FAILED: patch "[PATCH] staging: sm750fb: fix mono image source stride mismatch in" failed to apply to 5.15-stable tree
[email protected]
maintainerThe patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x cc7cd2a9228175c975f62ad56ed7c767701cb4fa
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090831-duress-clone-7908@gregkh' --subject-prefix 'PATCH 5.15.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From cc7cd2a9228175c975f62ad56ed7c767701cb4fa Mon Sep 17 00:00:00 2001
From: Muhammad Bilal <[email protected]>
Date: Tue, 1 Sep 2026 16:30:31 +0500
Subject: [PATCH] staging: sm750fb: fix mono image source stride mismatch in
lynxfb_ops_imageblit()
sm750_hw_imageblit() advances its monochrome source pointer by src_delta per scanline, and computes the correct rounded-up stride internally as:
bytes_per_scan = (width + start_bit + 7) / 8;
Its only caller, lynxfb_ops_imageblit(), instead passed src_delta as image->width >> 3. For widths not a multiple of 8 this under-counted the stride, so the source pointer fell further behind the real per-scanline layout on every line, corrupting the rendered image.
Rather than just fixing the caller's calculation, remove src_delta as a parameter entirely and have sm750_hw_imageblit() advance by the bytes_per_scan it already computes for itself. There has only ever been one caller, and that caller was passing an out-of-sync derivative of the same width/start_bit values sm750_hw_imageblit() already has, so keeping stride as a separate parameter served no purpose beyond letting the two calculations drift apart, which is exactly what happened here.
Rounding up, rather than down, is the direction consistent with the rest of the fbdev core: struct fb_image mono bitmap data (the same image->data this driver receives) is walked elsewhere with byte strides derived from a ceiling division of width by 8. The generic mono bit iterator in drivers/video/fbdev/core/fb_imageblit.h advances scanlines with "iter->data += BITS_TO_BYTES(iter->width)", and BITS_TO_BYTES() (include/linux/bitops.h) is a ceiling division. sm750_hw_imageblit()'s own "(width + start_bit + 7) / 8" is that same ceiling division with an added start_bit offset, so the caller's ">> 3" (floor) was the one calculation out of step with how this data layout is handled everywhere else.
Found by code review of sm750_hw_imageblit()'s internal stride calculation against what its only caller was passing in, and confirmed with a clean -Werror build. I do not have this hardware, so this has not been exercised at runtime on real sm750 silicon.
drivers/staging/sm750fb/sm750.c +1 -1
@@ -252,7 +252,7 @@ static void lynxfb_ops_imageblit(struct fb_info *info,spin_lock (&sm750_dev->slock); sm750_dev->accel.de_imageblit(&sm750_dev->accel, - image->data, image->width >> 3, 0, + image->data, 0, base, pitch, bpp, image->dx, image->dy, image->width, image->height,
drivers/staging/sm750fb/sm750.h +1 -1
@@ -64,7 +64,7 @@ struct lynx_accel { u32 rop2);int (*de_imageblit)(struct lynx_accel *accel,const char *p_srcbuf, -u32 src_delta,u32 start_bit,u32 d_base,u32 d_pitch, +u32 start_bit,u32 d_base,u32 d_pitch,u32 byte_per_pixel,u32 dx,u32 dy,u32 width,u32 height,u32 f_color,u32 b_color,u32 rop2);
drivers/staging/sm750fb/sm750_accel.c +2 -4
@@ -288,8 +288,6 @@ static unsigned int de_get_transparency(struct lynx_accel *accel)* sm750_hw_imageblit * @accel: Acceleration device data * @src_buf: pointer to start of source buffer in system memory -* @src_delta: Pitch value (in bytes) of the source buffer, +ive means top down -* and -ive mean button up * @start_bit: Mono data can start at any bit in a byte, this value should be * 0 to 7 * @dest_base: Address of destination: offset in frame buffer
@@ -304,7 +302,7 @@ static unsigned int de_get_transparency(struct lynx_accel *accel)* @rop2: ROP value */ int sm750_hw_imageblit (struct lynx_accel *accel,const char *src_buf, -u32 src_delta,u32 start_bit,u32 dest_base,u32 dest_pitch, +u32 start_bit,u32 dest_base,u32 dest_pitch,u32 byte_per_pixel,u32 dx,u32 dy,u32 width,u32 height,u32 fg_color,u32 bg_color,u32 rop2) {
@@ -395,7 +393,7 @@ int sm750_hw_imageblit(struct lynx_accel *accel, const char *src_buf,write_dp_port (accel, *(unsigned int *)remain); } - src_buf += src_delta; + src_buf += bytes_per_scan; }return 0 ;
drivers/staging/sm750fb/sm750_accel.h +1 -3
@@ -220,8 +220,6 @@ int sm750_hw_copyarea(struct lynx_accel *accel,/** * sm750_hw_imageblit * @src_buf: pointer to start of source buffer in system memory -* @src_delta: Pitch value (in bytes) of the source buffer, +ive means top down -*>----- and -ive mean button up * @start_bit: Mono data can start at any bit in a byte, this value should be *>----- 0 to 7 * @dest_base: Address of destination: offset in frame buffer
@@ -236,7 +234,7 @@ int sm750_hw_copyarea(struct lynx_accel *accel,* @rop2: ROP value */ int sm750_hw_imageblit (struct lynx_accel *accel,const char *src_buf, -u32 src_delta,u32 start_bit,u32 dest_base,u32 dest_pitch, +u32 start_bit,u32 dest_base,u32 dest_pitch,u32 byte_per_pixel,u32 dx,u32 dy,u32 width,u32 height,u32 fg_color,u32 bg_color,u32 rop2);
Sasha Levin
maintainerPATCH 1/1 staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
From: Muhammad Bilal <[email protected]>
[ Upstream commit cc7cd2a9228175c975f62ad56ed7c767701cb4fa ]
sm750_hw_imageblit() advances its monochrome source pointer by src_delta per scanline, and computes the correct rounded-up stride internally as:
bytes_per_scan = (width + start_bit + 7) / 8;
Its only caller, lynxfb_ops_imageblit(), instead passed src_delta as image->width >> 3. For widths not a multiple of 8 this under-counted the stride, so the source pointer fell further behind the real per-scanline layout on every line, corrupting the rendered image.
