From 6aec64b2f76f920afb7401fbdebbfda9efcffd0c Mon Sep 17 00:00:00 2001 From: Daniel Stone Date: Tue, 7 Dec 2021 16:45:39 +0000 Subject: [PATCH] backend-drm: Early-out for too-large SHM/cursor buffers We know what our limit is for cursor planes, so don't try to assign a view which is too large. Signed-off-by: Daniel Stone --- libweston/backend-drm/state-propose.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/libweston/backend-drm/state-propose.c b/libweston/backend-drm/state-propose.c index f5f63feb..9ac6bde3 100644 --- a/libweston/backend-drm/state-propose.c +++ b/libweston/backend-drm/state-propose.c @@ -239,7 +239,6 @@ drm_output_prepare_cursor_view(struct drm_output_state *output_state, struct drm_plane *plane = output->cursor_plane; struct drm_plane_state *plane_state; bool needs_update = false; - struct weston_buffer *buffer = ev->surface->buffer_ref.buffer; const char *p_name = drm_output_get_plane_type_name(plane); assert(!b->cursors_are_broken); @@ -271,16 +270,6 @@ drm_output_prepare_cursor_view(struct drm_output_state *output_state, goto err; } - if (buffer->width > b->cursor_width || - buffer->height > b->cursor_height) { - drm_debug(b, "\t\t\t\t[%s] not assigning view %p to %s plane " - "(surface buffer (%dx%d) larger than permitted" - " (%dx%d))\n", p_name, ev, p_name, - buffer->width, buffer->height, - b->cursor_width, b->cursor_height); - goto err; - } - if (plane_state->src_x != 0 || plane_state->src_y != 0 || plane_state->src_w > (unsigned) b->cursor_width << 16 || plane_state->src_h > (unsigned) b->cursor_height << 16 || @@ -694,12 +683,21 @@ drm_output_prepare_plane_view(struct drm_output_state *state, if (shmbuf) { if (!output->cursor_plane) return NULL; + if (wl_shm_buffer_get_format(shmbuf) != WL_SHM_FORMAT_ARGB8888) { drm_debug(b, "\t\t\t\t[view] not placing view %p on " "plane; SHM buffers must be ARGB8888 for " "cursor view", ev); return NULL; } + + if (buffer->width > b->cursor_width || + buffer->height > b->cursor_height) { + drm_debug(b, "\t\t\t\t[view] not assigning view %p to plane " + "(buffer (%dx%d) too large for cursor plane)", + ev, buffer->width, buffer->height); + return NULL; + } } else { fb = drm_fb_get_from_view(state, ev, try_view_on_plane_failure_reasons); }