linux-kernel - Re: [PATCH] drm/fb-helper: Fix clipping when damage area spans a single scanline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <48b93df8-acd9-4fc4-a4e3-7391a26de744@suse.de>
Date: Wed, 11 Feb 2026 11:03:26 +0100
From: Thomas Zimmermann <tzimmermann@...e.de>
To: Francesco Lavra <flavra@...libre.com>,
 Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
 Maxime Ripard <mripard@...nel.org>, David Airlie <airlied@...il.com>,
 Simona Vetter <simona@...ll.ch>,
 Javier Martinez Canillas <javierm@...hat.com>,
 dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/fb-helper: Fix clipping when damage area spans a
 single scanline

Hi

Am 10.02.26 um 18:35 schrieb Francesco Lavra:
> When the damage area resulting from a dirty memory range spans a single
> scanline, the width of the rectangle is calculated dynamically because it
> may not coincide with the framebuffer width.
> If the dirty range ends exactly at the end of the scanline, the `bit_end`
> variable is incorrectly assigned a 0 value, which results in a bogus clip
> rectangle where the x2 coordinate is 0. This prevents the dirty scanline
> from being flushed to the hardware.
> Change the calculation of the `bit_end` value to fix the x2 coordinate
> value in the above edge case.
>
> Fixes: ded74cafeea9 ("drm/fb-helper: Clip damage area horizontally")
> Signed-off-by: Francesco Lavra <flavra@...libre.com>

The whole logic in that helper would need an update. But for now

Reviewed-by: Thomas Zimmermann <tzimmermann@...e.de>

Best regards
Thomas

> ---
>   drivers/gpu/drm/drm_fb_helper.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
> index 4b47aa0dab35..d545342d24b3 100644
> --- a/drivers/gpu/drm/drm_fb_helper.c
> +++ b/drivers/gpu/drm/drm_fb_helper.c
> @@ -608,7 +608,7 @@ static void drm_fb_helper_memory_range_to_clip(struct fb_info *info, off_t off,
>   		 * the number of horizontal pixels that need an update.
>   		 */
>   		off_t bit_off = (off % line_length) * 8;
> -		off_t bit_end = (end % line_length) * 8;
> +		off_t bit_end = bit_off + len * 8;
>   
>   		x1 = bit_off / info->var.bits_per_pixel;
>   		x2 = DIV_ROUND_UP(bit_end, info->var.bits_per_pixel);

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)