xf86-video-intel: 3 commits - src/sna/sna_accel.c src/sna/sna_dri.c

[Chris Wilson]

 src/sna/sna_accel.c |    3 ++-
 src/sna/sna_dri.c   |   15 +++++++--------
 2 files changed, 9 insertions(+), 9 deletions(-)

New commits:
commit d995705fb01842652a79076cbecee4392f653bfe
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Fri Sep 14 19:32:06 2012 +0100

    sna: Only discard CPU damage if we completely overwrite its extents
    
    If we are performing a clipped copy, then we must be careful not to
    completely discard the CPU damage as it may not be entirely replaced.
    
    Reported-by: Roman Jarosz <kedgedev at gmail.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=54937
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index 7db7368..6832a7c 100644
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -4410,7 +4410,8 @@ sna_copy_boxes(DrawablePtr src, DrawablePtr dst, GCPtr gc,
 			sna_damage_destroy(&dst_priv->cpu_damage);
 			list_del(&dst_priv->list);
 		}
-		hint |= IGNORE_CPU;
+		if (region->data == NULL)
+			hint |= IGNORE_CPU;
 	}
 
 	bo = sna_drawable_use_bo(&dst_pixmap->drawable, hint,
commit deacab87e4ba7fe09f0f16568dc2848949f2707a
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Fri Sep 14 17:01:13 2012 +0100

    sna/dri: flip->next_front.bo is owned by the DRI drawable not by the flip
    
    Be careful not to delete the reference we presume we hold as it is
    borrowed from the DRI drawable.
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna_dri.c b/src/sna/sna_dri.c
index d6cc2aa..b1fba20 100644
--- a/src/sna/sna_dri.c
+++ b/src/sna/sna_dri.c
@@ -941,9 +941,6 @@ sna_dri_frame_event_info_free(struct sna *sna,
 	if (info->old_front.bo)
 		kgem_bo_destroy(&sna->kgem, info->old_front.bo);
 
-	if (info->next_front.bo)
-		kgem_bo_destroy(&sna->kgem, info->next_front.bo);
-
 	if (info->cache.bo)
 		kgem_bo_destroy(&sna->kgem, info->cache.bo);
 
@@ -1431,7 +1428,6 @@ static void sna_dri_flip_event(struct sna *sna,
 
 			flip->cache = flip->old_front;
 			flip->old_front = flip->next_front;
-			flip->next_front.bo = NULL;
 
 			flip->count = sna_page_flip(sna,
 						    get_private(flip->front)->bo,
@@ -1457,8 +1453,6 @@ static void sna_dri_flip_event(struct sna *sna,
 			sna->dri.flip_pending = flip;
 		} else {
 finish_async_flip:
-			flip->next_front.bo = NULL;
-
 			DBG(("%s: async flip completed\n", __FUNCTION__));
 			sna_dri_frame_event_info_free(sna, draw, flip);
 		}
commit 5369408d596a0611d4f76333dac2e1c93e63e8b6
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Fri Sep 14 16:12:00 2012 +0100

    sna/dri: And the hunt for the use-after-free continues...
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna_dri.c b/src/sna/sna_dri.c
index 2296ab6..d6cc2aa 100644
--- a/src/sna/sna_dri.c
+++ b/src/sna/sna_dri.c
@@ -196,11 +196,13 @@ static struct kgem_bo *sna_pixmap_set_dri(struct sna *sna,
 
 constant static inline void *sna_pixmap_get_buffer(PixmapPtr pixmap)
 {
+	assert(pixmap->refcnt);
 	return ((void **)dixGetPrivateAddr(&pixmap->devPrivates, &sna_pixmap_key))[2];
 }
 
 static inline void sna_pixmap_set_buffer(PixmapPtr pixmap, void *ptr)
 {
+	assert(pixmap->refcnt);
 	((void **)dixGetPrivateAddr(&pixmap->devPrivates, &sna_pixmap_key))[2] = ptr;
 }
 
@@ -429,8 +431,11 @@ static void set_bo(PixmapPtr pixmap, struct kgem_bo *bo)
 	sna_damage_destroy(&priv->cpu_damage);
 	priv->undamaged = false;
 
-	kgem_bo_destroy(&sna->kgem, priv->gpu_bo);
-	priv->gpu_bo = ref(bo);
+	assert(bo->refcnt);
+	if (priv->gpu_bo != bo) {
+		kgem_bo_destroy(&sna->kgem, priv->gpu_bo);
+		priv->gpu_bo = ref(bo);
+	}
 	if (bo->domain != DOMAIN_GPU)
 		bo->domain = DOMAIN_NONE;