diff --git a/0001-xwayland-present-Destroy-sync_callback-in-xwl_presen.patch b/0001-xwayland-present-Destroy-sync_callback-in-xwl_presen.patch new file mode 100644 index 0000000..58c78d2 --- /dev/null +++ b/0001-xwayland-present-Destroy-sync_callback-in-xwl_presen.patch @@ -0,0 +1,36 @@ +From 2e18eec6f03cc4d9d5bf62853c65d341b363f4b3 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Fri, 8 Mar 2019 18:49:04 +0100 +Subject: [PATCH xserver] xwayland/present: Destroy sync_callback in + xwl_present_cleanup + +xwl_present_cleanup frees the struct xwl_present_window memory, +so if there's a pending callback, we have to destroy it to prevent +use-after-free in xwl_present_sync_callback. + +Should fix issue #645. + +Reviewed-by: Olivier Fourdan +--- + hw/xwayland/xwayland-present.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/hw/xwayland/xwayland-present.c b/hw/xwayland/xwayland-present.c +index 192f59a653..a1b3109cc2 100644 +--- a/hw/xwayland/xwayland-present.c ++++ b/hw/xwayland/xwayland-present.c +@@ -123,6 +123,11 @@ xwl_present_cleanup(WindowPtr window) + xwl_present_window->frame_callback = NULL; + } + ++ if (xwl_present_window->sync_callback) { ++ wl_callback_destroy(xwl_present_window->sync_callback); ++ xwl_present_window->sync_callback = NULL; ++ } ++ + /* Clear remaining events */ + xorg_list_for_each_entry_safe(event, tmp, &xwl_present_window->event_list, list) { + xorg_list_del(&event->list); +-- +2.20.1 + diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index 8b0a10c..da6af0b 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -46,7 +46,7 @@ Summary: X.Org X11 X server Name: xorg-x11-server Version: 1.20.4 -Release: 1%{?gitdate:.%{gitdate}}%{?dist} +Release: 2%{?gitdate:.%{gitdate}}%{?dist} URL: http://www.x.org License: MIT @@ -94,6 +94,8 @@ Patch5: 0001-autobind-GPUs-to-the-screen.patch # because the display-managers are not ready yet, do not upstream Patch6: 0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch +Patch10: 0001-xwayland-present-Destroy-sync_callback-in-xwl_presen.patch + BuildRequires: systemtap-sdt-devel BuildRequires: git BuildRequires: automake autoconf libtool pkgconfig @@ -518,6 +520,9 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %changelog +* Thu Mar 21 2019 Adam Jackson - 1.20.4-2 +- Backport an Xwayland crash fix in the Present code + * Tue Feb 26 2019 Adam Jackson - 1.20.4-1 - xserver 1.20.4