xf86-video-amdgpu: Branch 'master' - 3 commits

[Michel Dänzer]

 src/amdgpu_dri2.c     |    6 +++---
 src/amdgpu_probe.c    |    3 ++-
 src/drmmode_display.c |    2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)

New commits:
commit 9945b4ae1664ab815b39ff07e7b66cfa7f942dfa
Author: Tom St Denis <tom.stdenis at amd.com>
Date:   Wed Sep 9 09:38:02 2015 -0400

    Avoid use-after-free in drmmode_output_destroy()
    
    The encoders array is freed before potentially all of the elements of
    the array are individually freed.
    
    Signed-off-by: Tom St Denis <tom.stdenis at amd.com>
    Reviewed-by: Christian König <christian.koenig at amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Michel Dänzer <michel.daenzer at amd.com> (cosmetic fixups)

diff --git a/src/drmmode_display.c b/src/drmmode_display.c
index 88987d0..0af5044 100644
--- a/src/drmmode_display.c
+++ b/src/drmmode_display.c
@@ -1077,8 +1077,8 @@ static void drmmode_output_destroy(xf86OutputPtr output)
 	}
 	for (i = 0; i < drmmode_output->mode_output->count_encoders; i++) {
 		drmModeFreeEncoder(drmmode_output->mode_encoders[i]);
-		free(drmmode_output->mode_encoders);
 	}
+	free(drmmode_output->mode_encoders);
 	free(drmmode_output->props);
 	drmModeFreeConnector(drmmode_output->mode_output);
 	free(drmmode_output);
commit 36b3faebdd1d2090a286616eeeb131d15e9a1386
Author: Tom St Denis <tom.stdenis at amd.com>
Date:   Wed Sep 9 09:36:59 2015 -0400

    Avoid use-after-free in amdgpu_kernel_open_fd()
    
    If the device cannot be opened avoid re-using busid after it has been
    freed.
    
    Signed-off-by: Tom St Denis <tom.stdenis at amd.com>
    Reviewed-by: Christian König <christian.koenig at amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Michel Dänzer <michel.daenzer at amd.com> (cosmetic fixups)

diff --git a/src/amdgpu_probe.c b/src/amdgpu_probe.c
index 9edaf4f..ead248e 100644
--- a/src/amdgpu_probe.c
+++ b/src/amdgpu_probe.c
@@ -127,13 +127,14 @@ static int amdgpu_kernel_open_fd(ScrnInfoPtr pScrn, struct pci_device *dev)
 #endif
 
 	fd = drmOpen(NULL, busid);
-	free(busid);
 	if (fd == -1) {
 		xf86DrvMsg(pScrn->scrnIndex, X_ERROR,
 			   "[drm] Failed to open DRM device for %s: %s\n",
 			   busid, strerror(errno));
+		free(busid);
 		return fd;
 	}
+	free(busid);
 
 	/* Check that what we opened was a master or a master-capable FD,
 	 * by setting the version of the interface we'll use to talk to it.
commit 8823c3d4c6db70cff7699b31088f2d92db8faaf4
Author: Tom St Denis <tom.stdenis at amd.com>
Date:   Wed Sep 9 09:34:38 2015 -0400

    dri2: Avoid calculation with undefined msc value
    
    If the get_msc() call fails for any reason we should avoid updating the
    vblank counter delta with undefined data.
    
    Signed-off-by: Tom St Denis <tom.stdenis at amd.com>
    Reviewed-by: Christian König <christian.koenig at amd.com>
    Acked-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Michel Dänzer <michel.daenzer at amd.com> (minor fixups)

diff --git a/src/amdgpu_dri2.c b/src/amdgpu_dri2.c
index cdef3f2..0d9323b 100644
--- a/src/amdgpu_dri2.c
+++ b/src/amdgpu_dri2.c
@@ -507,9 +507,9 @@ xf86CrtcPtr amdgpu_dri2_drawable_crtc(DrawablePtr pDraw, Bool consider_disabled)
 		if (priv->crtc && priv->crtc != crtc) {
 			CARD64 ust, mscold, mscnew;
 
-			amdgpu_dri2_get_crtc_msc(priv->crtc, &ust, &mscold);
-			amdgpu_dri2_get_crtc_msc(crtc, &ust, &mscnew);
-			priv->vblank_delta += mscold - mscnew;
+			if (amdgpu_dri2_get_crtc_msc(priv->crtc, &ust, &mscold) &&
+			    amdgpu_dri2_get_crtc_msc(crtc, &ust, &mscnew))
+				priv->vblank_delta += mscold - mscnew;
 		}
 
 		priv->crtc = crtc;