# HG changeset patch
# User Ryan C. Gordon <icculus@icculus.org>
# Date 1132426620 0
# Node ID dd2a8deeb26d3c546bf25d2fc00414c38ff45fdf
# Parent  867f521591e5b977032db993769091c57d50e2f2
Date: Mon, 17 Oct 2005 20:09:03 -0400
From: Mark Schreiber <mark7@alumni.cmu.edu>
To: ryan@clutteredmind.org
Subject: [PATCH]SDL mprotect() crash fix

(I'm going to throw this patch your way at the suggestion of #SDL --
for some reason, I had some difficulty sending it to the main list
last time, and I go bonkers subscribing to send each email or
patch...)

Currently, when I run SDL applications as non-root using
SDL_VIDEODRIVER=dga, the fbdev fallback mprotect()s read/write the
proper size of mmapped /dev/fb0 (7.5MB), but on framebuffer release
mprotect()s read-only the range by the entire size of my video memory
(128MB), which causes a segfault:

#0  0x002a9a27 in ?? () from /lib/libc.so.6
#1  0x04a63eb6 in SDL_XDGAUnmapFramebuffer (screen=3D0) at XF86DGA2.c:978
#2  0x04a63efc in SDL_XDGACloseFramebuffer (dpy=3D0x9d3f008, screen=3D0)
    at XF86DGA2.c:268
#3  0x04a68b57 in DGA_Available () at SDL_dgavideo.c:98
#4  0x04a53677 in SDL_VideoInit (driver_name=3D0xbfb0bfc7 "dga", flags=3D0)
    at SDL_video.c:180
#5  0x04a2613f in SDL_InitSubSystem (flags=3D32) at SDL.c:74
#6  0x04a2617c in SDL_Init (flags=3D32) at SDL.c:166
#7  0x08049722 in main (argc=3D1, argv=3D0x0) at testwin.c:32

This is SDL 1.2.8 on Fedora Core 4, radeon driver for a Radeon 9250,
xorg-x11-6.8.2-37.

I've attached a one-line patch against SDL CVS that updates the size
of the framebuffer at framebuffer map time so that the mprotect() on
unmap will be the same size.  I'm not sure if this is the best
approach (i.e. one might want to retain the original value), but it
does make my SDL applications work without segfaulting.

-- Best of luck, Mark Schreiber

diff -r 867f521591e5 -r dd2a8deeb26d src/video/Xext/Xxf86dga/XF86DGA2.c
--- a/src/video/Xext/Xxf86dga/XF86DGA2.c	Thu Nov 17 03:43:42 2005 +0000
+++ b/src/video/Xext/Xxf86dga/XF86DGA2.c	Sat Nov 19 18:57:00 2005 +0000
@@ -957,7 +957,7 @@
            (((long)finfo.smem_start)&~(PAGE_SIZE-1)))
          */
         base = 0;
-        size = finfo.smem_len;
+        size = pMap->size = finfo.smem_len;
     }
 #else
 	return False;