From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: drm/hyperv: validate resolution_count and fix WIN8 fallback
Date: Mon, 25 May 2026 19:37:10 +1000
Message-ID: <review-patch1-6945b22419c7d404b4954a113de2ac9c900dba93.1779396074.git.me@berkoc.com>
In-Reply-To: <6945b22419c7d404b4954a113de2ac9c900dba93.1779396074.git.me@berkoc.com>
References: <cover.1779396074.git.me@berkoc.com> <6945b22419c7d404b4954a113de2ac9c900dba93.1779396074.git.me@berkoc.com>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Patch Review

**Verdict: Good, minor nit.**

**Resolution count bounds check** =E2=80=94 Correct and necessary. The exis=
ting code only checked for zero:

```c
if (msg->resolution_resp.resolution_count =3D=3D 0 ||
    msg->resolution_resp.resolution_count >
    SYNTHVID_MAX_RESOLUTION_COUNT) {
```

Without this, a malicious or buggy host sending `resolution_count > 64` wou=
ld cause the loop at line 405 to read past `supported_resolution[SYNTHVID_M=
AX_RESOLUTION_COUNT]`, which is an OOB read on `hv->init_buf`. Since `init_=
buf` is a flat `u8[0x4000]` inside `struct hyperv_drm_device`, this reads a=
djacent struct members rather than unmapped memory, but it's still a data-i=
ntegrity bug that can corrupt `screen_width_max`/`screen_height_max` with g=
arbage.

**WIN8 fallback** =E2=80=94 Clean refactoring. The change from:

```c
} else {
    hv->screen_width_max =3D SYNTHVID_WIDTH_WIN8;
    hv->screen_height_max =3D SYNTHVID_HEIGHT_WIN8;
}
```

to:

```c
if (!hv->screen_width_max) {
    hv->screen_width_max =3D SYNTHVID_WIDTH_WIN8;
    hv->screen_height_max =3D SYNTHVID_HEIGHT_WIN8;
    hv->preferred_width =3D SYNTHVID_WIDTH_WIN8;
    hv->preferred_height =3D SYNTHVID_HEIGHT_WIN8;
}
```

This correctly converges three previously-distinct failure paths (pre-WIN10=
, WIN10 probe failure, WIN10 invalid count) into a single fallback. It also=
 fixes the pre-WIN10 branch that never populated `preferred_width`/`preferr=
ed_height`, which would leave them at 0.

**Nit:** The error message uses `%d` for `resolution_count` which is `u8`:

```c
drm_err(dev, "Invalid resolution count: %d\n",
        msg->resolution_resp.resolution_count);
```

`%u` would be more semantically precise for an unsigned type, though `%d` w=
orks correctly for `u8` values and is common in the kernel. Not worth a res=
pin.

---

---
Generated by Claude Code Patch Reviewer