From 9a59631a490876eae57f813e3a274c46d35d5287 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Fri, 18 Jun 2021 14:52:55 +0200 Subject: [PATCH] glx: Fix use after free in MakeCurrent The fix from commit c468d34c7 - "glx: Set ContextTag for all contexts" is actually incomplete, it correctly sets the context tag for direct contexts as well, but would fail to mark the context's currentClient. As a result, when the context is destroyed, it would be freed immediately rather than being just scheduled for deletion, even though it is still current for some client. leading to a use-after-free. Make sure to also set the context's currentClient for direct contexts as well, not just indirect ones. Signed-off-by: Olivier Fourdan Fixes: c468d34c7 - "glx: Set ContextTag for all contexts" Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1186 Reviewed-by: Adam Jackson (cherry picked from commit aad61e8e03311eb8bae4f7db59e65634733eadc2) --- glx/glxcmds.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/glx/glxcmds.c b/glx/glxcmds.c index d148c79bf..c82ce2c78 100644 --- a/glx/glxcmds.c +++ b/glx/glxcmds.c @@ -648,11 +648,11 @@ xorgGlxMakeCurrent(ClientPtr client, GLXContextTag tag, XID drawId, XID readId, glxc->readPriv = NULL; return __glXError(GLXBadContext); } - - glxc->currentClient = client; } glxServer.setContextTagPrivate(client, newContextTag, glxc); + if (glxc) + glxc->currentClient = client; if (prevglxc) { prevglxc->currentClient = NULL;