From 22605effd188436629a0dbc688666549473741e4 Mon Sep 17 00:00:00 2001 From: Adam Jackson Date: Thu, 28 Apr 2011 13:34:28 +1000 Subject: [PATCH 1/7] fbdevhw: iterate over all modes that match a mode. (v3) So on RHEL5 anaconda sets an xorg.conf with a fixed 800x600 mode in it, we run radeonfb and fbdev since ati won't work in userspace due to domain issues in the older codebase. On certain pseries blades the built-in KVM can't accept an 800x600-43 mode, it requires the 800x600-60 mode, so we have to have the kernel radeonfb driver reject the 800x600-43 mode when it sees it. However then fbdev doesn't try any of the other 800x600 modes in the modelist, and we end up getting a default 640x480 mode we don't want. This patch changes the mode validation loop to continue on with the other modes that match to find one that works. v2: move code around to avoid extra loop, after comment from Jamey. v3: move loop setup back into loop as per Jeremy's review. Signed-off-by: Dave Airlie Reviewed-by: Jamey Sharp Reviewed-by: Jeremy Huddleston --- hw/xfree86/fbdevhw/fbdevhw.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/hw/xfree86/fbdevhw/fbdevhw.c b/hw/xfree86/fbdevhw/fbdevhw.c index 2019741b2..309fa654a 100644 --- a/hw/xfree86/fbdevhw/fbdevhw.c +++ b/hw/xfree86/fbdevhw/fbdevhw.c @@ -506,20 +506,22 @@ fbdevHWSetVideoModes(ScrnInfoPtr pScrn) pScrn->virtualY = pScrn->display->virtualY; for (modename = pScrn->display->modes; *modename != NULL; modename++) { - for (mode = pScrn->monitor->Modes; mode != NULL; mode = mode->next) - if (0 == strcmp(mode->name,*modename)) - break; + for (mode = pScrn->monitor->Modes; mode != NULL; mode = mode->next) { + if (0 == strcmp(mode->name,*modename)) { + if (fbdevHWSetMode(pScrn, mode, TRUE)) + break; + + xf86DrvMsg(pScrn->scrnIndex, X_INFO, + "\tmode \"%s\" test failed\n", *modename); + } + } + if (NULL == mode) { xf86DrvMsg(pScrn->scrnIndex, X_INFO, "\tmode \"%s\" not found\n", *modename); continue; } - if (!fbdevHWSetMode(pScrn, mode, TRUE)) { - xf86DrvMsg(pScrn->scrnIndex, X_INFO, - "\tmode \"%s\" test failed\n", *modename); - continue; - } xf86DrvMsg(pScrn->scrnIndex, X_INFO, "\tmode \"%s\" ok\n", *modename); From b62dc4fcbcffd10de16650bee284702c8608bb60 Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Wed, 19 Oct 2011 16:21:26 +0100 Subject: [PATCH 2/7] xext: don't free uninitialised pointer when malloc fails. (v2) Initialise the pAttr->values to values so if the values allocation fails it just ends up as free(NULL). Pointed out by coverity. v2: use Alan's suggestion. Signed-off-by: Dave Airlie Reviewed-by: Alan Coopersmith Reviewed-by: Jeremy Huddleston --- Xext/saver.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Xext/saver.c b/Xext/saver.c index 142758c87..18d5e468d 100644 --- a/Xext/saver.c +++ b/Xext/saver.c @@ -925,7 +925,7 @@ ScreenSaverSetAttributes (ClientPtr client) goto bail; } /* over allocate for override redirect */ - values = malloc((len + 1) * sizeof (unsigned long)); + pAttr->values = values = malloc((len + 1) * sizeof (unsigned long)); if (!values) { ret = BadAlloc; @@ -945,7 +945,6 @@ ScreenSaverSetAttributes (ClientPtr client) pAttr->pCursor = NullCursor; pAttr->pBackgroundPixmap = NullPixmap; pAttr->pBorderPixmap = NullPixmap; - pAttr->values = values; /* * go through the mask, checking the values, * looking up pixmaps and cursors and hold a reference From 682c09a2cedd234b005334cc01247d859dd7f26a Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Wed, 19 Oct 2011 16:22:31 +0100 Subject: [PATCH 3/7] Xi: avoid overrun of callback array. This code had an off-by-one and would allow writing one past the end of the callbacks array. Pointed out by coverity. Signed-off-by: Dave Airlie Reviewed-by: Jeremy Huddleston --- Xi/extinit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Xi/extinit.c b/Xi/extinit.c index a2c807b46..b43f9bbc0 100644 --- a/Xi/extinit.c +++ b/Xi/extinit.c @@ -409,7 +409,7 @@ static int