Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] drm/edid: off-by-one error in HF-VSDB payload length check skips QMS TFR flags --
commit f56b6e153864bbb4bece6ab04dc75e7a1bb4de03 Author: Nicolas Frattaroli <[email protected]> drm/edid: Parse QMS TFR min/max flags from HDMI SCDS HDMI has two flags in the SCDS EDID extension that signal which minimum and maximum refresh rate the sink wishes to use when doing QMS ("Quick Media Switching"). This commit adds definitions for these flags and parses them based on the publicly available libdisplay-info source code. The parsed QMS TFR min/max results are stored as booleans in drm_hdmi_info. > diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c > index 5a7d3b7e65daa..4fe754328b1c8 100644 > --- a/drivers/gpu/drm/drm_edid.c > +++ b/drivers/gpu/drm/drm_edid.c > @@ -6332,6 +6332,12 @@ static void drm_parse_vrr_info(struct drm_display_info > *info, const u8 *hf_scds) > if (!range->max_vfreq) > range->max_vfreq = (FIELD_GET(DRM_EDID_VRR_MAX_UPPER_MASK, > hf_scds[9]) << 8) | > hf_scds[10]; > + > + if (pld_len < 12) > + return; > + > + info->hdmi.qms_tfr_min = !!(hf_scds[11] & DRM_EDID_QMS_TFR_MIN); > + info->hdmi.qms_tfr_max = !!(hf_scds[11] & DRM_EDID_QMS_TFR_MAX); [Severity: Medium] Does this length check accidentally skip valid 11-byte payloads? In drm_parse_vrr_info(), cea_db_payload_len(hf_scds) returns the exact number of payload bytes declared in the EDID block header. In the CTA-861 data block representation, payload bytes are located at array indices 1 through pld_len. When pld_len is 11, hf_scds[11] is a valid access to the last payload byte. However, the if (pld_len < 12) check evaluates to true and returns early, incorrectly skipping the parsing of the QMS TFR min/max flags for displays that advertise them in a block with exactly 11 bytes of payload. > } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=16
