Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Critical] Heap buffer overflow in `sink->dc_edid.raw_edid` due to mismatched bounds check when handling HF-EEODB EDID extensions. --
--- Patch [2]: [PATCH 2/2] drm/amd/display: Use drm_edid_block_count() instead of raw extensions --- commit 9d8e550a87693a10ec905e77e53d8e77319a53c9 Author: Timo Prömer <[email protected]> drm/amd/display: Use drm_edid_block_count() instead of raw extensions This commit replaces the manual EDID block count calculation with the core DRM helper drm_edid_block_count(). It aims to include possible HF-EEODB extension blocks that were previously truncated. > diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c > b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c > --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c > +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c [ ... ] > @@ -1224,7 +1225,9 @@ enum dc_edid_status dm_helpers_read_local_edid( > edid->extensions >= sizeof(sink->dc_edid.raw_edid) / > EDID_LENGTH) > return EDID_BAD_INPUT; > > - sink->dc_edid.length = EDID_LENGTH * (edid->extensions + 1); > + block_count = drm_edid_block_count(drm_edid); > + > + sink->dc_edid.length = EDID_LENGTH * block_count; > memmove(sink->dc_edid.raw_edid, (uint8_t *)edid, > sink->dc_edid.length); [Severity: Critical] Can this cause a heap buffer overflow when handling HF-EEODB extensions? Looking at dm_helpers_read_local_edid(), the bounds check right before this change still validates against the raw edid->extensions count: if (!edid || edid->extensions >= sizeof(sink->dc_edid.raw_edid) / EDID_LENGTH) return EDID_BAD_INPUT; If an EDID specifies a small edid->extensions count (e.g., 1) but an HF-EEODB overrides the block count to a much larger value (e.g., 32), the bounds check evaluates to 1 >= 16 and passes. The new logic then calculates a length based on the larger block_count returned by drm_edid_block_count() and passes it directly to memmove(). Since sink->dc_edid.raw_edid is a fixed-size buffer, does this result in copying more data than the buffer can safely hold? -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2
