Re: [PATCH RFC 16/25] drm/edid: Parse QMS TFR min/max flags from HDMI SCDS

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/edid: off-by-one error in HF-VSDB payload length check skips QMS TFR flags
--

commit f56b6e153864bbb4bece6ab04dc75e7a1bb4de03
Author: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>

drm/edid: Parse QMS TFR min/max flags from HDMI SCDS

HDMI has two flags in the SCDS EDID extension that signal which minimum
and maximum refresh rate the sink wishes to use when doing QMS ("Quick
Media Switching").
    
This commit adds definitions for these flags and parses them based on the
publicly available libdisplay-info source code. The parsed QMS TFR min/max
results are stored as booleans in drm_hdmi_info.

> diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
> index 5a7d3b7e65daa..4fe754328b1c8 100644
> --- a/drivers/gpu/drm/drm_edid.c
> +++ b/drivers/gpu/drm/drm_edid.c
> @@ -6332,6 +6332,12 @@ static void drm_parse_vrr_info(struct drm_display_info *info, const u8 *hf_scds)
>  	if (!range->max_vfreq)
>  		range->max_vfreq = (FIELD_GET(DRM_EDID_VRR_MAX_UPPER_MASK, hf_scds[9]) << 8) |
>  				    hf_scds[10];
> +
> +	if (pld_len < 12)
> +		return;
> +
> +	info->hdmi.qms_tfr_min = !!(hf_scds[11] & DRM_EDID_QMS_TFR_MIN);
> +	info->hdmi.qms_tfr_max = !!(hf_scds[11] & DRM_EDID_QMS_TFR_MAX);

[Severity: Medium]
Does this length check accidentally skip valid 11-byte payloads?

In drm_parse_vrr_info(), cea_db_payload_len(hf_scds) returns the exact number
of payload bytes declared in the EDID block header. In the CTA-861 data block
representation, payload bytes are located at array indices 1 through pld_len.

When pld_len is 11, hf_scds[11] is a valid access to the last payload byte.
However, the if (pld_len < 12) check evaluates to true and returns early,
incorrectly skipping the parsing of the QMS TFR min/max flags for displays
that advertise them in a block with exactly 11 bytes of payload.

>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921-vrr-limiter-uapi-v1-0-2fcd7d011646@collabora.com?part=16