From 1259abed5fae505e4173bdff693eb8633071b114 Mon Sep 17 00:00:00 2001
From: Anuar Lukpanov <156117923+Mi-Yomi@users.noreply.github.com>
Date: Sun, 1 Nov 2026 11:33:03 +0500
Subject: [PATCH] fix(quest): check a caught-up KGSL context at timestamp zero
 too

A context with no submissions skipped the ownership check. Check whenever
nothing is pending, since a pending timestamp's wait already checks it.
---
 tools/linuxfs/preload/kgslpoll.c |  2 +-
 tools/tests/test_kgsl_read.c     | 13 +++++++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/tools/linuxfs/preload/kgslpoll.c b/tools/linuxfs/preload/kgslpoll.c
index 7b877b9fa..83e16bc82 100644
--- a/tools/linuxfs/preload/kgslpoll.c
+++ b/tools/linuxfs/preload/kgslpoll.c
@@ -50,7 +50,7 @@ static int read_retired(int (*real)(int, unsigned long, void *), int fd,
   timestamp = __atomic_load_n(&contexts[id].retired, __ATOMIC_RELAXED);
   submitted = __atomic_load_n(&contexts[id].submitted, __ATOMIC_RELAXED);
   /* KGSL checks a context's owner on every wait, which catches one that died with a reused descriptor. */
-  if (timestamp != 0 && wait_retired(real, fd, id, timestamp) < 0) return -1;
+  if (timestamp == submitted && wait_retired(real, fd, id, timestamp) < 0) return -1;
   while (timestamp != submitted) {
     result = wait_retired(real, fd, id, timestamp + 1);
     if (result < 0) return -1;
diff --git a/tools/tests/test_kgsl_read.c b/tools/tests/test_kgsl_read.c
index 23fcd37df..d7d137aea 100644
--- a/tools/tests/test_kgsl_read.c
+++ b/tools/tests/test_kgsl_read.c
@@ -74,8 +74,13 @@ int main(void) {
   assert(read_timestamp(3, &timestamp) == -1 && errno == EACCES && waits == 0);
 
   create_context(3);
-  assert(read_timestamp(3, &timestamp) == 0 && timestamp == 0 && waits == 0);
+  assert(read_timestamp(3, &timestamp) == 0 && timestamp == 0 && waits == 1);
 
+  wait_error = EINVAL;
+  assert(read_timestamp(3, &timestamp) == -1 && errno == EINVAL);
+  wait_error = 0;
+
+  waits = 0;
   read_error = EBADF;
   assert(read_timestamp(3, &timestamp) == -1 && errno == EBADF && waits == 0);
   read_error = EACCES;
@@ -95,11 +100,11 @@ int main(void) {
   assert(read_timestamp(3, &timestamp) == 0 && timestamp == 2 && waits == 3);
 
   waits = 0;
-  assert(read_timestamp(3, &timestamp) == 0 && timestamp == 2 && waits == 2);
+  assert(read_timestamp(3, &timestamp) == 0 && timestamp == 2 && waits == 1);
 
   retired = 3;
   waits = 0;
-  assert(read_timestamp(3, &timestamp) == 0 && timestamp == 3 && waits == 2);
+  assert(read_timestamp(3, &timestamp) == 0 && timestamp == 3 && waits == 1);
 
   waits = 0;
   assert(read_timestamp(3, &timestamp) == 0 && timestamp == 3 && waits == 1);
@@ -123,7 +128,7 @@ int main(void) {
   create_context(3);
   retired = 0;
   waits = 0;
-  assert(read_timestamp(3, &timestamp) == 0 && timestamp == 0 && waits == 0);
+  assert(read_timestamp(3, &timestamp) == 0 && timestamp == 0 && waits == 1);
 
   struct kgsl_drawctxt_destroy destroy = {.drawctxt_id = 3};
   bl_kgsl_track(mock, 42, IOCTL_KGSL_DRAWCTXT_DESTROY, &destroy, &rc);