Adding fixes from Linaro
authorRicardo Salveti de Araujo <ricardo.salveti@linaro.org>
Tue, 17 Jul 2012 23:17:24 +0000 (20:17 -0300)
committerXavier Boudet <x-boudet@ti.com>
Tue, 21 Aug 2012 14:50:59 +0000 (16:50 +0200)
 * debian/patches/111_armel-drv-fallbacks.patch:
   - Make Panda able to load the omap video driver without the need of a
     config
 * debian/patches/516-randr-first-check-pScrPriv-before-using-the-pointer.patch
 * debian/patches/517-randr-Catch-two-more-potential-unset-rrScrPriv-uses.patch:
   - Add upstream patches to avoid seg fault in case the user is running with
     multiple screens and xrandr is only enabled at one (LP: #1015292)

Signed-off-by: Ricardo Salveti de Araujo <ricardo.salveti@linaro.org>
debian/patches/111_armel-drv-fallbacks.patch
debian/patches/516-randr-first-check-pScrPriv-before-using-the-pointer.patch [new file with mode: 0644]
debian/patches/517-randr-Catch-two-more-potential-unset-rrScrPriv-uses.patch [new file with mode: 0644]
debian/patches/series

index 501427896de2a86b57542b612bb86a770cf37f72..50d0c6f4434a39c173bcaab982e6b4df2e872c58 100644 (file)
@@ -1,7 +1,7 @@
 Index: xorg-server-1.11.4/hw/xfree86/common/xf86AutoConfig.c
 ===================================================================
---- xorg-server-1.11.4.orig/hw/xfree86/common/xf86AutoConfig.c 2012-03-20 02:08:02.154998574 -0300
-+++ xorg-server-1.11.4/hw/xfree86/common/xf86AutoConfig.c      2012-03-20 02:08:46.819220051 -0300
+--- xorg-server-1.11.4.orig/hw/xfree86/common/xf86AutoConfig.c 2012-05-21 13:27:14.460110121 -0300
++++ xorg-server-1.11.4/hw/xfree86/common/xf86AutoConfig.c      2012-05-21 13:29:49.620879524 -0300
 @@ -44,6 +44,12 @@
  # include "xf86sbusBus.h"
  #endif
@@ -42,7 +42,7 @@ Index: xorg-server-1.11.4/hw/xfree86/common/xf86AutoConfig.c
  static void
  listPossibleVideoDrivers(char *matches[], int nmatches)
  {
-@@ -282,6 +308,16 @@
+@@ -282,6 +308,17 @@
  #if !defined(__linux__) && defined(__sparc__)
        matches[i++] = xnfstrdup("wsfb");
  #else
@@ -51,9 +51,10 @@ Index: xorg-server-1.11.4/hw/xfree86/common/xf86AutoConfig.c
 +           matches[i++] = xnfstrdup("imx");
 +        else if (test_sysfs_device("dovefb", "dovefb"))
 +           matches[i++] = xnfstrdup("dovefb");
-+        else if (test_sysfs_device("omap", "pvr"))
++        else if (test_sysfs_device("omap", "pvr")) {
 +           matches[i++] = xnfstrdup("pvr");
-+        else if (test_sysfs_device("omapfb", "omapfb"))
++           matches[i++] = xnfstrdup("omap");
++        } else if (test_sysfs_device("omapfb", "omapfb"))
 +           matches[i++] = xnfstrdup("omapfb");
 +#endif /* defined(__linux__) && defined(__arm__) */
        matches[i++] = xnfstrdup("fbdev");
diff --git a/debian/patches/516-randr-first-check-pScrPriv-before-using-the-pointer.patch b/debian/patches/516-randr-first-check-pScrPriv-before-using-the-pointer.patch
new file mode 100644 (file)
index 0000000..8c9cf71
--- /dev/null
@@ -0,0 +1,30 @@
+From 32603f57ca03b6390b109960f8bb5ea53ac95ecb Mon Sep 17 00:00:00 2001
+From: Ricardo Salveti de Araujo <ricardo.salveti@linaro.org>
+Date: Thu, 21 Jun 2012 00:55:53 -0300
+Subject: [PATCH] randr: first check pScrPriv before using the pointer at
+ RRFirstOutput
+
+Fix a seg fault in case pScrPriv is NULL at ProcRRGetScreenInfo,
+which later calls RRFirstOutput.
