allocation to exactly the planes being processed.

Gustavo Piaz Da Silva (1):
  drm/blend: size zpos array to active planes instead of total

 drivers/gpu/drm/drm_blend.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.43.0

[PATCH 1/1] drm/blend: size zpos array to active planes instead of total

[Gustavo Piaz Da Silva]

drm_atomic_helper_crtc_normalize_zpos() allocates a temporary
array with num_total_plane entries, which is the total number of
planes registered across the entire DRM device. However, the
function only processes planes active on the given CRTC, as
described by crtc_state->plane_mask.

Replace num_total_plane with hweight32(crtc_state->plane_mask),
which counts exactly the planes that drm_for_each_plane_mask will
visit. This ensures the allocation is sized precisely for the work
being done, reducing memory pressure on devices where
num_total_plane is significantly larger than the number of active
planes per CRTC.

Signed-off-by: Gustavo Piaz Da Silva <gustavopiazdasilva2102@gmail.com>
---
 drivers/gpu/drm/drm_blend.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_blend.c b/drivers/gpu/drm/drm_blend.c
index 1f3af27d2418e..ffa1870528726 100644
--- a/drivers/gpu/drm/drm_blend.c
+++ b/drivers/gpu/drm/drm_blend.c
@@ -465,7 +465,7 @@ static int drm_atomic_helper_crtc_normalize_zpos(struct drm_crtc *crtc,
 {
 	struct drm_atomic_state *state = crtc_state->state;
 	struct drm_device *dev = crtc->dev;
-	int total_planes = dev->mode_config.num_total_plane;
+	int total_planes = hweight32(crtc_state->plane_mask);
 	struct drm_plane_state **states;
 	struct drm_plane *plane;
 	int i, n = 0;
-- 
2.43.0

Claude review: drm/blend: size zpos array to active planes instead of total

[Claude Code Review Bot]

Overall Series Review

Subject: drm/blend: size zpos array to active planes instead of total
Author: Gustavo Piaz Da Silva <gustavopiazdasilva2102@gmail.com>
Patches: 2
Reviewed: 2026-05-05T09:43:21.243447

---

This is a single-patch series that reduces the allocation size of a temporary array in `drm_atomic_helper_crtc_normalize_zpos()` from `num_total_plane` (all planes on the device) to `hweight32(crtc_state->plane_mask)` (only the active planes on the given CRTC).

The change is **correct**. The `drm_for_each_plane_mask()` loop iterates exactly over the bits set in `plane_mask`, so `hweight32(plane_mask)` gives the precise count of array entries that will be populated. The original allocation was safe but conservatively oversized.

That said, the practical benefit is minimal. A typical device might have 3-8 total planes, and each array entry is a single pointer (8 bytes on 64-bit). The savings are on the order of a handful of bytes per CRTC atomic commit — not meaningful "memory pressure." The real value is arguably in making the code more self-documenting: the allocation size now directly reflects the iteration count.

**One potential issue worth flagging:** `plane_mask` is `u32` (confirmed at `include/drm/drm_crtc.h:195`), so `hweight32()` is type-correct today. However, if `plane_mask` were ever widened (e.g., to `u64` for devices with >32 planes), the `hweight32()` call would silently truncate and produce an undersized allocation, causing an out-of-bounds write at line 492:

```c
states[n++] = plane_state;
```

This is not a bug today, but it is a latent fragility the original code didn't have. Using `hweight_long()` or adding a `BUILD_BUG_ON(sizeof(crtc_state->plane_mask) > sizeof(u32))` would harden against that future scenario.

---

---
Generated by Claude Code Patch Reviewer

Claude review: drm/blend: size zpos array to active planes instead of total

[Claude Code Review Bot]

Patch Review

**Correctness:** The change is correct. Walking the function at `drm_blend.c:463-511`:

- `total_planes = hweight32(crtc_state->plane_mask)` — counts exactly the bits set in the mask.
- `kmalloc_objs(*states, total_planes)` at line 477 — allocates that many entries.
- `drm_for_each_plane_mask(plane, dev, crtc_state->plane_mask)` at line 485 — iterates exactly over those same bits.
- `states[n++] = plane_state` at line 492 — `n` will reach exactly `total_planes` (assuming no early error exit), so no overrun.

The zero-planes edge case (`plane_mask == 0`) is also fine: `kmalloc_array(0, ...)` returns `ZERO_SIZE_PTR` (non-NULL), the loop body never executes, `sort` and the for-loop with `n=0` are no-ops, and `kfree(ZERO_SIZE_PTR)` is valid.

**Suggested improvement:** Consider using `hweight_long()` or a type-matched weight function instead of `hweight32()` to avoid a silent truncation bug if `plane_mask` is ever widened beyond `u32`:

```c
-	int total_planes = hweight32(crtc_state->plane_mask);
+	int total_planes = hweight_long(crtc_state->plane_mask);
```

Or alternatively, add a static assertion:

```c
BUILD_BUG_ON(sizeof(crtc_state->plane_mask) != sizeof(u32));
```

**Commit message:** The commit message is well written and clearly explains both the problem and the solution. The claim about "reducing memory pressure" is a bit strong for what amounts to saving a few pointers per atomic commit — "tightens the allocation" or "avoids over-allocation" would be more proportionate.

**Verdict:** Correct, low-risk change. Worth applying, ideally with `hweight_long()` for future-proofing.

---
Generated by Claude Code Patch Reviewer