[PATCH] drm/format-helper: Fix dst computation in drm_fb_xrgb8888_to_rgb888_dstclip()

[PATCH] drm/format-helper: Fix dst computation in drm_fb_xrgb8888_to_rgb888_dstclip()

[Hector Martin]

The dst pointer was being advanced by the clip width, not the full line
stride, resulting in corruption. The clip offset was also calculated
incorrectly.

Cc: stable@vger.kernel.org
Signed-off-by: Hector Martin <marcan@marcan.st>
---
 drivers/gpu/drm/drm_format_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_format_helper.c b/drivers/gpu/drm/drm_format_helper.c
index e676921422b8..12bc6b45e95b 100644
--- a/drivers/gpu/drm/drm_format_helper.c
+++ b/drivers/gpu/drm/drm_format_helper.c
@@ -366,12 +366,12 @@ void drm_fb_xrgb8888_to_rgb888_dstclip(void __iomem *dst, unsigned int dst_pitch
 		return;
 
 	vaddr += clip_offset(clip, fb->pitches[0], sizeof(u32));
-	dst += clip_offset(clip, dst_pitch, sizeof(u16));
+	dst += clip_offset(clip, dst_pitch, 3);
 	for (y = 0; y < lines; y++) {
 		drm_fb_xrgb8888_to_rgb888_line(dbuf, vaddr, linepixels);
 		memcpy_toio(dst, dbuf, dst_len);
 		vaddr += fb->pitches[0];
-		dst += dst_len;
+		dst += dst_pitch;
 	}
 
 	kfree(dbuf);
-- 
2.33.0

Re: [PATCH] drm/format-helper: Fix dst computation in drm_fb_xrgb8888_to_rgb888_dstclip()

[Thomas Zimmermann]

[-- Attachment #1.1: Type: text/plain, Size: 1870 bytes --]

Hi

Am 17.11.21 um 15:22 schrieb Hector Martin:
> The dst pointer was being advanced by the clip width, not the full line
> stride, resulting in corruption. The clip offset was also calculated
> incorrectly.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Hector Martin <marcan@marcan.st>

Thanks for your patch, but you're probably on the wrong branch. We 
rewrote this code recently and fixed the issue in drm-misc-next. [1][2]

If anything, this patch could go into stable. If anyone wants to merge 
it there, then

Acked-by: Thomas Zimmermann <tzimmermann@suse.de>

Best regards
Thomas

[1] 
https://lore.kernel.org/dri-devel/20211110103702.374-5-tzimmermann@suse.de/
[2] 
https://cgit.freedesktop.org/drm/drm-misc/commit/?id=53bc2098d2b6ccff25fe13f9345cbb5c0ef34a99

> ---
>   drivers/gpu/drm/drm_format_helper.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_format_helper.c b/drivers/gpu/drm/drm_format_helper.c
> index e676921422b8..12bc6b45e95b 100644
> --- a/drivers/gpu/drm/drm_format_helper.c
> +++ b/drivers/gpu/drm/drm_format_helper.c
> @@ -366,12 +366,12 @@ void drm_fb_xrgb8888_to_rgb888_dstclip(void __iomem *dst, unsigned int dst_pitch
>   		return;
>   
>   	vaddr += clip_offset(clip, fb->pitches[0], sizeof(u32));
> -	dst += clip_offset(clip, dst_pitch, sizeof(u16));
> +	dst += clip_offset(clip, dst_pitch, 3);
>   	for (y = 0; y < lines; y++) {
>   		drm_fb_xrgb8888_to_rgb888_line(dbuf, vaddr, linepixels);
>   		memcpy_toio(dst, dbuf, dst_len);
>   		vaddr += fb->pitches[0];
> -		dst += dst_len;
> +		dst += dst_pitch;
>   	}
>   
>   	kfree(dbuf);
> 

-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]

Re: [PATCH] drm/format-helper: Fix dst computation in drm_fb_xrgb8888_to_rgb888_dstclip()

[Hector Martin]

On 17/11/2021 23.56, Thomas Zimmermann wrote:
> Hi
> 
> Am 17.11.21 um 15:22 schrieb Hector Martin:
>> The dst pointer was being advanced by the clip width, not the full line
>> stride, resulting in corruption. The clip offset was also calculated
>> incorrectly.
>>
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Hector Martin <marcan@marcan.st>
> 
> Thanks for your patch, but you're probably on the wrong branch. We
> rewrote this code recently and fixed the issue in drm-misc-next. [1][2]

Oops. I was on linux-next as of Nov 1. Looks like I missed it by a week!

Sounds like I'm going to have to rebase/rewrite the other series I just 
sent too...

-- 
Hector Martin (marcan@marcan.st)
Public Key: https://mrcn.st/pub