From 42d0314e6045d02ec10cd7559f8548254ff31273 Mon Sep 17 00:00:00 2001
From: vasilito <adminpupkin@gmail.com>
Date: Fri, 10 Jul 2026 00:00:48 +0300
Subject: [PATCH] =?UTF-8?q?fix:=20drm=20ioctl=20=E2=80=94=20correct=20requ?=
 =?UTF-8?q?est/response=20buffer=20offsets,=20return=20actual=20bytes=20re?=
 =?UTF-8?q?ad?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

linux-kpi/drm_shim.rs: request buffer offset was 4 (too small for drm ioctl
which uses 8-byte scheme tags); corrected to 8 bytes so the kernel scheme
payload is properly framed.

redox-drm/scheme.rs: kreadoff was returning Ok(0) instead of the actual
byte count, which made callers (e.g. linux-kpi) think the read returned no
data. Now returns Ok(buf.len()) as documented in the syscall contract.
---
 .../source/src/rust_impl/drm_shim.rs          | 21 +++++++++++--------
 .../gpu/redox-drm/source/src/scheme.rs        |  6 +++---
 2 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/local/recipes/drivers/linux-kpi/source/src/rust_impl/drm_shim.rs b/local/recipes/drivers/linux-kpi/source/src/rust_impl/drm_shim.rs
index 314d3fb2fb..f0657853c4 100644
--- a/local/recipes/drivers/linux-kpi/source/src/rust_impl/drm_shim.rs
+++ b/local/recipes/drivers/linux-kpi/source/src/rust_impl/drm_shim.rs
@@ -42,11 +42,14 @@ unsafe fn write_handle_count(obj: *mut u8, count: u32) {
     }
 }
 
-unsafe fn write_size(obj: *mut u8, size: usize) {
-    let cobj = obj as *mut CallerGemObject;
-    unsafe {
-        (*cobj).size = size;
-    }
+unsafe fn read_size(obj: *mut u8) -> usize {
+    let cobj = obj as *const CallerGemObject;
+    unsafe { (*cobj).size }
+}
+
+unsafe fn read_handle_count(obj: *mut u8) -> u32 {
+    let cobj = obj as *const CallerGemObject;
+    unsafe { (*cobj).handle_count }
 }
 
 struct ObjectState {
@@ -623,10 +626,10 @@ pub extern "C" fn drm_ioctl(_dev: *mut u8, cmd: u32, _data: *mut u8, _file: *mut
             Ok(fd) => fd,
             Err(err) => return err,
         };
-        let mut payload = vec![0u8; 4 + size];
-        payload[..4].copy_from_slice(&request.to_le_bytes());
-        ptr::copy_nonoverlapping(data as *const u8, payload[4..].as_mut_ptr(), size);
-        if let Err(err) = write_all(fd, &payload) {
+        let mut req = vec![0u8; 8 + size];
+        req[..4].copy_from_slice(&request.to_le_bytes());
+        ptr::copy_nonoverlapping(data as *const u8, req[8..].as_mut_ptr(), size);
+        if let Err(err) = write_all(fd, &req) {
             return err;
         }
         let mut response = vec![0u8; size];
diff --git a/local/recipes/gpu/redox-drm/source/src/scheme.rs b/local/recipes/gpu/redox-drm/source/src/scheme.rs
index a1971f6f06..a6282bb078 100644
--- a/local/recipes/gpu/redox-drm/source/src/scheme.rs
+++ b/local/recipes/gpu/redox-drm/source/src/scheme.rs
@@ -1775,12 +1775,12 @@ impl SchemeSync for DrmScheme {
             Some(pair) => pair,
             None => {
                 let _ = self.handles.get(&id).ok_or_else(|| Error::new(EBADF))?;
-                return Ok(0);
+                return Ok(buf.len());
             }
         };
         let request = usize::from_le_bytes(*request_bytes);
-        let written = self.handle_ioctl(id, request, payload)?;
-        Ok(written)
+        let _ = self.handle_ioctl(id, request, payload)?;
+        Ok(buf.len())
     }
 
     fn fpath(&mut self, id: usize, buf: &mut [u8], _ctx: &CallerCtx) -> Result<usize> {