From a5f439dcd21b4fda093cb382bb1a758b434a1444 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Mon, 14 Sep 2020 15:39:10 +0200 Subject: [PATCH] xwayland: Remove pending stream reference when freeing The EGLStream backend keeps a queue of pending streams for each Xwayland window. However, when this pending queue is freed, the corresponding private data may not be cleared (typically if the pixmap for this window has changed before the compositor finished attaching the consumer for the window's pixmap's original eglstream), leading to a use-after-free and a crash when trying to use that data as the window pixmap. Make sure to clear the private data when the pending stream is freed. Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1055 Signed-off-by: Olivier Fourdan Tested-by: Karol Szuster Reviewed-by: Adam Jackson --- hw/xwayland/xwayland-glamor-eglstream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/xwayland/xwayland-glamor-eglstream.c b/hw/xwayland/xwayland-glamor-eglstream.c index ee7f95b56..2821f9a58 100644 --- a/hw/xwayland/xwayland-glamor-eglstream.c +++ b/hw/xwayland/xwayland-glamor-eglstream.c @@ -437,8 +437,8 @@ xwl_eglstream_consumer_ready_callback(void *data, DebugF("eglstream: win %d completes eglstream for pixmap %p, congrats!\n", pending->window->drawable.id, pending->pixmap); - xwl_eglstream_window_set_pending(pending->window, NULL); out: + xwl_eglstream_window_set_pending(pending->window, NULL); xorg_list_del(&pending->link); free(pending); }