Rather than just fixing the caller's calculation, remove src_delta as a parameter entirely and have sm750_hw_imageblit() advance by the bytes_per_scan it already computes for itself. There has only ever been one caller, and that caller was passing an out-of-sync derivative of the same width/start_bit values sm750_hw_imageblit() already has, so keeping stride as a separate parameter served no purpose beyond letting the two calculations drift apart, which is exactly what happened here.
Rounding up, rather than down, is the direction consistent with the rest of the fbdev core: struct fb_image mono bitmap data (the same image->data this driver receives) is walked elsewhere with byte strides derived from a ceiling division of width by 8. The generic mono bit iterator in drivers/video/fbdev/core/fb_imageblit.h advances scanlines with "iter->data += BITS_TO_BYTES(iter->width)", and BITS_TO_BYTES() (include/linux/bitops.h) is a ceiling division. sm750_hw_imageblit()'s own "(width + start_bit + 7) / 8" is that same ceiling division with an added start_bit offset, so the caller's ">> 3" (floor) was the one calculation out of step with how this data layout is handled everywhere else.
Found by code review of sm750_hw_imageblit()'s internal stride calculation against what its only caller was passing in, and confirmed with a clean -Werror build. I do not have this hardware, so this has not been exercised at runtime on real sm750 silicon.
--- drivers/staging/sm750fb/sm750.c | 2 +- drivers/staging/sm750fb/sm750.h | 2 +- drivers/staging/sm750fb/sm750_accel.c | 6 ++---- drivers/staging/sm750fb/sm750_accel.h | 4 +--- 4 files changed, 5 insertions(+), 9 deletions(-)
drivers/staging/sm750fb/sm750.c +1 -1
@@ -275,7 +275,7 @@ static void lynxfb_ops_imageblit(struct fb_info *info,spin_lock (&sm750_dev->slock); sm750_dev->accel.de_imageblit(&sm750_dev->accel, - image->data, image->width >> 3, 0, + image->data, 0, base, pitch, Bpp, image->dx, image->dy, image->width, image->height,
drivers/staging/sm750fb/sm750.h +1 -1
@@ -73,7 +73,7 @@ struct lynx_accel { u32 rop2);int (*de_imageblit)(struct lynx_accel *accel,const char *p_srcbuf, -u32 src_delta,u32 start_bit,u32 d_base,u32 d_pitch, +u32 start_bit,u32 d_base,u32 d_pitch,u32 byte_per_pixel,u32 dx,u32 dy,u32 width,u32 height,u32 f_color,u32 b_color,u32 rop2);
drivers/staging/sm750fb/sm750_accel.c +2 -4
@@ -301,8 +301,6 @@ static unsigned int deGetTransparency(struct lynx_accel *accel)* sm750_hw_imageblit * @accel: Acceleration device data * @pSrcbuf: pointer to start of source buffer in system memory -* @srcDelta: Pitch value (in bytes) of the source buffer, +ive means top down -* and -ive mean button up * @startBit: Mono data can start at any bit in a byte, this value should be * 0 to 7 * @dBase: Address of destination: offset in frame buffer
@@ -317,7 +315,7 @@ static unsigned int deGetTransparency(struct lynx_accel *accel)* @rop2: ROP value */ int sm750_hw_imageblit (struct lynx_accel *accel,const char *pSrcbuf, -u32 srcDelta,u32 startBit,u32 dBase,u32 dPitch, +u32 startBit,u32 dBase,u32 dPitch,u32 bytePerPixel,u32 dx,u32 dy,u32 width,u32 height,u32 fColor,u32 bColor,u32 rop2) {
@@ -406,7 +404,7 @@ int sm750_hw_imageblit(struct lynx_accel *accel, const char *pSrcbuf,write_dpPort (accel, *(unsigned int *)ajRemain); } - pSrcbuf += srcDelta; + pSrcbuf += ulBytesPerScan; }return 0 ;
drivers/staging/sm750fb/sm750_accel.h +1 -3
@@ -220,8 +220,6 @@ int sm750_hw_copyarea(struct lynx_accel *accel,/** * sm750_hw_imageblit * @pSrcbuf: pointer to start of source buffer in system memory -* @srcDelta: Pitch value (in bytes) of the source buffer, +ive means top down -*>----- and -ive mean button up * @startBit: Mono data can start at any bit in a byte, this value should be *>----- 0 to 7 * @dBase: Address of destination: offset in frame buffer
@@ -236,7 +234,7 @@ int sm750_hw_copyarea(struct lynx_accel *accel,* @rop2: ROP value */ int sm750_hw_imageblit (struct lynx_accel *accel,const char *pSrcbuf, -u32 srcDelta,u32 startBit,u32 dBase,u32 dPitch, +u32 startBit,u32 dBase,u32 dPitch,u32 bytePerPixel,u32 dx,u32 dy,u32 width,u32 height,u32 fColor,u32 bColor,u32 rop2);
Signature · 1 line
2.53.0