Hi guys, Following up on this v2. Some list copies of my previous follow-up were rejected because they contained HTML, so I'm following up in plain text.
Would any additional testing or changes help with the review? I'm happy to address any remaining concerns. Thanks, Aldo On Wed, 23 Sep 2026 12:29:37 -0300, Aldo Ariel Panzardo <[email protected]> wrote: > qxl_process_single_command() maps the page containing the current > release slot and copies the userspace command into it at the > release_offset within the page: > > fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, > (release->release_offset & PAGE_MASK)); > copy_from_user(..., fb_cmd + sizeof(union qxl_release_info) + > (release->release_offset & ~PAGE_MASK), ...); > > However, the subsequent mm_time stamp casts the page-start pointer > directly: > > struct qxl_drawable *draw = fb_cmd; > > This writes mm_time at the page start rather than into the drawable > that was just copied. The drawable begins at the page-relative > release_offset (struct qxl_drawable embeds the release_info header > as its first member, so no additional sizeof skip is needed for the > struct pointer). > > Apply the page-relative offset so mm_time lands in the right place. > > Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") > Cc: [email protected] > Reported-by: Sashiko <[email protected]> > Signed-off-by: Aldo Ariel Panzardo <[email protected]> > --- > v2: drop the sizeof(union qxl_release_info) term — qxl_drawable > embeds release_info as its first member, so the struct pointer > only needs the page-relative offset (found by Sashiko AI review). > > drivers/gpu/drm/qxl/qxl_ioctl.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c > index 591b026..65e9bfd 100644 > --- a/drivers/gpu/drm/qxl/qxl_ioctl.c > +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c > @@ -188,7 +188,8 @@ static int qxl_process_single_command(struct qxl_device *qdev, > u64_to_user_ptr(cmd->command), cmd->command_size); > > { > - struct qxl_drawable *draw = fb_cmd; > + struct qxl_drawable *draw = (void *)fb_cmd + > + (release->release_offset & ~PAGE_MASK); > > draw->mm_time = qdev->rom->mm_clock; > } > -- > 2.43.0
