Otherwise the reference can lead to use after free in
__glXDRIinvalidateBuffers().
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=50019
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit a2d0829531)
Signed-off-by: Julien Cristau <jcristau@debian.org>
Same as DRI2CreateDrawable, except it can return the DRI2 specific XID of the
DRI2 drawable reference to the base drawable.
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 8a87acc9e5)
Signed-off-by: Julien Cristau <jcristau@debian.org>
DRI2DestroyDrawable() was still being _X_EXPORTed, but hasn't existed
since 1da1f33f last year.
Signed-off-by: Daniel Stone <daniel@fooishbar.org>
Reviewed-by: Cyril Brulebois <kibi@debian.org>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit b8a3267c36)
Signed-off-by: Julien Cristau <jcristau@debian.org>
This loop needs to count from 7 to 0, not only from 7 to 1.
The current code always skips the modes {1152, 864, 75, 0}, {1280, 1024, 85, 0},
{1400, 1050, 75, 0}, {1600, 1200, 70, 0} and {1920, 1200, 60, 0}.
Signed-off-by: Torsten Kaiser <x11@ariolc.dyndns.org>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 7c9d8cbd36)
Using -O3 gcc notes that m could reach beyound the end of the EstIIIModes array,
if the last bits of the 11s byte where set.
Fix this, by extending the array to cover all possible bits from est.
https://bugs.freedesktop.org/show_bug.cgi?id=45623
Signed-off-by: Torsten Kaiser <x11@ariolc.dyndns.org>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 0b3abacb64)
Drivers call xf86InstallSIGIOHandler() for their fd on DEVICE_ON. That
function does not actually enable the signal if it was blocked to begin
with. As a result, if one vt-switches away from the server (SIGIO is
blocked) and then triggers a server regeneration, the signal remains
blocked and input devices are dead.
Avoid this by always unblocking SIGIO when we start the server.
X.Org Bug 50957 <http://bugs.freedesktop.org/show_bug.cgi?id=50957>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 9f1edced9a)
Number of devices is 2 + MAXDEVICES, with index 0 and 1 reserved for
XIAll{Master}Devices. At the current size, PropagateMask would be overrun in
RecalculateDeviceDeliverableEvents().
Found by Coverity.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit 12bfb4cf1b)
Don't leak if ti->history is NULL.
Found by coverity.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit a9c09f8f8e)
*dev is the condition of the while loop we're in, reset to NULL after
freeing
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit e3f47be9fb)
Call UpdateCurrentTimeIf(), not UpdateCurrentTime(), from RRTellChanged().
The latter calls ProcessInputEvents(), which can trigger a recursion
into mieqProcessInputEvents(). The former omits the call to
ProcessInputEvents().
Signed-off-by: Andy Ritger <aritger@nvidia.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit dae317e726)
Too much scrolling down may eventually trigger an overflow of the valuator.
If this happens, reset the valuator to 0 and skip this event for button
emulation. Clients will have to figure out a way to deal with this, but a
scroll event from (close to) INT_MAX to 0 is a hint of that it needs to be
ignored.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
(cherry picked from commit 54476b5e44)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
(cherry picked from commit 72cfc1a097)
Slow keys are enabled when the XKB AccessX features are generally enabled
(ctrls->enabled_ctrls & XkbAccessXKeysMask) and either shift key is held for
8 seconds. For the unsuspecting user this appears as if the keyboard
suddenly stops working.
Print a warning to the log, so we can later tell them "told you so".
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dan Nicholson <dbn.lists@gmail.com>
(cherry picked from commit ff41753b1b)
DeleteInputDeviceRequest is called from CloseDownDevices on reset, so
call RemoveDevice to avoid leaking devices in Xvfb/Xnest/Xwin.
Signed-off-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit e4153c1d91)
xf86-input-evdev (since "smooth scrolling" support was added) can send mouse
motion and wheel events in one batch, so we need to handle it properly.
Otherwise mouse wheel events which come with motion events are lost
and separate mouse wheel events are handled through non-DGA path.
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 2d4fda4b09)
last.valuators contains the transformed valuators of the device. If the
device submits events with x/y missing, we need to get that from
last.valuators and undo the transformation to that axis.
X.Org Bug 49347 <http://bugs.freedesktop.org/show_bug.cgi?id=49347>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
(cherry picked from commit 749a593e49)
The current code seems to skip syms with width less than
type->num_levels when calculating the total size for the new
size_syms. This leads to less space being allocated than necessary
during the next phase, which is to copy over the syms to the new
location. This results in an overflow leading to a crash.
Signed-off-by: Siddhesh Poyarekar <siddhesh.poyarekar@gmail.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 42ae2e8199)
A WarpPointer request may trigger a motion event on a device without
valuators. That request is ignored by GetPointerEvents but during smooth
scroll emulation we dereference dev->valuators to get the number of axes.
Break out early if the device doesn't have valuators.
