glx: Fix use after free in MakeCurrent

The fix from commit c468d34c7 - "glx: Set ContextTag for all contexts"
is actually incomplete, it correctly sets the context tag for direct
contexts as well, but would fail to mark the context's currentClient.

As a result, when the context is destroyed, it would be freed
immediately rather than being just scheduled for deletion, even though
it is still current for some client. leading to a use-after-free.

Make sure to also set the context's currentClient for direct contexts as
well, not just indirect ones.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Fixes: c468d34c7 - "glx: Set ContextTag for all contexts"
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1186
Reviewed-by: Adam Jackson <ajax@redhat.com>
This commit is contained in:
Olivier Fourdan 2021-06-18 14:52:55 +02:00
parent 021b3c2f77
commit aad61e8e03
1 changed files with 2 additions and 2 deletions

View File

@ -662,11 +662,11 @@ xorgGlxMakeCurrent(ClientPtr client, GLXContextTag tag, XID drawId, XID readId,
glxc->readPriv = NULL;
return __glXError(GLXBadContext);
}
glxc->currentClient = client;
}
glxServer.setContextTagPrivate(client, newContextTag, glxc);
if (glxc)
glxc->currentClient = client;
if (prevglxc) {
prevglxc->currentClient = NULL;