[PATCH 0/2] drm/amd/display: Fix missing HF-EEODB blocks in EDID copies

[PATCH 0/2] drm/amd/display: Fix missing HF-EEODB blocks in EDID copies

[Timo Prömer]

Fix an issue in amd/display where devices with HF-EEODB blocks would 
be missing these additional blocks during EDID reads.

The driver previously used `edid->extensions + 1` to calculate the 
number of blocks to copy, but the base extension flag does not include 
HF-EEODB blocks.

Use drm_edid_block_count() directly to get the true number of blocks, 
ensuring that HF-EEODB blocks are properly copied.

Timo Prömer (2):
  drm/edid: Export drm_edid_block_count()
  drm/amd/display: Use drm_edid_block_count() instead of raw extensions

 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 5 ++++-
 drivers/gpu/drm/drm_edid.c                                | 3 ++-
 include/drm/drm_edid.h                                    | 1 +
 3 files changed, 7 insertions(+), 2 deletions(-)

-- 
2.55.0

[PATCH 1/2] drm/edid: Export drm_edid_block_count()

[Timo Prömer]

Drivers currently calculating EDID size by reading the `extensions`
field of the raw EDID structure (e.g., `edid->extensions + 1`) will
calculate the wrong size if the EDID contains an HF-EEODB (HDMI Forum
EDID Extension Override Data Block). The base extension flag does not
account for these override blocks, leading to truncated EDIDs.

Remove the static declaration and export drm_edid_block_count() so
drivers can safely query the true block count. This allows drivers to
leverage the core DRM's proper handling of HF-EEODB and other edge
cases without having to parse the raw EDID fields themselves.

Signed-off-by: Timo Prömer <timo.proemer04@gmail.com>
---
 drivers/gpu/drm/drm_edid.c | 3 ++-
 include/drm/drm_edid.h     | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index df3c25bac..34560b33a 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1698,12 +1698,13 @@ static int __drm_edid_block_count(const struct drm_edid *drm_edid)
 }
 
 /* EDID block count, limited by allocated size */
-static int drm_edid_block_count(const struct drm_edid *drm_edid)
+int drm_edid_block_count(const struct drm_edid *drm_edid)
 {
 	/* Limit by allocated size */
 	return min(__drm_edid_block_count(drm_edid),
 		   (int)drm_edid->size / EDID_LENGTH);
 }
+EXPORT_SYMBOL(drm_edid_block_count);
 
 /* EDID extension block count, limited by allocated size */
 static int drm_edid_extension_block_count(const struct drm_edid *drm_edid)
diff --git a/include/drm/drm_edid.h b/include/drm/drm_edid.h
index 04f7a7f1f..4a990bf87 100644
--- a/include/drm/drm_edid.h
+++ b/include/drm/drm_edid.h
@@ -481,6 +481,7 @@ const struct drm_edid *drm_edid_read_switcheroo(struct drm_connector *connector,
 int drm_edid_connector_update(struct drm_connector *connector,
 			      const struct drm_edid *edid);
 int drm_edid_connector_add_modes(struct drm_connector *connector);
+int drm_edid_block_count(const struct drm_edid *drm_edid);
 bool drm_edid_is_digital(const struct drm_edid *drm_edid);
 void drm_edid_get_product_id(const struct drm_edid *drm_edid,
 			     struct drm_edid_product_id *id);
-- 
2.55.0

[PATCH 2/2] drm/amd/display: Use drm_edid_block_count() instead of raw extensions

[Timo Prömer]

Instead of manually calculating the EDID block count by reading the
extensions field from the raw edid structure (`edid->extensions + 1`),
utilize the core DRM helper `drm_edid_block_count()`.

This now includes possible HF-EEODB extension blocks, which are not
included in `edid->extensions` and were previously truncated with the
`memmove`.

Signed-off-by: Timo Prömer <timo.proemer04@gmail.com>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
index c6f94eb71..ac5a3b337 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -1160,6 +1160,7 @@ enum dc_edid_status dm_helpers_read_local_edid(
 	struct drm_connector *connector = &aconnector->base;
 	struct i2c_adapter *ddc;
 	int retry = 25;
+	int block_count;
 	enum dc_edid_status edid_status = EDID_NO_RESPONSE;
 	const struct drm_edid *drm_edid;
 	const struct edid *edid;
@@ -1205,7 +1206,9 @@ enum dc_edid_status dm_helpers_read_local_edid(
 		    edid->extensions >= sizeof(sink->dc_edid.raw_edid) / EDID_LENGTH)
 			return EDID_BAD_INPUT;
 
-		sink->dc_edid.length = EDID_LENGTH * (edid->extensions + 1);
+		block_count = drm_edid_block_count(drm_edid);
+
+		sink->dc_edid.length = EDID_LENGTH * block_count;
 		memmove(sink->dc_edid.raw_edid, (uint8_t *)edid, sink->dc_edid.length);
 
 		/* We don't need the original edid anymore */
-- 
2.55.0

Re: [PATCH 2/2] drm/amd/display: Use drm_edid_block_count() instead of raw extensions

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Heap buffer overflow in `sink->dc_edid.raw_edid` due to mismatched bounds check when handling HF-EEODB EDID extensions.
--

--- Patch [2]: [PATCH 2/2] drm/amd/display: Use drm_edid_block_count() instead of raw extensions ---
commit 9d8e550a87693a10ec905e77e53d8e77319a53c9
Author: Timo Prömer <timo.proemer04@gmail.com>

drm/amd/display: Use drm_edid_block_count() instead of raw extensions

This commit replaces the manual EDID block count calculation with the core
DRM helper drm_edid_block_count(). It aims to include possible HF-EEODB
extension blocks that were previously truncated.

> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
[ ... ]
> @@ -1224,7 +1225,9 @@ enum dc_edid_status dm_helpers_read_local_edid(
>  		    edid->extensions >= sizeof(sink->dc_edid.raw_edid) / EDID_LENGTH)
>  			return EDID_BAD_INPUT;
>  
> -		sink->dc_edid.length = EDID_LENGTH * (edid->extensions + 1);
> +		block_count = drm_edid_block_count(drm_edid);
> +
> +		sink->dc_edid.length = EDID_LENGTH * block_count;
>  		memmove(sink->dc_edid.raw_edid, (uint8_t *)edid, sink->dc_edid.length);

[Severity: Critical]
Can this cause a heap buffer overflow when handling HF-EEODB extensions?

Looking at dm_helpers_read_local_edid(), the bounds check right before this
change still validates against the raw edid->extensions count:

    if (!edid ||
        edid->extensions >= sizeof(sink->dc_edid.raw_edid) / EDID_LENGTH)
        return EDID_BAD_INPUT;

If an EDID specifies a small edid->extensions count (e.g., 1) but an
HF-EEODB overrides the block count to a much larger value (e.g., 32), the
bounds check evaluates to 1 >= 16 and passes.

The new logic then calculates a length based on the larger block_count
returned by drm_edid_block_count() and passes it directly to memmove().

Since sink->dc_edid.raw_edid is a fixed-size buffer, does this result in
copying more data than the buffer can safely hold?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713183841.5921-1-timo.proemer04@gmail.com?part=2

Re: [PATCH 2/2] drm/amd/display: Use drm_edid_block_count() instead of raw extensions

[Timo Prömer]

Thanks for the report.

I have fixed this issue and just sent out a v2 of the series.