xserver: Branch 'master' - 2 commits

[Adam Jackson]

 render/animcur.c |   35 +++++++++++++++++++++--------------
 1 file changed, 21 insertions(+), 14 deletions(-)

New commits:
commit 4d82a150b2ee29c1025408cdb9ece255452a81bd
Author: Adam Jackson <ajax at redhat.com>
Date:   Tue Jan 9 11:48:10 2018 -0500

    animcur: Handle allocation failure for the animation timer
    
    Signed-off-by: Adam Jackson <ajax at redhat.com>
    Reviewed-by: Aaron Plattner <aplattner at nvidia.com>
    Tested-by: Aaron Plattner <aplattner at nvidia.com>

diff --git a/render/animcur.c b/render/animcur.c
index 797029443..b5d222bc6 100644
--- a/render/animcur.c
+++ b/render/animcur.c
@@ -299,7 +299,7 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor,
                  CursorPtr *ppCursor, ClientPtr client, XID cid)
 {
     CursorPtr pCursor;
-    int rc, i;
+    int rc = BadAlloc, i;
     AnimCurPtr ac;
 
     for (i = 0; i < screenInfo.numScreens; i++)
@@ -314,7 +314,7 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor,
                                  sizeof(AnimCurRec) +
                                  ncursor * sizeof(AnimCurElt), 1);
     if (!pCursor)
-        return BadAlloc;
+        return rc;
     dixInitPrivates(pCursor, pCursor + 1, PRIVATE_CURSOR);
     pCursor->bits = &animCursorBits;
     pCursor->refcnt = 1;
@@ -333,8 +333,10 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor,
     ac->timer = TimerSet(NULL, 0, 0, AnimCurTimerNotify, NULL);
 
     /* security creation/labeling check */
-    rc = XaceHook(XACE_RESOURCE_ACCESS, client, cid, RT_CURSOR, pCursor,
-                  RT_NONE, NULL, DixCreateAccess);
+    if (ac->timer)
+        rc = XaceHook(XACE_RESOURCE_ACCESS, client, cid, RT_CURSOR, pCursor,
+                      RT_NONE, NULL, DixCreateAccess);
+
     if (rc != Success) {
         TimerFree(ac->timer);
         dixFiniPrivates(pCursor, PRIVATE_CURSOR);
commit de60245e05c0d2528d4ff42557a044387e53315c
Author: Adam Jackson <ajax at redhat.com>
Date:   Tue Jan 9 10:54:05 2018 -0500

    animcur: Fix transitions between animated cursors
    
    We weren't cancelling the old timer when changing cursors, making things
    go all crashy. Logically we could always cancel the timer first, but
    then we'd have to call TimerSet to re-arm ourselves, and GetTimeInMillis
    is potentially expensive.
    
    Reported-by: https://devtalk.nvidia.com/default/topic/1028172/linux/titan-v-ubuntu-16-04lts-and-387-34-driver-crashes-badly/post/5230967/#5230967
    Signed-off-by: Adam Jackson <ajax at redhat.com>
    Reviewed-by: Aaron Plattner <aplattner at nvidia.com>
    Tested-by: Aaron Plattner <aplattner at nvidia.com>

diff --git a/render/animcur.c b/render/animcur.c
index 058bc1b32..797029443 100644
--- a/render/animcur.c
+++ b/render/animcur.c
@@ -151,11 +151,20 @@ AnimCurTimerNotify(OsTimerPtr timer, CARD32 now, void *arg)
     return ac->elts[elt].delay;
 }
 
+static void
+AnimCurCancelTimer(DeviceIntPtr pDev)
+{
+    CursorPtr cur = pDev->spriteInfo->anim.pCursor;
+
+    if (IsAnimCur(cur))
+        TimerCancel(GetAnimCur(cur)->timer);
+}
+
 static Bool
 AnimCurDisplayCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCursor)
 {
     AnimCurScreenPtr as = GetAnimCurScreen(pScreen);
-    Bool ret;
+    Bool ret = TRUE;
 
     if (IsFloating(pDev))
         return FALSE;
@@ -165,8 +174,10 @@ AnimCurDisplayCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCursor)
         if (pCursor != pDev->spriteInfo->anim.pCursor) {
             AnimCurPtr ac = GetAnimCur(pCursor);
 
-            ret = (*pScreen->DisplayCursor)
-                (pDev, pScreen, ac->elts[0].pCursor);
+            AnimCurCancelTimer(pDev);
+            ret = (*pScreen->DisplayCursor) (pDev, pScreen,
+                                             ac->elts[0].pCursor);
+
             if (ret) {
                 pDev->spriteInfo->anim.elt = 0;
                 pDev->spriteInfo->anim.pCursor = pCursor;
@@ -176,15 +187,9 @@ AnimCurDisplayCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCursor)
                                      AnimCurTimerNotify, pDev);
             }
         }
-        else
-            ret = TRUE;
     }
     else {
-        CursorPtr old = pDev->spriteInfo->anim.pCursor;
-
-        if (old && IsAnimCur(old))
-            TimerCancel(GetAnimCur(old)->timer);
-
+        AnimCurCancelTimer(pDev);
         pDev->spriteInfo->anim.pCursor = 0;
         pDev->spriteInfo->anim.pScreen = 0;
         ret = (*pScreen->DisplayCursor) (pDev, pScreen, pCursor);