The map path computed the framebuffer size as stride*(height-1)+linesize, while the unmap callback in ramfb_unmap_display_surface used stride*height. This mismatch means we unmap more bytes than we mapped.
Fix the unmap callback to recompute linesize from the pixman image properties and use stride*(height-1)+linesize, matching the map path. The last scanline only occupies linesize bytes, so there is no need to map the trailing stride padding. Reported-by: Pavee Hui <[email protected]> Fixes: 3fcf15df0073 ("ramfb: fix size calculation") Signed-off-by: Marc-André Lureau <[email protected]> --- hw/display/ramfb.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/hw/display/ramfb.c b/hw/display/ramfb.c index 2d5378754717..956c2660cb52 100644 --- a/hw/display/ramfb.c +++ b/hw/display/ramfb.c @@ -41,8 +41,11 @@ struct RAMFBState { static void ramfb_unmap_display_surface(pixman_image_t *image, void *unused) { void *data = pixman_image_get_data(image); - uint32_t size = pixman_image_get_stride(image) * - pixman_image_get_height(image); + int stride = pixman_image_get_stride(image); + int height = pixman_image_get_height(image); + hwaddr linesize = pixman_image_get_width(image) * + PIXMAN_FORMAT_BPP(pixman_image_get_format(image)) / 8; + hwaddr size = (hwaddr)stride * (height - 1) + linesize; physical_memory_unmap(data, size, 0, 0); } -- 2.56.0.rc0.29.g47ce80527c56
