xserver: Branch 'master' - 3 commits

[GitLab Mirror]

 hw/xwayland/xwayland-present.c |    8 ++++++++
 present/present_wnmd.c         |    8 ++++----
 2 files changed, 12 insertions(+), 4 deletions(-)

New commits:
commit b6b1161fd7ac409156fb69439897bcabdeacf393
Author: Michel Dänzer <mdaenzer at redhat.com>
Date:   Fri Sep 4 12:50:00 2020 +0200

    present/wnmd: Remove dead check from present_wnmd_check_flip
    
    present_wnmd_toplvl_pixmap_window returns a window with the same window
    pixmap, so the check could never fail.
    
    Reviewed-by: Roman Gilg <subdiff at gmail.com>

diff --git a/present/present_wnmd.c b/present/present_wnmd.c
index 5420d54e8..97b8fe00c 100644
--- a/present/present_wnmd.c
+++ b/present/present_wnmd.c
@@ -305,10 +305,6 @@ present_wnmd_check_flip(RRCrtcPtr           crtc,
     if (!screen_priv->wnmd_info->flip)
         return FALSE;
 
-    /* Can't flip redirected child windows */
-    if (screen->GetWindowPixmap(window) != screen->GetWindowPixmap(toplvl_window))
-        return FALSE;
-
     /* Source pixmap must align with window exactly */
     if (x_off || y_off)
         return FALSE;
commit 4c25356d6cd908c5030c70e712076dff318ac00d
Author: Michel Dänzer <mdaenzer at redhat.com>
Date:   Thu Aug 27 18:36:15 2020 +0200

    xwayland: Check window pixmap in xwl_present_check_flip2
    
    We can only flip if the window pixmap matches that of the toplevel
    window. Doing so regardless could cause the toplevel window pixmap to
    get destroyed while it was still referenced by the window, resulting in
    use-after-free and likely a crash.
    
    Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1033
    Reviewed-by: Olivier Fourdan <ofourdan at redhat.com>
    Reviewed-by: Roman Gilg <subdiff at gmail.com>

diff --git a/hw/xwayland/xwayland-present.c b/hw/xwayland/xwayland-present.c
index a4ecdada4..afcd03187 100644
--- a/hw/xwayland/xwayland-present.c
+++ b/hw/xwayland/xwayland-present.c
@@ -399,10 +399,18 @@ xwl_present_check_flip2(RRCrtcPtr crtc,
                         PresentFlipReason *reason)
 {
     struct xwl_window *xwl_window = xwl_window_from_window(present_window);
+    ScreenPtr screen = pixmap->drawable.pScreen;
 
     if (!xwl_window)
         return FALSE;
 
+    /* Can't flip if the window pixmap doesn't match the xwl_window parent
+     * window's, e.g. because a client redirected this window or one of its
+     * parents.
+     */
+    if (screen->GetWindowPixmap(xwl_window->window) != screen->GetWindowPixmap(present_window))
+        return FALSE;
+
     /*
      * We currently only allow flips of windows, that have the same
      * dimensions as their xwl_window parent window. For the case of
commit 7ac303c7b1e3b1be79ba3648e217798683e65a99
Author: Michel Dänzer <mdaenzer at redhat.com>
Date:   Fri Aug 28 11:57:39 2020 +0200

    present/wnmd: Can't use page flipping for windows clipped by children
    
    Noticed this was missing while working on the following fix.
    
    v2:
    * Dropped present_wnmd_can_window_flip hunk (that function is never
      called, will be cleaned up in a follow-up MR).
    
    Reviewed-by: Olivier Fourdan <ofourdan at redhat.com> # v1
    Reviewed-by: Roman Gilg <subdiff at gmail.com>

diff --git a/present/present_wnmd.c b/present/present_wnmd.c
index 4ee2585c2..5420d54e8 100644
--- a/present/present_wnmd.c
+++ b/present/present_wnmd.c
@@ -326,6 +326,10 @@ present_wnmd_check_flip(RRCrtcPtr           crtc,
     if ( !RegionEqual(&window->winSize, &toplvl_window->winSize) )
         return FALSE;
 
+    /* Can't flip if window clipped by children */
+    if (!RegionEqual(&window->clipList, &window->winSize))
+        return FALSE;
+
     /* Ask the driver for permission */
     if (screen_priv->wnmd_info->check_flip2) {
         if (!(*screen_priv->wnmd_info->check_flip2) (crtc, window, pixmap, sync_flip, reason)) {