diff options
| author | Alex Goins <agoins@nvidia.com> | 2017-10-24 18:39:13 -0700 |
|---|---|---|
| committer | Adam Jackson <ajax@redhat.com> | 2017-12-13 10:04:47 -0500 |
| commit | 4ef1aef0fbbf47c937cf421f0180cc18fc23a03e (patch) | |
| tree | 5f4703f8556edb58736250d6249eece71f00f1a1 | |
| parent | cd5076a50c0274512bd2ce2c8ecf56c3517d0266 (diff) | |
ramdac: Check ScreenPriv != NULL in xf86ScreenSetCursor()
Similar to change cba5a10f, xf86ScreenSetCursor() would dereference ScreenPriv
without NULL checking it. If Option "SWCursor" is specified, ScreenPriv == NULL.
Without this fix, it is observed that setting Option "SWCursor" "on" on the
modesetting driver in a PRIME configuration will segfault the server.
It is important to return success rather than failure in the instance that
ScreenPriv == NULL and pCurs == NullCursor, because otherwise xf86SetCursor()
can fall into infinite recursion: xf86SetCursor(pCurs) calls
xf86ScreenSetCursor(pCurs), and if FALSE, calls xf86SetCursor(NullCursor). If
xf86ScreenSetCursor(NullCursor) returns FALSE, it calls
xf86SetCursor(NullCursor) again and this repeats forever.
Signed-off-by: Alex Goins <agoins@nvidia.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit 68d95e759f8b6ebca6bd52e69e6bc34cc174f8ca)
| -rw-r--r-- | hw/xfree86/ramdac/xf86HWCurs.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/hw/xfree86/ramdac/xf86HWCurs.c b/hw/xfree86/ramdac/xf86HWCurs.c index 7043a9c72..4e2e587fd 100644 --- a/hw/xfree86/ramdac/xf86HWCurs.c +++ b/hw/xfree86/ramdac/xf86HWCurs.c @@ -180,9 +180,16 @@ xf86ScreenSetCursor(ScreenPtr pScreen, CursorPtr pCurs, int x, int y) xf86CursorScreenPtr ScreenPriv = (xf86CursorScreenPtr) dixLookupPrivate(&pScreen->devPrivates, xf86CursorScreenKey); - xf86CursorInfoPtr infoPtr = ScreenPriv->CursorInfoPtr; + + xf86CursorInfoPtr infoPtr; unsigned char *bits; + if (!ScreenPriv) { /* NULL if Option "SWCursor" */ + return (pCurs == NullCursor); + } + + infoPtr = ScreenPriv->CursorInfoPtr; + if (pCurs == NullCursor) { (*infoPtr->HideCursor) (infoPtr->pScrn); return TRUE; |