From 31b6041d525f36c20f20e8f9b9d06fd515fe9d1a Mon Sep 17 00:00:00 2001 From: Max Krummenacher Date: Thu, 4 Feb 2021 21:51:07 +0100 Subject: weston: imx: fix use with fbdev/pixman If the imx fork is used on a i.MX 6ULL stopping weston may result in a segfault due to using already freed memory. Make sure to only call pixman_renderer_output_destroy() once and harden pixman_renderer_output_destroy() to not segfault should it be called twice. Related-to: ELB-3532 Signed-off-by: Max Krummenacher (cherry picked from commit 942c1d04fb1c57e0698620adc03fbd476c8fbe93) --- ...ackend-fbdev-fbdev.c-don-t-destroy-output.patch | 50 ++++++++++++++++++++++ ...ston-pixman-renderer.c-zero-freed-pointer.patch | 42 ++++++++++++++++++ recipes-graphics/wayland/weston_9.0.0.imx.bbappend | 6 +++ 3 files changed, 98 insertions(+) create mode 100644 recipes-graphics/wayland/weston/0001-libweston-backend-fbdev-fbdev.c-don-t-destroy-output.patch create mode 100644 recipes-graphics/wayland/weston/0002-libweston-pixman-renderer.c-zero-freed-pointer.patch diff --git a/recipes-graphics/wayland/weston/0001-libweston-backend-fbdev-fbdev.c-don-t-destroy-output.patch b/recipes-graphics/wayland/weston/0001-libweston-backend-fbdev-fbdev.c-don-t-destroy-output.patch new file mode 100644 index 0000000..1469938 --- /dev/null +++ b/recipes-graphics/wayland/weston/0001-libweston-backend-fbdev-fbdev.c-don-t-destroy-output.patch @@ -0,0 +1,50 @@ +From 52ec338ec27a3e3267442bcef36e0b9312441af5 Mon Sep 17 00:00:00 2001 +From: Max Krummenacher +Date: Thu, 4 Feb 2021 20:33:40 +0000 +Subject: [PATCH 1/2] libweston/backend-fbdev/fbdev.c: don't destroy output + twice + +This is currently unsupported and may result in a segfault. + +fbdev_output_disable(base) does call pixman_renderer_output_destroy(base) so +one should not do it a second time here. + +Observed on a colibri-imx6ull which actually uses pixman for rendering. + +Program received signal SIGSEGV, Segmentation fault. +_pixman_image_fini (image=0x636f6c2f) + at ../pixman-0.38.4/pixman/pixman-image.c:139 +139 ../pixman-0.38.4/pixman/pixman-image.c: Datei oder Verzeichnis nicht gefunden. +(gdb) bt + at ../pixman-0.38.4/pixman/pixman-image.c:139 + at ../pixman-0.38.4/pixman/pixman-image.c:211 + at ../git/libweston/pixman-renderer.c:971 + at ../git/libweston/backend-fbdev/fbdev.c:790 + at ../git/libweston/compositor.c:7607 + at ../git/libweston/backend-fbdev/fbdev.c:885 + at ../git/libweston/compositor.c:7949 + at ../git/compositor/main.c:3538 + from /srv/nfs/rootfs-colibri-imx6ull/lib/libc.so.6 + +Signed-off-by: Max Krummenacher +--- + libweston/backend-fbdev/fbdev.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/libweston/backend-fbdev/fbdev.c b/libweston/backend-fbdev/fbdev.c +index becc1488..6c6376c1 100644 +--- a/libweston/backend-fbdev/fbdev.c ++++ b/libweston/backend-fbdev/fbdev.c +@@ -786,8 +786,7 @@ fbdev_output_destroy(struct weston_output *base) + fbdev_output_disable(base); + + if (backend->use_pixman) { +- if (base->renderer_state != NULL) +- pixman_renderer_output_destroy(base); ++ ; + #if defined(ENABLE_IMXGPU) + #if defined(ENABLE_IMXG2D) + } else if (backend->use_g2d) { +-- +2.20.1 + diff --git a/recipes-graphics/wayland/weston/0002-libweston-pixman-renderer.c-zero-freed-pointer.patch b/recipes-graphics/wayland/weston/0002-libweston-pixman-renderer.c-zero-freed-pointer.patch new file mode 100644 index 0000000..67d21a2 --- /dev/null +++ b/recipes-graphics/wayland/weston/0002-libweston-pixman-renderer.c-zero-freed-pointer.patch @@ -0,0 +1,42 @@ +From 1c9ad2f2bbd9ad99b89c330ee809f5752cb03877 Mon Sep 17 00:00:00 2001 +From: Max Krummenacher +Date: Thu, 4 Feb 2021 20:37:02 +0000 +Subject: [PATCH 2/2] libweston/pixman-renderer.c: zero freed pointer + +Setting struct elements in a struct just before the whole struct +is freed makes little sense, however zero the pointer to said struct +guards against using the no longer assigned memory. + +Signed-off-by: Max Krummenacher +--- + libweston/pixman-renderer.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/libweston/pixman-renderer.c b/libweston/pixman-renderer.c +index 59b1f0ff..ec037e44 100644 +--- a/libweston/pixman-renderer.c ++++ b/libweston/pixman-renderer.c +@@ -967,6 +967,9 @@ pixman_renderer_output_destroy(struct weston_output *output) + { + struct pixman_output_state *po = get_output_state(output); + ++ if (!po) ++ return; ++ + if (po->shadow_image) + pixman_image_unref(po->shadow_image); + +@@ -975,9 +978,6 @@ pixman_renderer_output_destroy(struct weston_output *output) + + free(po->shadow_buffer); + +- po->shadow_buffer = NULL; +- po->shadow_image = NULL; +- po->hw_buffer = NULL; +- + free(po); ++ output->renderer_state = NULL; + } +-- +2.20.1 + diff --git a/recipes-graphics/wayland/weston_9.0.0.imx.bbappend b/recipes-graphics/wayland/weston_9.0.0.imx.bbappend index d5609a3..d4c3eea 100644 --- a/recipes-graphics/wayland/weston_9.0.0.imx.bbappend +++ b/recipes-graphics/wayland/weston_9.0.0.imx.bbappend @@ -4,3 +4,9 @@ PACKAGECONFIG_remove = "wayland x11" PACKAGECONFIG[xwayland] = "-Dxwayland=true,-Dxwayland=false,libxcursor" + +FILESEXTRAPATHS_prepend := "${THISDIR}/weston/:" +SRC_URI_append = " \ + file://0001-libweston-backend-fbdev-fbdev.c-don-t-destroy-output.patch \ + file://0002-libweston-pixman-renderer.c-zero-freed-pointer.patch \ +" -- cgit v1.2.3