ProcIDispatch(ClientPtr client) { REQUEST(xReq); - if (stuff->data > ARRAY_SIZE(ProcIVector) || !ProcIVector[stuff->data]) + if (stuff->data >= ARRAY_SIZE(ProcIVector) || !ProcIVector[stuff->data]) return BadRequest; return (*ProcIVector[stuff->data])(client); @@ -428,7 +428,7 @@ static int SProcIDispatch(ClientPtr client) { REQUEST(xReq); - if (stuff->data > ARRAY_SIZE(SProcIVector) || !SProcIVector[stuff->data]) + if (stuff->data >= ARRAY_SIZE(SProcIVector) || !SProcIVector[stuff->data]) return BadRequest; return (*SProcIVector[stuff->data])(client); From 1049139499d9132a20cd6d4d156fe9da9cddb6c2 Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Wed, 19 Oct 2011 16:57:13 +0100 Subject: [PATCH 4/7] xaa: avoid possible freed pointer reuse in epilogue If the pGCPriv->flags == 2, then we try to assign the freed pGCPriv->XAAOps avoid this by clearing the flags in to be destroyed pGCPriv. Reported by coverity. Signed-off-by: Dave Airlie Reviewed-by: Jeremy Huddleston --- hw/xfree86/xaa/xaaGC.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/xfree86/xaa/xaaGC.c b/hw/xfree86/xaa/xaaGC.c index 44d50e6b6..1bc35d9f3 100644 --- a/hw/xfree86/xaa/xaaGC.c +++ b/hw/xfree86/xaa/xaaGC.c @@ -239,6 +239,7 @@ XAADestroyGC(GCPtr pGC) free(pGCPriv->XAAOps); free(pGCPriv->DashPattern); + pGCPriv->flags = 0; (*pGC->funcs->DestroyGC)(pGC); XAA_GC_FUNC_EPILOGUE (pGC); From 41229392b790f30a0f0ef1f4ed95647c5bca4001 Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Thu, 20 Oct 2011 11:00:43 +0100 Subject: [PATCH 5/7] xv: test correct number of requests. (v2) Pointed out by coverity. v2: fix swapped as well, as pointed out by Alan Signed-off-by: Dave Airlie Reviewed-by: Alan Coopersmith --- Xext/xvdisp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c index 364a90cf2..0795a1475 100644 --- a/Xext/xvdisp.c +++ b/Xext/xvdisp.c @@ -1238,7 +1238,7 @@ ProcXvDispatch(ClientPtr client) UpdateCurrentTime(); - if (stuff->data > xvNumRequests) { + if (stuff->data >= xvNumRequests) { SendErrorToClient(client, XvReqCode, stuff->data, 0, BadRequest); return BadRequest; } @@ -1542,7 +1542,7 @@ SProcXvDispatch(ClientPtr client) UpdateCurrentTime(); - if (stuff->data > xvNumRequests) { + if (stuff->data >= xvNumRequests) { SendErrorToClient(client, XvReqCode, stuff->data, 0, BadRequest); return BadRequest; } From 8d3731a811e33e263920dd7c8ec63d02968cb56e Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Thu, 20 Oct 2011 10:48:26 +0100 Subject: [PATCH 6/7] hal: free tmp_val in one missing case Pointed out by coverity scan. Signed-off-by: Dave Airlie Reviewed-by: Daniel Stone --- config/hal.c | 1 + 1 file changed, 1 insertion(+) diff --git a/config/hal.c b/config/hal.c index aa234ebb4..088c9939d 100644 --- a/config/hal.c +++ b/config/hal.c @@ -348,6 +348,7 @@ device_added(LibHalContext *hal_ctx, const char *udi) if (!strcasecmp(tmp, ".options") && (!xkb_opts.options)) xkb_opts.options = strdup(tmp_val); } + free(tmp_val); } } } From 98c4a888a4428789386c7c47cecc81933b5999ba Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Mon, 28 Nov 2011 16:37:59 +0000 Subject: [PATCH 7/7] kdrive: drop screen crossing code. The only kdrive server we probably care about anymore is Xephyr, and this screen enable/disable code totally breaks it in multi-screen mode. When you are in one screen the other stops updating. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=757457 Signed-off-by: Dave Airlie Reviewed-by: Peter Hutterer --- hw/kdrive/src/kinput.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/hw/kdrive/src/kinput.c b/hw/kdrive/src/kinput.c index 9c0b34fe1..968ebb159 100644 --- a/hw/kdrive/src/kinput.c +++ b/hw/kdrive/src/kinput.c @@ -2146,12 +2146,6 @@ KdCursorOffScreen(ScreenPtr *ppScreen, int *x, int *y) static void KdCrossScreen(ScreenPtr pScreen, Bool entering) { -#ifndef XIPAQ - if (entering) - KdEnableScreen (pScreen); - else - KdDisableScreen (pScreen); -#endif } int KdCurScreen; /* current event screen */