xserver/hw
Olivier Fourdan a5e863963e xwayland: Force disposal of windows buffers for root on destroy
With explicit buffer synchronization in use, the window buffers use a
file descriptor for event notification to keep the buffer alive for
synchronization purpose.

When running rootful, the root window (which is visible) is destroyed
directly from the resource manager on server reset, and the window
buffer's eventfd will trigger after the window is destroyed, leading to
a use after free and a crash of the xserver.

To avoid the issue, check whether the window being destroyed is the root
window in rootless mode, and make sure to force the disposal of the
window buffers in that case.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1699
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1589>
2024-07-04 08:26:23 +00:00
..
kdrive kdrive: drop Solaris specific hack 2024-06-18 00:41:38 +00:00
vfb dix: unexport fields from opaque.h not used by modules/drivers 2024-06-23 21:19:27 +00:00
xfree86 modesetting: Fix hang when all probed cursor sizes fail to find a minimum one 2024-06-24 09:53:11 -04:00
xnest os: unexport ddx callbacks 2024-05-08 09:37:35 +02:00
xquartz os: unexport ddx callbacks 2024-05-08 09:37:35 +02:00
xwayland xwayland: Force disposal of windows buffers for root on destroy 2024-07-04 08:26:23 +00:00
xwin dix: unexport fields from opaque.h not used by modules/drivers 2024-06-23 21:19:27 +00:00
meson.build Drop DMX DDX 2021-09-07 09:34:31 +00:00