From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: drm/hyperv: validate resolution_count and fix WIN8 fallback Date: Mon, 25 May 2026 17:45:30 +1000 Message-ID: In-Reply-To: <6945b22419c7d404b4954a113de2ac9c900dba93.1779542874.git.me@berkoc.com> References: <6945b22419c7d404b4954a113de2ac9c900dba93.1779542874.git.me@berkoc.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Patch Review **Status: Good =E2=80=94 no issues found.** The `resolution_count` bounds check is correct. The parse loop at lines 405= =E2=80=93410 of the original iterates `resolution_count` times over `suppor= ted_resolution[SYNTHVID_MAX_RESOLUTION_COUNT]` (64 entries), so an unchecke= d count from the host can cause an out-of-bounds read: ```c + if (msg->resolution_resp.resolution_count =3D=3D 0 || + msg->resolution_resp.resolution_count > + SYNTHVID_MAX_RESOLUTION_COUNT) { + drm_err(dev, "Invalid resolution count: %d\n", + msg->resolution_resp.resolution_count); return -ENODEV; ``` Folding the upper bound into the existing zero-check is clean. The `%d` for= mat for a `u8` is fine (promoted to `int`). The fallback refactor is also correct. The original `else` branch only cove= red pre-WIN10, leaving `screen_width_max` / `screen_height_max` at zero on = a failed WIN10 probe, which cascades into `mode_config.max_width =3D 0` and= breaks framebuffer creation. The new guard: ```c + if (!hv->screen_width_max) { hv->screen_width_max =3D SYNTHVID_WIDTH_WIN8; hv->screen_height_max =3D SYNTHVID_HEIGHT_WIN8; + hv->preferred_width =3D SYNTHVID_WIDTH_WIN8; + hv->preferred_height =3D SYNTHVID_HEIGHT_WIN8; } ``` This works because `screen_width_max` is zero-initialized (the device struc= t comes from `devm_drm_dev_alloc` =E2=86=92 `kzalloc`), and `hyperv_get_sup= ported_resolution()` only sets it to nonzero on success. The pre-WIN10 path= also benefits from gaining the `preferred_width`/`preferred_height` defaul= ts that were previously missing. No concerns. --- --- Generated by Claude Code Patch Reviewer