Hi Shuvam, On Tue, 2026-06-16 at 03:31 +0545, [email protected] wrote: > pvr_set_uobj_array() copies an array of kernel objects to a userspace > array whose element size is described by out->stride. When out->stride > is different from the kernel object size, the slow path advances the > userspace pointer by the kernel object size and the kernel pointer by the > userspace stride. > > This reverses the intended layout. For larger userspace strides, later > copies read from the wrong kernel addresses. For smaller userspace > strides, later copies are written at the wrong userspace offsets. The > padding clear is also done only for the first element instead of the > padding area for each element. > > Advance the userspace pointer by out->stride and the kernel pointer by > obj_size, and clear per-element padding while the current userspace > pointer is still available. > > Fixes: f99f5f3ea7ef ("drm/imagination: Add GPU ID parsing and firmware > loading") > Cc: [email protected] # v6.8+ > Signed-off-by: Shuvam Pandey <[email protected]>
Could you resend the patch with the "From:" header fixed up with name + email, to match the signed off line? Somehow the name got lost. Everything else looks good, so with that sorted, Reviewed-by: Alessio Belle <[email protected]> Thanks, Alessio > --- > drivers/gpu/drm/imagination/pvr_drv.c | 13 ++++++------- > 1 file changed, 6 insertions(+), 7 deletions(-) > > diff --git a/drivers/gpu/drm/imagination/pvr_drv.c > b/drivers/gpu/drm/imagination/pvr_drv.c > index 268900464ab6..0a68a9c32361 100644 > --- a/drivers/gpu/drm/imagination/pvr_drv.c > +++ b/drivers/gpu/drm/imagination/pvr_drv.c > @@ -1252,14 +1252,13 @@ pvr_set_uobj_array(const struct drm_pvr_obj_array > *out, u32 min_stride, u32 obj_ > if (copy_to_user(out_ptr, in_ptr, cpy_elem_size)) > return -EFAULT; > > - out_ptr += obj_size; > - in_ptr += out->stride; > - } > + if (out->stride > obj_size && > + clear_user(out_ptr + cpy_elem_size, out->stride - > obj_size)) { > + return -EFAULT; > + } > > - if (out->stride > obj_size && > - clear_user(u64_to_user_ptr(out->array + obj_size), > - out->stride - obj_size)) { > - return -EFAULT; > + out_ptr += out->stride; > + in_ptr += obj_size; > } > } >
