From: Jani Nikula Date: Wed, 8 Jun 2022 07:50:31 +0000 (+0300) Subject: drm/edid: fix CTA data block collection size for CTA version 3 X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=fc67615f4ecc3b66bd458840927272aa131eface;p=linux.git drm/edid: fix CTA data block collection size for CTA version 3 The CTA Data Block Collection is valid only for CTA extension version 3. In versions 1 and 2, it is a reserved block, which we ignore. The DTD start offset (byte 2, or d in CTA-861 spec), which determines the CTA Data Block Collection size, is specified slightly differently for different versions: Version 1: d = offset for the byte following the reserved data block. If no data is provided in the reserved data block, then d=4. If no DTDs are provided, then d=0 Version 2: d = offset for the byte following the reserved data block. If no data is provided in the reserved data block, then d=4. If d=0, then no detailed timing descriptors are provided, and no data is provided in the reserved data block. Version 3: d = offset for the byte following the data block collection. If no data is provided in the data block collection, then d=4. If d=0, then no detailed timing descriptors are provided, and no data is provided in the data block collection. Ever since commit 9e50b9d55e9c ("drm: edid: Add some bounds checking"), we've interpreted 0 to mean there are no DTDs but it's all Data Blocks. Per the spec, Data Blocks are only valid for version 3, where we should interpret 0 to mean there are no data blocks. Follow the spec (and hope the EDIDs follow it too). Cc: Ville Syrjälä Signed-off-by: Jani Nikula Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/2a4c94417f024cbafc5d4ca0a74e4617fc4325d1.1654674560.git.jani.nikula@intel.com --- diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index 929fc0e46751f..c57f6333ea7d7 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -4498,8 +4498,6 @@ static const void *__cea_db_iter_edid_next(struct cea_db_iter *iter) iter->index = 4; iter->end = ext[2]; - if (iter->end == 0) - iter->end = 127; if (iter->end < 4 || iter->end > 127) continue;