[PATCH] staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()

[PATCH] staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()

[Muhammad Bilal]

sm750_hw_imageblit() advances its monochrome source pointer by
src_delta per scanline, and computes the correct rounded-up stride
internally as:

	bytes_per_scan = (width + start_bit + 7) / 8;

Its only caller, lynxfb_ops_imageblit(), instead passes src_delta as
image->width >> 3. For widths not a multiple of 8 this under-counts
the stride, so the source pointer falls further behind the real
per-scanline layout on every line, corrupting the rendered image.

Use DIV_ROUND_UP() so the stride passed in matches what
sm750_hw_imageblit() already assumes.

Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
 drivers/staging/sm750fb/sm750.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 89c811e0806c..69e803f4f175 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -261,7 +261,7 @@ static void lynxfb_ops_imageblit(struct fb_info *info,
 	spin_lock(&sm750_dev->slock);
 
 	sm750_dev->accel.de_imageblit(&sm750_dev->accel,
-				      image->data, image->width >> 3, 0,
+				      image->data, DIV_ROUND_UP(image->width, 8), 0,
 				      base, pitch, bpp,
 				      image->dx, image->dy,
 				      image->width, image->height,
-- 
2.55.0

Re: [PATCH] staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()

[Dan Carpenter]

On Sat, Jul 18, 2026 at 09:56:41AM +0500, Muhammad Bilal wrote:
> sm750_hw_imageblit() advances its monochrome source pointer by
> src_delta per scanline, and computes the correct rounded-up stride
> internally as:
> 
> 	bytes_per_scan = (width + start_bit + 7) / 8;
> 
> Its only caller, lynxfb_ops_imageblit(), instead passes src_delta as
> image->width >> 3. For widths not a multiple of 8 this under-counts
> the stride, so the source pointer falls further behind the real
> per-scanline layout on every line, corrupting the rendered image.
> 
> Use DIV_ROUND_UP() so the stride passed in matches what
> sm750_hw_imageblit() already assumes.
> 
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>

Looks reasonable.  Add a Fixes tag.

You have this hardware and are finding these with testing?

It would be better to move the source delta calculation into
the the sm750_hw_imageblit() since it's just width rounded up
(or rounded down if you want to be wrong I suppose).

regards,
dan carpenter

Re: [PATCH] staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()

[Muhammad Bilal]

On Sat, Jul 18, 2026, Dan Carpenter wrote:
> Looks reasonable.  Add a Fixes tag.
>
> You have this hardware and are finding these with testing?
>
> It would be better to move the source delta calculation into
> the the sm750_hw_imageblit() since it's just width rounded up
> (or rounded down if you want to be wrong I suppose).

Thanks for the review. Sending v2 as a separate message since it
came out as a fuller rework rather than a small diff on v1:

 - Added Fixes: 81dee67e215b2 ("staging: sm750fb: add sm750 to
   staging"), traced via git blame. The bug has been there,
   unchanged, since the original 2015 staging import.

 - No, I don't have this hardware. This was found by auditing
   sm750_hw_imageblit()'s internal stride calculation against what
   its caller was passing in, and confirmed with a clean "-Werror"
   build. No runtime testing on real sm750 silicon.

 - Moved the stride calculation into sm750_hw_imageblit() itself, as
   you suggested, and dropped src_delta as a parameter entirely. It
   was the only caller and was independently recomputing (wrong)
   something the function already had every input for - which is
   exactly how this bug happened. Updated the declaration in
   sm750_accel.h and the de_imageblit function pointer typedef in
   sm750.h to match.

regards,
Muhammad Bilal

Re: [PATCH] staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()

[Dan Carpenter]

On Sat, Jul 18, 2026 at 03:38:52PM +0500, Muhammad Bilal wrote:
> On Sat, Jul 18, 2026, Dan Carpenter wrote:
> > Looks reasonable.  Add a Fixes tag.
> >
> > You have this hardware and are finding these with testing?
> >
> > It would be better to move the source delta calculation into
> > the the sm750_hw_imageblit() since it's just width rounded up
> > (or rounded down if you want to be wrong I suppose).
> 
> Thanks for the review. Sending v2 as a separate message since it
> came out as a fuller rework rather than a small diff on v1:
> 
>  - Added Fixes: 81dee67e215b2 ("staging: sm750fb: add sm750 to
>    staging"), traced via git blame. The bug has been there,
>    unchanged, since the original 2015 staging import.
> 
>  - No, I don't have this hardware. This was found by auditing
>    sm750_hw_imageblit()'s internal stride calculation against what
>    its caller was passing in, and confirmed with a clean "-Werror"
>    build. No runtime testing on real sm750 silicon.

You really need to put this into the commit message.

regards,
dan carpenter