Blame SOURCES/0008-qxl-Initialize-prev-field-while-dup-surface-list.patch

af55dd
From cf2254c13497049a8dbc73a3b031f4cd43403ab1 Mon Sep 17 00:00:00 2001
af55dd
From: Victor Toso <me@victortoso.com>
af55dd
Date: Tue, 23 Oct 2018 13:48:58 +0200
af55dd
Subject: [PATCH] qxl: Initialize prev field while dup surface list
af55dd
MIME-Version: 1.0
af55dd
Content-Type: text/plain; charset=UTF-8
af55dd
Content-Transfer-Encoding: 8bit
af55dd
af55dd
Otherwise we will can hit a segfault qxl_surface_kill()
af55dd
af55dd
 │717     void
af55dd
 │718     qxl_surface_kill (qxl_surface_t *surface)
af55dd
 │719     {
af55dd
 │720         struct evacuated_surface_t *ev = surface->evacuated;
af55dd
 │721
af55dd
 │722         if (ev)
af55dd
 │723         {
af55dd
 │724             /* server side surface is already destroyed (via reset), don't
af55dd
 │725              * resend a destroy. Just mark surface as not to be recreated */
af55dd
 │726             ev->pixmap = NULL;│
af55dd
 │727             if (ev->image)│
af55dd
 │728                 pixman_image_unref (ev->image);
af55dd
 │729             if (ev->next)
af55dd
 │730                 ev->next->prev = ev->prev;
af55dd
 │731             if (ev->prev)
af55dd
>│732                ev->prev->next = ev->next;
af55dd
 │733             free(ev);
af55dd
 │734             surface->evacuated = NULL;
af55dd
 │735             return;
af55dd
 │736         }
af55dd
af55dd
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1641793
af55dd
af55dd
Signed-off-by: Victor Toso <victortoso@redhat.com>
af55dd
---
af55dd
 src/qxl_surface_ums.c | 1 +
af55dd
 1 file changed, 1 insertion(+)
af55dd
af55dd
diff --git a/src/qxl_surface_ums.c b/src/qxl_surface_ums.c
af55dd
index 2c16ede..19cbd36 100644
af55dd
--- a/src/qxl_surface_ums.c
af55dd
+++ b/src/qxl_surface_ums.c
af55dd
@@ -792,6 +792,7 @@ qxl_surface_cache_evacuate_all (surface_cache_t *cache)
af55dd
 
af55dd
 	unlink_surface (s);
af55dd
 	
af55dd
+	evacuated->prev = NULL;
af55dd
 	evacuated->next = evacuated_surfaces;
af55dd
         if (evacuated_surfaces)
af55dd
             evacuated_surfaces->prev = evacuated;
af55dd
-- 
af55dd
2.19.2
af55dd