[PATCH] drm/debugfs: Accept "reset" with a trailing newline in edid_override

[PATCH] drm/debugfs: Accept "reset" with a trailing newline in edid_override

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

Writing "reset" to a connector's edid_override debugfs file removes the
override, but only when exactly those five bytes are written. The
obvious

  echo reset > /sys/kernel/debug/dri/0/HDMI-A-1/edid_override

writes "reset\n", which is handed to drm_edid_override_set() as an EDID
and rejected with -EINVAL, leaving the override in place. A test
harness that cleared its override this way kept running on the
overridden EDID until the next reboot.

Accept a single trailing newline as well. An EDID is at least 128
bytes, so a six-byte "reset\n" can't be a valid override.

Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
Found and tested on an Orange Pi 5 (RK3588S), with this change on a 7.3
based kernel: with the HDMI connector's own EDID written to
edid_override, "echo reset > edid_override" succeeds and edid_override
reads back empty, and "printf reset" (no newline) still succeeds. On
drm-misc-next the patch is build-tested only (arm64 and x86_64, W=1).

This patch was developed with Claude (Anthropic) as a coding assistant:
it wrote the code and the commit message, and I reviewed and tested it
as described above.
---
 drivers/gpu/drm/drm_debugfs.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
index a72f9723d3a9..3c6290457fa3 100644
--- a/drivers/gpu/drm/drm_debugfs.c
+++ b/drivers/gpu/drm/drm_debugfs.c
@@ -569,7 +569,12 @@ static ssize_t edid_write(struct file *file, const char __user *ubuf,
 	if (IS_ERR(buf))
 		return PTR_ERR(buf);
 
-	if (len == 5 && !strncmp(buf, "reset", 5))
+	/*
+	 * An EDID is at least 128 bytes, so "reset" with the trailing newline
+	 * that "echo reset" adds can't be mistaken for one.
+	 */
+	if ((len == 5 || (len == 6 && buf[5] == '\n')) &&
+	    !strncmp(buf, "reset", 5))
 		ret = drm_edid_override_reset(connector);
 	else
 		ret = drm_edid_override_set(connector, buf, len);

---
base-commit: cb0a63f0c96e8ecb90199eeb99cc2a7fcfa703d4
change-id: 20261110-drm-debugfs-edid-reset-0504a20c67d1

Best regards,
--  
Arun Iyengar <aiyengar1990@gmail.com>

Re: [PATCH] drm/debugfs: Accept "reset" with a trailing newline in edid_override

[Jani Nikula]

On Thu, 12 Nov 2026, Arun Iyengar via B4 Relay <devnull+aiyengar1990.gmail.com@kernel.org> wrote:
> From: Arun Iyengar <aiyengar1990@gmail.com>
>
> Writing "reset" to a connector's edid_override debugfs file removes the
> override, but only when exactly those five bytes are written. The
> obvious
>
>   echo reset > /sys/kernel/debug/dri/0/HDMI-A-1/edid_override
>
> writes "reset\n", which is handed to drm_edid_override_set() as an EDID
> and rejected with -EINVAL, leaving the override in place. A test
> harness that cleared its override this way kept running on the
> overridden EDID until the next reboot.
>
> Accept a single trailing newline as well. An EDID is at least 128
> bytes, so a six-byte "reset\n" can't be a valid override.
>
> Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
> ---
> Found and tested on an Orange Pi 5 (RK3588S), with this change on a 7.3
> based kernel: with the HDMI connector's own EDID written to
> edid_override, "echo reset > edid_override" succeeds and edid_override
> reads back empty, and "printf reset" (no newline) still succeeds. On
> drm-misc-next the patch is build-tested only (arm64 and x86_64, W=1).
>
> This patch was developed with Claude (Anthropic) as a coding assistant:
> it wrote the code and the commit message, and I reviewed and tested it
> as described above.
> ---
>  drivers/gpu/drm/drm_debugfs.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
> index a72f9723d3a9..3c6290457fa3 100644
> --- a/drivers/gpu/drm/drm_debugfs.c
> +++ b/drivers/gpu/drm/drm_debugfs.c
> @@ -569,7 +569,12 @@ static ssize_t edid_write(struct file *file, const char __user *ubuf,
>  	if (IS_ERR(buf))
>  		return PTR_ERR(buf);
>  
> -	if (len == 5 && !strncmp(buf, "reset", 5))
> +	/*
> +	 * An EDID is at least 128 bytes, so "reset" with the trailing newline
> +	 * that "echo reset" adds can't be mistaken for one.
> +	 */
> +	if ((len == 5 || (len == 6 && buf[5] == '\n')) &&
> +	    !strncmp(buf, "reset", 5))

Feels like a more robust option would be to allocate buf with
memdup_user_nul() and do a simple sysfs_streq() that handles newlines in
a generic fashion.

The corner case downside is that it'll also match "reset\0" followed by
a bunch of arbitrary data, but then an EDID like that wouldn't pass
anyway.

BR,
Jani.


>  		ret = drm_edid_override_reset(connector);
>  	else
>  		ret = drm_edid_override_set(connector, buf, len);
>
> ---
> base-commit: cb0a63f0c96e8ecb90199eeb99cc2a7fcfa703d4
> change-id: 20261110-drm-debugfs-edid-reset-0504a20c67d1
>
> Best regards,
> --  
> Arun Iyengar <aiyengar1990@gmail.com>
>
>

-- 
Jani Nikula, Intel