[PATCH v2] drm/debugfs: Accept "reset" with a trailing newline in edid_override

[PATCH v2] drm/debugfs: Accept "reset" with a trailing newline in edid_override

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

Writing "reset" to edid_override only removes the override when exactly
those five bytes are written, so "echo reset > edid_override" fails with
-EINVAL and leaves the override in place.

Compare with sysfs_streq() on a NUL-terminated copy, and reject writes
larger than the largest possible EDID (256 blocks) before copying,
so that the size of the copy is bounded.

Suggested-by: Jani Nikula <jani.nikula@linux.intel.com>
Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
Tested on an Orange Pi 5 (RK3588S) with this patch on a 7.3 based
kernel: "echo reset" and "printf reset" both remove an override, an EDID
override round trip still works, and garbage or oversized writes fail
with -EINVAL.

Developed with Claude (Anthropic), which wrote the code and the commit
message. I reviewed and tested it.
---
Changes in v2:
- Use memdup_user_nul() and sysfs_streq() (Jani Nikula)
- Reject writes larger than 256 EDID blocks before copying
- Shorter commit message
- Link to v1: https://patch.msgid.link/20261112-drm-debugfs-edid-reset-v1-1-4cd19d83cd22@gmail.com
---
 drivers/gpu/drm/drm_debugfs.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
index a72f9723d3a9..7c39c8ed3984 100644
--- a/drivers/gpu/drm/drm_debugfs.c
+++ b/drivers/gpu/drm/drm_debugfs.c
@@ -565,11 +565,15 @@ static ssize_t edid_write(struct file *file, const char __user *ubuf,
 	char *buf;
 	int ret;
 
-	buf = memdup_user(ubuf, len);
+	/* An EDID has at most 256 blocks */
+	if (len > 256 * EDID_LENGTH)
+		return -EINVAL;
+
+	buf = memdup_user_nul(ubuf, len);
 	if (IS_ERR(buf))
 		return PTR_ERR(buf);
 
-	if (len == 5 && !strncmp(buf, "reset", 5))
+	if (sysfs_streq(buf, "reset"))
 		ret = drm_edid_override_reset(connector);
 	else
 		ret = drm_edid_override_set(connector, buf, len);

---
base-commit: cb0a63f0c96e8ecb90199eeb99cc2a7fcfa703d4
change-id: 20261110-drm-debugfs-edid-reset-0504a20c67d1

Best regards,
--  
Arun Iyengar <aiyengar1990@gmail.com>