frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

prime: Clear PixmapDirtyUpdateRec::damage when it's destroyed 

The root window, and by extension any damage records referencing it,
may be destroyed before shared pixmaps referencing it, which resulted in
use-after-free / double-free in PixmapStopDirtyTracking.

Fixes: b5b292896f ("prime: Sync shared pixmap from root window instead of screen pixmap")
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
This commit is contained in:
Michel Dänzer 2017-02-16 16:13:56 +09:00 committed by Adam Jackson
parent 371ff0c969
commit a6566f9e4d
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
dix/pixmap.c
View File

@ -172,6 +172,14 @@ PixmapPtr PixmapShareToSlave(PixmapPtr pixmap, ScreenPtr slave)
return spix; return spix;
} }
static void
PixmapDirtyDamageDestroy(DamagePtr damage, void *closure)
{
PixmapDirtyUpdatePtr dirty = closure;
dirty->damage = NULL;
}
Bool Bool
PixmapStartDirtyTracking(PixmapPtr src, PixmapStartDirtyTracking(PixmapPtr src,
PixmapPtr slave_dst, PixmapPtr slave_dst,
@ -195,10 +203,10 @@ PixmapStartDirtyTracking(PixmapPtr src,
dirty_update->dst_x = dst_x; dirty_update->dst_x = dst_x;
dirty_update->dst_y = dst_y; dirty_update->dst_y = dst_y;
dirty_update->rotation = rotation; dirty_update->rotation = rotation;
dirty_update->damage = DamageCreate(NULL, NULL, dirty_update->damage = DamageCreate(NULL, PixmapDirtyDamageDestroy,
DamageReportNone, DamageReportNone,
TRUE, src->drawable.pScreen, TRUE, src->drawable.pScreen,
src->drawable.pScreen); dirty_update);
if (rotation != RR_Rotate_0) { if (rotation != RR_Rotate_0) {
RRTransformCompute(x, y, RRTransformCompute(x, y,
@ -247,7 +255,8 @@ PixmapStopDirtyTracking(PixmapPtr src, PixmapPtr slave_dst)
xorg_list_for_each_entry_safe(ent, safe, &screen->pixmap_dirty_list, ent) { xorg_list_for_each_entry_safe(ent, safe, &screen->pixmap_dirty_list, ent) {
if (ent->src == src && ent->slave_dst == slave_dst) { if (ent->src == src && ent->slave_dst == slave_dst) {
DamageDestroy(ent->damage); if (ent->damage)
DamageDestroy(ent->damage);
xorg_list_del(&ent->ent); xorg_list_del(&ent->ent);
free(ent); free(ent);
} }