xserver: Branch 'server-1.20-branch' - 2 commits

[GitLab Mirror]

 hw/xwayland/xwayland-glamor-eglstream.c |    2 +-
 hw/xwayland/xwayland-glamor-gbm.c       |   19 ++-----------------
 2 files changed, 3 insertions(+), 18 deletions(-)

New commits:
commit 1930ed233fdec5d22e4fc192769a0126faabb3ea
Author: Olivier Fourdan <ofourdan at redhat.com>
Date:   Mon Sep 14 15:39:10 2020 +0200

    xwayland: Remove pending stream reference when freeing
    
    The EGLStream backend keeps a queue of pending streams for each Xwayland
    window.
    
    However, when this pending queue is freed, the corresponding private
    data may not be cleared (typically if the pixmap for this window has
    changed before the compositor finished attaching the consumer for the
    window's pixmap's original eglstream), leading to a use-after-free and a
    crash when trying to use that data as the window pixmap.
    
    Make sure to clear the private data when the pending stream is freed.
    
    Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1055
    Signed-off-by: Olivier Fourdan <ofourdan at redhat.com>
    Tested-by: Karol Szuster <karolsz9898 at gmail.com>
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    (cherry picked from commit a5f439dcd21b4fda093cb382bb1a758b434a1444)

diff --git a/hw/xwayland/xwayland-glamor-eglstream.c b/hw/xwayland/xwayland-glamor-eglstream.c
index 36b749aaf..0c32fff4d 100644
--- a/hw/xwayland/xwayland-glamor-eglstream.c
+++ b/hw/xwayland/xwayland-glamor-eglstream.c
@@ -431,8 +431,8 @@ xwl_eglstream_consumer_ready_callback(void *data,
     DebugF("eglstream: win %d completes eglstream for pixmap %p, congrats!\n",
            pending->window->drawable.id, pending->pixmap);
 
-    xwl_eglstream_window_set_pending(pending->window, NULL);
 out:
+    xwl_eglstream_window_set_pending(pending->window, NULL);
     xorg_list_del(&pending->link);
     free(pending);
 }
commit 1ac389dda89b2882c80767c91bbe88e01818491c
Author: Greg V <greg at unrelenting.technology>
Date:   Tue Sep 15 17:41:04 2020 +0300

    xwayland: use drmGetNodeTypeFromFd for checking if a node is a render one
    
    Major/minor numbers are a.. major (ha) source of pain in FreeBSD porting.
    In this case, Xwayland was thinking that /dev/dri/card0 is already a render node,
    because the st_rdev on FreeBSD was passing the Linux-style check,
    and because of the assumption, acceleration would fail because
    various ioctls like AMDGPU_INFO would be denied on the non-render node.
    
    Switch to libdrm's function that already works correctly on all platforms.
    
    Signed-off-by: Greg V <greg at unrelenting.technology>
    Reviewed-by: Emmanuel Vadot <manu at FreeBSD.org>
    (cherry picked from commit 239ebdc9e447d4f836d0c2aa6068c6064fffb46c)

diff --git a/hw/xwayland/xwayland-glamor-gbm.c b/hw/xwayland/xwayland-glamor-gbm.c
index ebff70a00..b519492cc 100644
--- a/hw/xwayland/xwayland-glamor-gbm.c
+++ b/hw/xwayland/xwayland-glamor-gbm.c
@@ -110,21 +110,6 @@ wl_drm_format_for_depth(int depth)
     }
 }
 
-static char
-is_fd_render_node(int fd)
-{
-    struct stat render;
-
-    if (fstat(fd, &render))
-        return 0;
-    if (!S_ISCHR(render.st_mode))
-        return 0;
-    if (render.st_rdev & 0x80)
-        return 1;
-
-    return 0;
-}
-
 static char
 is_device_path_render_node (const char *device_path)
 {
@@ -135,7 +120,7 @@ is_device_path_render_node (const char *device_path)
     if (fd < 0)
         return 0;
 
-    is_render_node = is_fd_render_node(fd);
+    is_render_node = (drmGetNodeTypeFromFd(fd) == DRM_NODE_RENDER);
     close(fd);
 
     return is_render_node;
@@ -767,7 +752,7 @@ xwl_drm_handle_device(void *data, struct wl_drm *drm, const char *device)
        return;
    }
 
-   if (is_fd_render_node(xwl_gbm->drm_fd)) {
+   if (drmGetNodeTypeFromFd(xwl_gbm->drm_fd) == DRM_NODE_RENDER) {
        xwl_gbm->fd_render_node = 1;
        xwl_screen->expecting_event--;
    } else {