xf86-video-intel: 2 commits - src/sna/sna_display.c src/sna/sna_render.c

[Chris Wilson]

 src/sna/sna_display.c |   60 +++++++++++++++++++++-----------------------------
 src/sna/sna_render.c  |    5 ++++
 2 files changed, 31 insertions(+), 34 deletions(-)

New commits:
commit 916354164bcb149e1323a3219d85e7bba6e61e04
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Tue May 27 20:16:55 2014 +0100

    sna: Fix the depth/format on the temporary shadow Pictures
    
    When scaling the output, we re-render onto the scanout using a call to
    Composite, for which we create temporary Pictures. In most cases, the
    mismatching depth/format goes unnoticed, but along one particular
    fallback path, we use those to create a new Picture but the mismatching
    format results in a segfault.
    
    Reported-by: Matti Hämäläinen <ccr at tnsp.org>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=79320
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna_display.c b/src/sna/sna_display.c
index 2891b74..3980650 100644
--- a/src/sna/sna_display.c
+++ b/src/sna/sna_display.c
@@ -5165,38 +5165,34 @@ sna_crtc_redisplay__fallback(xf86CrtcPtr crtc, RegionPtr region, struct kgem_bo
 	PictFormatPtr format;
 	PicturePtr src, dst;
 	PixmapPtr pixmap;
-	int error;
+	int depth, error;
 	void *ptr;
 
 	DBG(("%s: compositing transformed damage boxes\n", __FUNCTION__));
 
+	error = sna_render_format_for_depth(sna->front->drawable.depth);
+	depth = PIXMAN_FORMAT_DEPTH(error);
+	format = PictureMatchFormat(screen, depth, error);
+	if (format == NULL) {
+		DBG(("%s: can't find format for depth=%d [%08x]\n",
+		     __FUNCTION__, depth, error));
+		return;
+	}
+
 	ptr = kgem_bo_map__gtt(&sna->kgem, bo);
 	if (ptr == NULL)
 		return;
 
-	pixmap = sna_pixmap_create_unattached(screen,
-					      0, 0, sna->front->drawable.depth);
+	pixmap = sna_pixmap_create_unattached(screen, 0, 0, depth);
 	if (pixmap == NullPixmap)
 		return;
 
 	if (!screen->ModifyPixmapHeader(pixmap,
-					crtc->mode.HDisplay,
-					crtc->mode.VDisplay,
-					sna->front->drawable.depth,
-					sna->front->drawable.bitsPerPixel,
+					crtc->mode.HDisplay, crtc->mode.VDisplay,
+					depth, sna->front->drawable.bitsPerPixel,
 					bo->pitch, ptr))
 		goto free_pixmap;
 
-	error = sna_render_format_for_depth(sna->front->drawable.depth);
-	format = PictureMatchFormat(screen,
-				    PIXMAN_FORMAT_DEPTH(error), error);
-	if (format == NULL) {
-		DBG(("%s: can't find format for depth=%d [%08x]\n",
-		     __FUNCTION__, sna->front->drawable.depth,
-		     (int)sna_render_format_for_depth(sna->front->drawable.depth)));
-		goto free_pixmap;
-	}
-
 	src = CreatePicture(None, &sna->front->drawable, format,
 			    0, NULL, serverClient, &error);
 	if (!src)
@@ -5257,36 +5253,32 @@ sna_crtc_redisplay__composite(xf86CrtcPtr crtc, RegionPtr region, struct kgem_bo
 	PicturePtr src, dst;
 	PixmapPtr pixmap;
 	BoxPtr b;
-	int n, error;
+	int n, depth, error;
 
 	DBG(("%s: compositing transformed damage boxes\n", __FUNCTION__));
 
-	pixmap = sna_pixmap_create_unattached(screen,
-					      0, 0, sna->front->drawable.depth);
+	error = sna_render_format_for_depth(sna->front->drawable.depth);
+	depth = PIXMAN_FORMAT_DEPTH(error);
+	format = PictureMatchFormat(screen, depth, error);
+	if (format == NULL) {
+		DBG(("%s: can't find format for depth=%d [%08x]\n",
+		     __FUNCTION__, depth, error));
+		return;
+	}
+
+	pixmap = sna_pixmap_create_unattached(screen, 0, 0, depth);
 	if (pixmap == NullPixmap)
 		return;
 
 	if (!screen->ModifyPixmapHeader(pixmap,
-					crtc->mode.HDisplay,
-					crtc->mode.VDisplay,
-					sna->front->drawable.depth,
-					sna->front->drawable.bitsPerPixel,
+					crtc->mode.HDisplay, crtc->mode.VDisplay,
+					depth, sna->front->drawable.bitsPerPixel,
 					bo->pitch, NULL))
 		goto free_pixmap;
 
 	if (!sna_pixmap_attach_to_bo(pixmap, bo))
 		goto free_pixmap;
 
-	error = sna_render_format_for_depth(sna->front->drawable.depth);
-	format = PictureMatchFormat(screen,
-				    PIXMAN_FORMAT_DEPTH(error), error);
-	if (format == NULL) {
-		DBG(("%s: can't find format for depth=%d [%08x]\n",
-		     __FUNCTION__, sna->front->drawable.depth,
-		     (int)sna_render_format_for_depth(sna->front->drawable.depth)));
-		goto free_pixmap;
-	}
-
 	src = CreatePicture(None, &sna->front->drawable, format,
 			    0, NULL, serverClient, &error);
 	if (!src)
commit d8360bd74f5b62a27c019c65ed9001cac8bf43ed
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Tue May 27 20:14:02 2014 +0100

    sna: Handle bad picture format/depth mismatches
    
    Scaling the output feed in an invalid picture->format/depth combination
    which causes the fallback downsampling function to explode. Whilst this
    is a bug in the higher layer, we can handle the error anyway.
    
    References: https://bugs.freedesktop.org/show_bug.cgi?id=79320
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna_render.c b/src/sna/sna_render.c
index d3cb6a0..fd73b09 100644
--- a/src/sna/sna_render.c
+++ b/src/sna/sna_render.c
@@ -789,6 +789,11 @@ fixup:
 	format = PictureMatchFormat(screen,
 				    pixmap->drawable.depth,
 				    picture->format);
+	if (format == NULL) {
+		DBG(("%s: invalid depth=%d, format=%08x\n",
+		     __FUNCTION__, pixmap->drawable.depth, picture->format));
+		goto fixup;
+	}
 
 	tmp_dst = CreatePicture(0, &tmp->drawable, format, 0, NULL,
 				serverClient, &error);