+
+Signed-off-by: Ricardo Salveti de Araujo <ricardo.salveti@linaro.org>
+Reviewed-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+---
+ randr/randr.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+Index: xorg-server-1.11.4/randr/randr.c
+===================================================================
+--- xorg-server-1.11.4.orig/randr/randr.c      2012-07-17 18:46:06.000000000 -0300
++++ xorg-server-1.11.4/randr/randr.c   2012-07-17 18:48:35.169824448 -0300
+@@ -454,6 +454,9 @@
+     rrScrPriv(pScreen);
+     RROutputPtr                   output;
+     int       i, j;
++
++    if (!pScrPriv)
++        return NULL;
+     
+     if (pScrPriv->primaryOutput && pScrPriv->primaryOutput->crtc)
+       return pScrPriv->primaryOutput;
diff --git a/debian/patches/517-randr-Catch-two-more-potential-unset-rrScrPriv-uses.patch b/debian/patches/517-randr-Catch-two-more-potential-unset-rrScrPriv-uses.patch
new file mode 100644 (file)
index 0000000..e37d073
--- /dev/null
@@ -0,0 +1,52 @@
+From 855003c333a0ead1db912695bc9705ef2b3144b4 Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp@keithp.com>
+Date: Thu, 21 Jun 2012 18:45:18 -0700
+Subject: [PATCH] randr: Catch two more potential unset rrScrPriv uses
+
+Ricardo Salveti <ricardo.salveti@linaro.org> found one place where the
+randr code could use the randr screen private data without checking
+for null first. This happens when the X server is running with
+multiple screens, some of which are randr enabled and some of which
+are not. Applications making protocol requests to the non-randr
+screens can cause segfaults where the server touches the unset private
+structure.
+
+I audited the code and found two more possible problem spots; the
+trick to auditing for this issue was to look for functions not taking
+a RandR data structure and where there was no null screen private
+check above them in the call graph.
+
+Signed-off-by: Keith Packard <keithp@keithp.com>
+---
+ randr/rroutput.c |    3 ++-
+ randr/rrscreen.c |    3 +++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/randr/rroutput.c b/randr/rroutput.c
+index 091e06b..fbd0e32 100644
+--- a/randr/rroutput.c
++++ b/randr/rroutput.c
+@@ -546,7 +546,8 @@ ProcRRSetOutputPrimary(ClientPtr client)
+     }
+     pScrPriv = rrGetScrPriv(pWin->drawable.pScreen);
+-    RRSetPrimaryOutput(pWin->drawable.pScreen, pScrPriv, output);
++    if (pScrPriv)
++        RRSetPrimaryOutput(pWin->drawable.pScreen, pScrPriv, output);
+     return Success;
+ }
+diff --git a/randr/rrscreen.c b/randr/rrscreen.c
+index f570afa..55110e0 100644
+--- a/randr/rrscreen.c
++++ b/randr/rrscreen.c
+@@ -261,6 +261,9 @@
+     pScreen = pWin->drawable.pScreen;
+     pScrPriv = rrGetScrPriv(pScreen);
++    if (!pScrPriv)
++        return BadMatch;
++
+     if (stuff->width < pScrPriv->minWidth || pScrPriv->maxWidth < stuff->width)
+     {
+       client->errorValue = stuff->width;
index c548ae17ba7f36c62a6653faa1f812d532789033..325ccbe1d665e929b45f115c079619932cd89885 100644 (file)
@@ -55,3 +55,7 @@
 # Rotation patches
 1001-xfree86-modes-Let-the-driver-handle-the-transform.patch
 1002-xfree86-modes-Make-cursor-position-transform-a-helpe.patch
+
+# Upstream patches
+516-randr-first-check-pScrPriv-before-using-the-pointer.patch
+517-randr-Catch-two-more-potential-unset-rrScrPriv-uses.patch