libX11: Changes to 'master'

[GitLab Mirror]

 include/X11/Xlibint.h |    3 +--
 src/OpenDis.c         |    2 +-
 src/XlibInt.c         |   14 +++++++++++---
 src/locking.c         |   12 ++++++++++++
 src/locking.h         |   12 ++++++++++++
 5 files changed, 37 insertions(+), 6 deletions(-)

New commits:
commit 30ccef3a48029bf4fc31d4abda2d2778d0ad6277
Author: Keith Packard <keithp at keithp.com>
Date:   Sat Nov 7 22:22:47 2020 -0800

    Avoid recursing through _XError due to sequence adjustment
    
    This patch is based on research done by Dmitry Osipenko to uncover the
    cause of a large class of Xlib lockups.
    
    _XError must unlock and re-lock the display around the call to the
    user error handler function. When re-locking the display, two
    functions are called to ensure that the display is ready to generate a request:
    
        _XIDHandler(dpy);
        _XSeqSyncFunction(dpy);
    
    The first ensures that there is at least one XID available to use
    (possibly calling _xcb_generate_id to do so). The second makes sure a
    reply is received at least every 65535 requests to keep sequence
    numbers in sync (possibly generating a GetInputFocus request and
    synchronously awaiting the reply).
    
    If the second of these does generate a GetInputFocus request and wait
    for the reply, then a pending error will cause recursion into _XError,
    which deadlocks the display.
    
    One seemingly easy fix is to have _XError avoid those calls by
    invoking InternalLockDisplay instead of LockDisplay. That function
    does everything that LockDisplay does *except* call those final two
    functions which may end up receiving an error.
    
    However, that doesn't protect the system from applications which call
    some legal Xlib function from within their error handler. Any Xlib
    function which cannot generate protocol or wait for events is valid,
    including many which invoke LockDisplay.
    
    What we need to do is make LockDisplay skip these two function calls
    precisely when it is called from within the _XError context for the
    same display.
    
    This patch accomplishes this by creating a list of threads in the
    display which are in _XError, and then having LockDisplay check the
    current thread against those list elements.
    
    Inspired-by: Dmitry Osipenko <digetx at gmail.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    Tested-by: Dmitry Osipenko <digetx at gmail.com>
    Reviewed-by: Dmitry Osipenko <digetx at gmail.com>