Re: [PATCH V2] drm/qxl: Fix out-of-bounds read in client monitors head access
From: kernel test robot
Date: Fri Oct 09 2026 - 11:50:07 EST
Hi Julio,
kernel test robot noticed the following build warnings:
[auto build test WARNING on drm-misc/drm-misc-next]
[also build test WARNING on drm/drm-next linus/master v7.3-rc6 next-20261008]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Julio-Faracco/drm-qxl-Fix-out-of-bounds-read-in-client-monitors-head-access/20261008-125034
base: https://gitlab.freedesktop.org/drm/misc/kernel.git drm-misc-next
patch link: https://lore.kernel.org/r/20261008155034.55688-1-jcfaracco%40gmail.com
patch subject: [PATCH V2] drm/qxl: Fix out-of-bounds read in client monitors head access
config: x86_64-randconfig-1017-20261009 (https://download.01.org/0day-ci/archive/20261009/202610092302.Y90qfnp6-lkp@xxxxxxxxx/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261009/202610092302.Y90qfnp6-lkp@xxxxxxxxx/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-kbuild-all/202610092302.Y90qfnp6-lkp@xxxxxxxxx/
All warnings (new ones prefixed by >>):
drivers/gpu/drm/qxl/qxl_display.c: In function 'qxl_conn_get_modes':
>> drivers/gpu/drm/qxl/qxl_display.c:1069:28: warning: unused variable 'qdev' [-Wunused-variable]
1069 | struct qxl_device *qdev = to_qxl(dev);
| ^~~~
vim +/qdev +1069 drivers/gpu/drm/qxl/qxl_display.c
f64122c1f6ade30 Dave Airlie 2013-02-25 1065
f64122c1f6ade30 Dave Airlie 2013-02-25 1066 static int qxl_conn_get_modes(struct drm_connector *connector)
f64122c1f6ade30 Dave Airlie 2013-02-25 1067 {
1b043677d4be206 Gerd Hoffmann 2019-01-18 1068 struct drm_device *dev = connector->dev;
e304f8a0513b830 Simona Vetter 2020-04-15 @1069 struct qxl_device *qdev = to_qxl(dev);
1b043677d4be206 Gerd Hoffmann 2019-01-18 1070 struct qxl_output *output = drm_connector_to_qxl_output(connector);
1b000494978d2f3 Shayenne da Luz Moura 2018-10-26 1071 unsigned int pwidth = 1024;
1b000494978d2f3 Shayenne da Luz Moura 2018-10-26 1072 unsigned int pheight = 768;
bf72b40d47f83ac Julio Faracco 2026-10-08 1073 struct qxl_head *head;
2d856f94e6d2532 Gerd Hoffmann 2017-03-01 1074 int ret = 0;
f64122c1f6ade30 Dave Airlie 2013-02-25 1075
bf72b40d47f83ac Julio Faracco 2026-10-08 1076 head = qxl_output_get_client_head(output);
bf72b40d47f83ac Julio Faracco 2026-10-08 1077 if (head) {
1b043677d4be206 Gerd Hoffmann 2019-01-18 1078 if (head->width)
1b043677d4be206 Gerd Hoffmann 2019-01-18 1079 pwidth = head->width;
1b043677d4be206 Gerd Hoffmann 2019-01-18 1080 if (head->height)
1b043677d4be206 Gerd Hoffmann 2019-01-18 1081 pheight = head->height;
1b043677d4be206 Gerd Hoffmann 2019-01-18 1082 }
1b043677d4be206 Gerd Hoffmann 2019-01-18 1083
b5f030b7b4a5c8e Gerd Hoffmann 2019-01-18 1084 ret += drm_add_modes_noedid(connector, 8192, 8192);
b5f030b7b4a5c8e Gerd Hoffmann 2019-01-18 1085 ret += qxl_add_extra_modes(connector);
1b043677d4be206 Gerd Hoffmann 2019-01-18 1086 ret += qxl_add_monitors_config_modes(connector);
1b043677d4be206 Gerd Hoffmann 2019-01-18 1087 drm_set_preferred_mode(connector, pwidth, pheight);
f64122c1f6ade30 Dave Airlie 2013-02-25 1088 return ret;
f64122c1f6ade30 Dave Airlie 2013-02-25 1089 }
f64122c1f6ade30 Dave Airlie 2013-02-25 1090
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki