qxl_process_single_command() maps the page containing the current release slot and copies the userspace command into it at the release_offset within the page: fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_MASK)); copy_from_user(..., fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_MASK), ...); However, the subsequent mm_time stamp casts the page-start pointer directly: struct qxl_drawable *draw = fb_cmd; This writes mm_time at the page start rather than into the drawable that was just copied. The drawable begins at the page-relative release_offset (struct qxl_drawable embeds the release_info header as its first member, so no additional sizeof skip is needed for the struct pointer). Apply the page-relative offset so mm_time lands in the right place. Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Aldo Ariel Panzardo --- v2: drop the sizeof(union qxl_release_info) term — qxl_drawable embeds release_info as its first member, so the struct pointer only needs the page-relative offset (found by Sashiko AI review). drivers/gpu/drm/qxl/qxl_ioctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 591b026..65e9bfd 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -188,7 +188,8 @@ static int qxl_process_single_command(struct qxl_device *qdev, u64_to_user_ptr(cmd->command), cmd->command_size); { - struct qxl_drawable *draw = fb_cmd; + struct qxl_drawable *draw = (void *)fb_cmd + + (release->release_offset & ~PAGE_MASK); draw->mm_time = qdev->rom->mm_clock; } -- 2.43.0