Go to file
Steven McDonald d7a2df0a74 Xi: block SIGIOs while copying device classes around
I've been seeing sporadic (anywhere from once every few days to 3-4
times a day) crashes and freezes in X. The problematic behaviour isn't
always the same, but I chose a particular incident to debug, and found
that X was segfaulting in updateMotionHistory, on line 575 of
dix/getevents.c.

After some further investigation, I found that the bug was being
triggered when a SIGIO was received in DeepCopyPointerClasses, between
the AllocValuatorClass call (line 540) and updating the to->valuator
pointer (line 545). AllocValuatorClass calls realloc() on to->valuator,
so between these lines, it's not guaranteed to point to allocated
memory.

It seems the SIGIO handler is calling updateMotionHistory, which is
reading the memory pointed to by to->valuator and getting a wrong value
for last_motion, which updates buff to point to wildly the wrong place
and thus generates a segfault when a memcpy() is done into buff.

I am attaching a patch which I've been running on that machine for the
past three days, and haven't yet observed any more crashing or freezing
behaviour. The patch simply calls OsBlockSIGIO while
DeepCopyDeviceClasses is in progress, as the state of the X server's
device data structures is not guaranteed to be in a consistent state
during that time.

Debian bug#744303 <https://bugs.debian.org/744303>

Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-05-23 11:08:17 +10:00
composite composite: Fix memory leak in compCopyWindow 2014-04-21 20:56:48 -07:00
config config: revert quirk for the Evoluent Vertical Mouse 2014-05-15 12:56:54 +10:00
damageext Replace 'pointer' type with 'void *' 2014-01-12 10:24:11 -08:00
dbe Replace 'pointer' type with 'void *' 2014-01-12 10:24:11 -08:00
dix dix: remove a now-superfluous comment 2014-04-29 10:06:25 +10:00
doc doc: Update documentation about Windows platforms support a bit 2012-10-29 12:21:14 +00:00
dri3 dri3: Fix dri3_open API change by adding new dri3_open_client 2014-04-08 13:53:58 -07:00
exa exa: Fix -Wshadow warnings 2014-01-22 19:56:32 -08:00
fb fb: Fix origin of source picture in fbGlyphs 2014-04-21 20:48:34 -07:00
glamor glamor: Don't forget to check whether we can fall back in polysegment. 2014-05-12 14:47:06 -07:00
glx Add a command line argument for disabling indirect GLX. 2014-04-23 13:24:22 -07:00
hw xfree86: fix warnings after MatchSeat patch 2014-05-12 14:14:28 -07:00
include systemd-logind: let the logind code decided whether to close an fd 2014-05-05 07:26:33 +10:00
m4 xorg-tls: fix warning, replace AC_TRY_COMPILE with AC_COMPILE_IFELSE 2014-01-22 11:18:42 -08:00
man Correct description of -displayfd option in man page. 2012-10-11 12:53:57 +01:00
mi mi: start calculating the sprite trace from the first child of root 2014-05-08 12:59:19 -07:00
miext sync: Add a header include necessary to use misyncstr.h 2014-03-17 14:30:45 -07:00
os os: automatically switch to sigsafe logging when needed 2014-05-23 11:08:13 +10:00
present Replace 'pointer' type with 'void *' 2014-01-12 10:24:11 -08:00
pseudoramiX pseudoramiX: Add _X_ATTRIBUTE_PRINTF attributes to debug functions. 2014-01-27 11:38:34 -08:00
randr rrcrtc: brackets are hard, lets go shopping. 2014-05-12 14:55:04 -07:00
record Clean up a few function prototypes to not place formals in /**/ 2014-01-12 10:24:12 -08:00
render xfixes: Forbid manipulating clip for source-only pictures (#28968) 2014-04-22 07:50:17 -07:00
test .gitignore: Add new autotools file 'test-driver' 2014-04-21 13:41:42 -07:00
Xext selinux: don't checkout for AVCs on select() EINTR 2014-04-30 08:56:35 -07:00
xfixes xfixes: Forbid manipulating clip for source-only pictures (#28968) 2014-04-22 07:50:17 -07:00
Xi Xi: block SIGIOs while copying device classes around 2014-05-23 11:08:17 +10:00
xkb xkb: Verify reads of compiled keymap header and TOC 2014-04-18 16:30:18 -07:00
.dir-locals.el Add .dir-locals.el 2013-08-17 12:17:36 +02:00
.gitignore .gitignore: Add new autotools file 'test-driver' 2014-04-21 13:41:42 -07:00
autogen.sh autogen.sh: Honor NOCONFIGURE=1 2012-10-19 13:12:33 +10:00
configure.ac default to stub int10 implementation on arm 2014-04-27 12:01:56 -04:00
COPYING Shadow: Switch the Amiga/Atari bitplane code to the canonical X.Org license 2013-05-14 14:41:00 -07:00
devbook.am devbook.am: maintenance update from docbook.am 2011-09-21 14:07:52 -07:00
docbook.am docbook.am: embed css styles inside the HTML HEAD element 2011-09-21 14:07:49 -07:00
fix-miregion Change region implementation names to eliminate the 'mi' prefix 2010-06-05 17:47:32 -07:00
fix-miregion-private Change region implementation names to eliminate the 'mi' prefix 2010-06-05 17:47:32 -07:00
fix-patch-whitespace Rename region macros to eliminate screen argument 2010-06-05 18:59:00 -07:00
fix-region Rename region macros to eliminate screen argument 2010-06-05 18:59:00 -07:00
Makefile.am DIST_SUBDIRS needs to include glamor, even if it isn't built 2014-02-13 15:25:56 -08:00
manpages.am Xorg: Add a suid root wrapper 2014-03-12 08:50:05 +01:00
README packaging: provide a default README file #24206 2010-01-27 14:00:17 -08:00
xorg-server.m4 macros: clarify documentation 2012-11-05 13:24:57 -06:00
xorg-server.pc.in xfree86: link modules against Xorg symbols on Cygwin 2012-04-05 21:57:07 -05:00
xserver.ent.in doc: relocate xserver.ent in the package root directory 2011-05-14 11:22:26 -07:00

					X Server

The X server accepts requests from client applications to create windows,
which are (normally rectangular) "virtual screens" that the client program
can draw into.

Windows are then composed on the actual screen by the X server
(or by a separate composite manager) as directed by the window manager,
which usually communicates with the user via graphical controls such as buttons
and draggable titlebars and borders.

For a comprehensive overview of X Server and X Window System, consult the
following article:
http://en.wikipedia.org/wiki/X_server

All questions regarding this software should be directed at the
Xorg mailing list:

        http://lists.freedesktop.org/mailman/listinfo/xorg

Please submit bug reports to the Xorg bugzilla:

        https://bugs.freedesktop.org/enter_bug.cgi?product=xorg

The master development code repository can be found at:

        git://anongit.freedesktop.org/git/xorg/xserver

        http://cgit.freedesktop.org/xorg/xserver

For patch submission instructions, see:

	http://www.x.org/wiki/Development/Documentation/SubmittingPatches

For more information on the git code manager, see:

        http://wiki.x.org/wiki/GitPage