glx: Fix crash when a client exits without deleting GL contexts
With the previous patches applied, we now have crash due to use-after-free when a client exits without deleting all it's GL contexts On client exit, CloseDownClient first calls glxClientCallback() with ClientStateGone, which calls __glXFreeContext() directly. Subsequently CloseDownClient() frees all the clients resources, which leads to ContextGone() being called for a context resource where the context has already been freed. Fix this by modifiying glxClientCallback() to free the context resource. Also make __glXFreeContext() static, as calling it directly leads to this problem, instead the context resource should be released. With the previous patches applied, this can be demonstrated with e.g. glxinfo, which doesn't delete it's context before exit. Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk> Reviewed-by: Adam Jackson <ajax@redhat.com>
This commit is contained in:
parent
5c606c0a89
commit
bc71081f0e
|
@ -66,6 +66,7 @@ static DevPrivateKeyRec glxClientPrivateKeyRec;
|
|||
** Forward declarations.
|
||||
*/
|
||||
static int __glXDispatch(ClientPtr);
|
||||
static GLboolean __glXFreeContext(__GLXcontext * cx);
|
||||
|
||||
/*
|
||||
** Called when the extension is reset.
|
||||
|
@ -189,7 +190,7 @@ __glXRemoveFromContextList(__GLXcontext * cx)
|
|||
/*
|
||||
** Free a context.
|
||||
*/
|
||||
GLboolean
|
||||
static GLboolean
|
||||
__glXFreeContext(__GLXcontext * cx)
|
||||
{
|
||||
if (cx->idExists || cx->currentClient)
|
||||
|
@ -294,7 +295,7 @@ glxClientCallback(CallbackListPtr *list, void *closure, void *data)
|
|||
c->loseCurrent(c);
|
||||
lastGLContext = NULL;
|
||||
c->currentClient = NULL;
|
||||
__glXFreeContext(c);
|
||||
FreeResourceByType(c->id, __glXContextRes, FALSE);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
@ -51,7 +51,6 @@
|
|||
#define GLX_RGBA_UNSIGNED_FLOAT_TYPE_EXT 0x20B1
|
||||
#endif
|
||||
|
||||
extern GLboolean __glXFreeContext(__GLXcontext * glxc);
|
||||
extern void __glXFlushContextCache(void);
|
||||
|
||||
extern Bool __glXAddContext(__GLXcontext * cx);
|
||||
|
|
Loading…
Reference in New Issue
Block a user