[PATCH xserver] dix: Make sure client is not in output_pending chain after closed (RH 1382444)

[Hans de Goede]

Hi,

On 02-11-16 21:39, Keith Packard wrote:
> I think it is possible that output could get queued to a client during
> CloseDownClient. After it is removed from the pending queue, active
> grabs are released, the client is awoken if sleeping and any work
> queue entries related to the client are processed.
>
> To fix this, move the call removing it from the output_pending chain
> until after clientGone has been set and then check clientGone in
> output_pending_mark.
>
> Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1382444
> Signed-off-by: Keith Packard <keithp at keithp.com>

Patch looks good to me:

Reviewed-by: Hans de Goede <hdegoede at redhat.com>

Regards,

Hans


> ---
>  dix/dispatch.c      | 2 +-
>  include/dixstruct.h | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/dix/dispatch.c b/dix/dispatch.c
> index e111377..3d0fe26 100644
> --- a/dix/dispatch.c
> +++ b/dix/dispatch.c
> @@ -3406,7 +3406,6 @@ CloseDownClient(ClientPtr client)
>              UngrabServer(client);
>          }
>          mark_client_not_ready(client);
> -        xorg_list_del(&client->output_pending);
>          BITCLEAR(grabWaiters, client->index);
>          DeleteClientFromAnySelections(client);
>          ReleaseActiveGrabs(client);
> @@ -3435,6 +3434,7 @@ CloseDownClient(ClientPtr client)
>          if (ClientIsAsleep(client))
>              ClientSignal(client);
>          ProcessWorkQueueZombies();
> +        output_pending_clear(client);
>          CloseDownConnection(client);
>
>          /* If the client made it to the Running stage, nClients has
> diff --git a/include/dixstruct.h b/include/dixstruct.h
> index 3b578f8..d71b0ac 100644
> --- a/include/dixstruct.h
> +++ b/include/dixstruct.h
> @@ -159,7 +159,7 @@ extern struct xorg_list output_pending_clients;
>  static inline void
>  output_pending_mark(ClientPtr client)
>  {
> -    if (xorg_list_is_empty(&client->output_pending))
> +    if (!client->clientGone && xorg_list_is_empty(&client->output_pending))
>          xorg_list_append(&client->output_pending, &output_pending_clients);
>  }
>
>