Gentle ping — any feedback on this patch? thanks, Aldo
On Wed, Sep 23, 2026 12:29 PM, Aldo Ariel Panzardo <[email protected]> wrote: > qxl_process_single_command() maps the page containing the current > release slot and copies the userspace command into it at the > release_offset within the page: > > fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, > (release->release_offset & PAGE_MASK)); > copy_from_user(..., fb_cmd + sizeof(union qxl_release_info) + > (release->release_offset & ~PAGE_MASK), ...); > > However, the subsequent mm_time stamp casts the page-start pointer > directly: > > struct qxl_drawable *draw = fb_cmd; > > This writes mm_time at the page start rather than into the drawable > that was just copied. The drawable begins at the page-relative > release_offset (struct qxl_drawable embeds the release_info header > as its first member, so no additional sizeof skip is needed for the > struct pointer). > > Apply the page-relative offset so mm_time lands in the right place. > > Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") > Cc: [email protected] > Reported-by: Sashiko <[email protected]> > Signed-off-by: Aldo Ariel Panzardo <[email protected]> > --- > v2: drop the sizeof(union qxl_release_info) term — qxl_drawable > embeds release_info as its first member, so the struct pointer > only needs the page-relative offset (found by Sashiko AI review). > > drivers/gpu/drm/qxl/qxl_ioctl.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c > b/drivers/gpu/drm/qxl/qxl_ioctl.c > index 591b026..65e9bfd 100644 > --- a/drivers/gpu/drm/qxl/qxl_ioctl.c > +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c > @@ -188,7 +188,8 @@ static int qxl_process_single_command(struct > qxl_device *qdev, > u64_to_user_ptr(cmd->command), cmd->command_size); > > { > - struct qxl_drawable *draw = fb_cmd; > + struct qxl_drawable *draw = (void *)fb_cmd + > + (release->release_offset & ~PAGE_MASK); > > draw->mm_time = qdev->rom->mm_clock; > } > -- > 2.43.0 >
