[Bug 97124] XF86HandleColormaps,AddScreen,InitOutput segfault in intel_drv on startx

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=97124

Chris Wilson <chris at chris-wilson.co.uk> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|medium                      |highest
           Severity|normal                      |blocker
           Assignee|chris at chris-wilson.co.uk    |xorg-team at lists.x.org
          Component|Driver/intel                |Server/DDX/Xorg
         QA Contact|intel-gfx-bugs at lists.freede |xorg-team at lists.x.org
                   |sktop.org                   |

--- Comment #4 from Chris Wilson <chris at chris-wilson.co.uk> ---
The call to xf86HandleColormaps() happens in ScreenInit (for all drivers).

commit b4e46c0444bb09f4af59d9d13acc939a0fbbc6d6
Author: Michel Dänzer <michel.daenzer at amd.com>
Date:   Sat Nov 28 16:50:47 2015 +0900

    xfree86: Hook up colormaps and RandR 1.2 gamma code v6

installs a scrn->LoadPalette callback inside xf86HandleColormaps() which is
immediately used by CMapInstallColormap(). But xf86RandrR12LoadPalette expects
pScrn->pScreen to already be valid but that is only set after ScreenInit
completes. Given the assertions, it would be fine to preset pScrn->pScreen ala

diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
index 7a267f8..dd2e520 100644
--- a/hw/xfree86/common/xf86Init.c
+++ b/hw/xfree86/common/xf86Init.c
@@ -790,13 +790,12 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char
**argv)
         pScrn->LoadPalette = NULL;
         pScrn->SetOverscan = NULL;
         pScrn->DriverFunc = NULL;
-        pScrn->pScreen = NULL;
+       pScrn->pScreen = screenInfo.gpuscreens[i];
         scr_index = AddGPUScreen(pScrn->ScreenInit, argc, argv);
         xf86VGAarbiterUnlock(pScrn);
         if (scr_index == i) {
             dixSetPrivate(&screenInfo.gpuscreens[scr_index]->devPrivates,
                           xf86ScreenKey, xf86GPUScreens[i]);
-            pScrn->pScreen = screenInfo.gpuscreens[scr_index];
             /* The driver should set this, but make sure it is set anyway */
             pScrn->vtSema = TRUE;
         } else {
@@ -818,7 +817,7 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char **argv)
         xf86Screens[i]->LoadPalette = NULL;
         xf86Screens[i]->SetOverscan = NULL;
         xf86Screens[i]->DriverFunc = NULL;
-        xf86Screens[i]->pScreen = NULL;
+       xf86Screens[i]->pScreen = screenInfo.screens[i];
         scr_index = AddScreen(xf86Screens[i]->ScreenInit, argc, argv);
         xf86VGAarbiterUnlock(xf86Screens[i]);
         if (scr_index == i) {
@@ -828,7 +827,6 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char **argv)
              */
             dixSetPrivate(&screenInfo.screens[scr_index]->devPrivates,
                           xf86ScreenKey, xf86Screens[i]);
-            xf86Screens[i]->pScreen = screenInfo.screens[scr_index];
             /* The driver should set this, but make sure it is set anyway */
             xf86Screens[i]->vtSema = TRUE;
         }

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/intel-gfx-bugs/attachments/20160729/5040fa69/attachment-0001.html>