summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPeter Wu <peter@lekensteyn.nl>2019-11-15 16:32:47 +0100
committerChris Wilson <chris@chris-wilson.co.uk>2019-11-15 19:20:30 +0000
commitcb6bff95ed900ffed99750dba9b9605581805904 (patch)
tree59786c784d7c23639fcc10536d93873427e86460
parentb5ac286c9bb0e13c5c23b2f76c7b9445587371df (diff)
downloadxorg-driver-xf86-video-intel-cb6bff95ed900ffed99750dba9b9605581805904.tar.gz
sn: fix PRIME output support since xserver 1.20
Since "Make PixmapDirtyUpdateRec::src a DrawablePtr" in xserver, the "src" pointer might point to the root window (created by the server) instead of a pixmap (as created by xf86-video-intel). Use get_drawable_pixmap to handle both cases. When built with -fsanitize=address, the following test on a hybrid graphics laptop will trigger a heap-buffer-overflow error due to to_sna_from_pixmap receiving a window instead of a pixmap: xrandr --setprovideroutputsource modesetting Intel xrandr --output DP-1-1 --mode 2560x1440 # should not crash glxgears # should display gears on both screens With nouveau instead of modesetting, it does not crash but the external monitor remains blank aside from a mouse cursor. This patch fixes both. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100086 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111976 Signed-off-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
-rw-r--r--src/sna/sna_accel.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index a464f4b4..98084bb0 100644
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -17686,10 +17686,10 @@ static void sna_accel_post_damage(struct sna *sna)
continue;
#ifdef HAS_DIRTYTRACKING_DRAWABLE_SRC
- assert(dirty->src->type == DRAWABLE_PIXMAP);
+ src = get_drawable_pixmap(dirty->src);
+#else
+ src = dirty->src;
#endif
-
- src = (PixmapPtr)dirty->src;
dst = dirty->slave_dst->master_pixmap;
region.extents.x1 = dirty->x;