Signed-off-by: Michal Suchanek <hramrach@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 88c767edb0)
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
Reviewed-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit 96e0ab5496)
Code was deleted in commit affec10635
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 5a3a98fcb7)
The code to implement was deleted when BaseModules[] was emptied by
the replacement of the "pcidata" module with libpciaccess calls
in commit 46f55f5dea.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit afcb7ba24e)
XInput 2.1 and earlier clients do not know about touches. We must report
touch emulated button presses for these clients. For later clients, we
only report true pointer button presses.
Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit ee542b8559)
Physical button state is usually meaningless to an X client.
Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 1e7b500a8e)
It is not safe to ever use an arbitrary (possibly user supplied) string as
part of the format for a *sprintf() call.
For example:
1. Name a Bluetooth keyboard "%n%n%n%n%n%n%n%n"
2. Pair it with a computer running X and try to use it
3. X is not happy when trying to do the following in xf86-input-evdev:
xf86IDrvMsg(pInfo, X_CONFIG, "Device: \"%s\"\n", device);
because LogVHdrMessageVerb() has put the %n from the device name
into a format string of the form:
"evdev: %n%n%n%n%n%n%n%n: Device: \"%s\"\n"
Instead, build up a log message in place by appending successive formatted
strings by sncprintf'ing to the end of the previous.
Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit c91d00e0f3)
The current code will write a timestamps into the logFile whenever
the last message ended with a '\n' - even if the verb for that timestamp
is at too high a level. This timestamp will sit there with no matching
message until the next call to LogVWrite with a valid verb.
In other words, in some cases, timestamps in the X.org.log are for some
completely unrelated message that was previously ignored due to
insufficient verbosity, and not for the message that appears next to it
in the log file.
We keep the current policy which appears to be to only apply timestamps if
a message is actually written to a log file. That is, no timestamps on
stderr, or in the mem buffer. Therefore, the timestamp stringification
is moved to the conditional where it is used.
Since logging uses a fixed length buffer, this patch also forces a '\n'
whenever a buffer is terminated due to a too-long write request. This
allows the newline detection to work even on overflow, and also cleans up
the log a bit in the overflow case.
Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 6ce0eac4f8)
Normal snprintf() usually returns the number of bytes that would have been
written into a buffer had the buffer been long enough.
The scnprintf() variants return the actual number of bytes written,
excluding the trailing '\0'.
Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 5c2e2a164d)
* space->tab
* remove comment that doesn't make any sense
Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit c30862879d)
This reverts commit 90299556db.
The commit being reverted triggered a segfault on server shutdown when a
device posts raw events after the root windows are forced to NULL.
https://lists.debian.org/debian-x/2012/05/msg00240.html
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
and fix resulting printf warning in dmxLogVisual
Signed-off-by: Michal Suchanek <hramrach@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit d662fa2450)
Events from button-only devices still need coordinates, and they get them
from scale_to_desktop(). Therefore, a dev without valuators is not a bug.
However, a dev with valuators, but less than two of them still is a bug.
This was noticed when unplugging a "Creative Technology SB Arena Headset",
which has some BTNs and some KEYs, but no REL or ABS valuators.
It emits [BTN_3] = 0 on unplug, which would trigger the BUG_WARN.
Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit c5a45b0f76)
This is the result of re-running the 'x-indent.sh' script over
xf86vmode.c to clean up the disaster caused by broken syntax in the
file.
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 9779b904c7)
Inside the unfinished XF86VIDMODE_EVENTS #ifdef block the
function definition for xf86VidModeNotifyEvent had an extra ');'
before the prototype argument declarations. This was harmless for the
compiler as the code never gets used, but completely messed up the
file re-indentation. This patch removes the spurious characters in
preparation for re-indenting the file.
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 592bd0ae2b)
With multiple servers installed, we can't be certain if X is Xorg or Xquartz
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
(cherry picked from commit 93d6ba5b71)
A suspend-induced device disable may happen before the device gets to see
the button release event. On resume, the server's internal state still has
some buttons pressed, causing inconsistent behaviour.
Force the release and the matching events to be sent to the client.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
(cherry picked from commit f3410b97cf)
Conflicts:
dix/devices.c
Test case:
- create a device with REL_HWHEEL and ABS_X and ABS_Y. evdev 2.7.0 will set
that up as device with 1 relative axis
- move pointer to VGA1
- xrandr --output VGA1 --off
Warps the pointer to the new spot and calls GPE with the x/y mask bits set.
When running through the loop to check for scroll event, this overruns the
axes and may try to emulate scroll events based on random garbage in the
memory. If that memory contained non-zero for the scroll type but near-zero
for the increment field, the server would hang in an infinite loop.
This was the trigger for this suggested, never-merged, patch here:
http://patchwork.freedesktop.org/patch/9543/
X.Org Bug 47281 <http://bugs.freedesktop.org/show_bug.cgi?id=47281>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
(cherry picked from commit af88b43f9e)
If TimerSet() is called from a signal handler (synaptics tap handling code)
may result in list corruption if we're currently inside TimerSet().
See backtrace in
https://bugzilla.redhat.com/show_bug.cgi?id=814869
Block signals for all list manipulations in the timers.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
(cherry picked from commit 08962951de)
