xserver: Branch 'master'

[GitLab Mirror]

 hw/xfree86/drivers/modesetting/drmmode_display.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

New commits:
commit 73480f172aeced074dd9301ae4d97f7d2f3a9a45
Author: Jose Maria Casanova Crespo <jmcasanova at igalia.com>
Date:   Fri May 15 18:33:11 2020 +0200

    modesetting: Fix front_bo leak at drmmode_xf86crtc_resize on XRandR rotation
    
    Since the introduction of "modesetting: Remove unnecessary fb addition from
    drmmode_xf86crtc_resize" the fb_id isn't initialited at
    drmmode_xf86crtc_resize.
    
    Rotate operation of XRandR uses rotate_bo. So in this case the fb_id
    associated to the front_bo is not initialized at drmmode_set_mode_major.
    So fd_id remains 0.
    
    As every call to drmmode_xf86crtc_resize allocates a new front_bo we should
    destroy unconditionally the old_front_bo if operation success. So we free
    the allocated GBM handles.
    
    This avoids crashing xserver with a OOM in the RPI4 1Gb at 4k resolution
    after 3 series xrandr rotations from normal to left and vice versa reported at
    https://github.com/raspberrypi/firmware/issues/1345
    
    Signed-off-by: Jose Maria Casanova Crespo <jmcasanova at igalia.com>
    Reviewed-by: Keith Packard <keithp at keithp.com>
    Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1024
    Fixes: 8774532121 "modesetting: Remove unnecessary fb addition from
           drmmode_xf86crtc_resize"

diff --git a/hw/xfree86/drivers/modesetting/drmmode_display.c b/hw/xfree86/drivers/modesetting/drmmode_display.c
index 5a453474b..a9a83aa8b 100644
--- a/hw/xfree86/drivers/modesetting/drmmode_display.c
+++ b/hw/xfree86/drivers/modesetting/drmmode_display.c
@@ -3233,10 +3233,10 @@ drmmode_xf86crtc_resize(ScrnInfoPtr scrn, int width, int height)
                                crtc->rotation, crtc->x, crtc->y);
     }
 
-    if (old_fb_id) {
+    if (old_fb_id)
         drmModeRmFB(drmmode->fd, old_fb_id);
-        drmmode_bo_destroy(drmmode, &old_front);
-    }
+
+    drmmode_bo_destroy(drmmode, &old_front);
 
     return TRUE;