xserver: Branch 'server-1.20-branch'
GitLab Mirror
gitlab-mirror at kemper.freedesktop.org
Sat Jun 26 21:20:36 UTC 2021
glx/glxcmds.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
New commits:
commit 9a59631a490876eae57f813e3a274c46d35d5287
Author: Olivier Fourdan <ofourdan at redhat.com>
Date: Fri Jun 18 14:52:55 2021 +0200
glx: Fix use after free in MakeCurrent
The fix from commit c468d34c7 - "glx: Set ContextTag for all contexts"
is actually incomplete, it correctly sets the context tag for direct
contexts as well, but would fail to mark the context's currentClient.
As a result, when the context is destroyed, it would be freed
immediately rather than being just scheduled for deletion, even though
it is still current for some client. leading to a use-after-free.
Make sure to also set the context's currentClient for direct contexts as
well, not just indirect ones.
Signed-off-by: Olivier Fourdan <ofourdan at redhat.com>
Fixes: c468d34c7 - "glx: Set ContextTag for all contexts"
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1186
Reviewed-by: Adam Jackson <ajax at redhat.com>
(cherry picked from commit aad61e8e03311eb8bae4f7db59e65634733eadc2)
diff --git a/glx/glxcmds.c b/glx/glxcmds.c
index d148c79bf..c82ce2c78 100644
--- a/glx/glxcmds.c
+++ b/glx/glxcmds.c
@@ -648,11 +648,11 @@ xorgGlxMakeCurrent(ClientPtr client, GLXContextTag tag, XID drawId, XID readId,
glxc->readPriv = NULL;
return __glXError(GLXBadContext);
}
-
- glxc->currentClient = client;
}
glxServer.setContextTagPrivate(client, newContextTag, glxc);
+ if (glxc)
+ glxc->currentClient = client;
if (prevglxc) {
prevglxc->currentClient = NULL;
More information about the xorg-commit
mailing list