fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-05-09 15:28:08 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

randr: clear primary screen's primaryOutput when the output is deleted

Browse source 
This fix use after free when a pluggable gpu screen (such as displaylink)
was set as primary screen and unpluged.

gdb backtrace:
 #0 OssigHandler (signo=11, sip=0x7fff2e0a50f0, unused=0x7fff2e0a4fc0) at ../../../../os/osinit.c:138
 #1 <signal handler called>
 #2 rrGetscreenResources (client=0x3195160, query=0) at ../../../../randr/rrscreen.c:577
 #3 0x0000000000562bae in ProcRRGetscreenResourcesCurrent (client=0x3195160) at ../../../../randr/rrscreen.c:652
 #4 OxOOOOB0000054de63 in ProcRRDispatch (client=0x3195160) at ../../../../randr/randr.c:717
 #5 0x00000000004322c6 in Dispatch () at ../../../../dix/dispatch.c:485
 #6 0x0900900990443139 in dix_main (argc=12, argv=0x7fff2e0a5f78, envp=0x7fff2e0a5fe0) at ../../../../dix/main.c:276
 #7 0X0000000000421d9a in main (argc=12, argv=0x7fff2e0a5f78, envp=0x7fff2e0a5fe0) at ../../../../dix/stubmain.c:34

Signed-off-by: hongao <hongao@uniontech.com>
(cherry picked from commit 1443fd34ea)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2151>
This commit is contained in:
hongao 2024-05-15 14:35:23 +08:00 • committed by Marge Bot
parent da8185b42f
commit fb69bd234e
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
randr/rroutput.c
View file

@ -374,6 +374,8 @@ RROutputDestroyResource(void *value, XID pid)
{
RROutputPtr output = (RROutputPtr) value;
ScreenPtr pScreen = output->pScreen;
ScreenPtr primary;
rrScrPrivPtr primarysp;
int m;
if (pScreen) {
@ -394,6 +396,15 @@ RROutputDestroyResource(void *value, XID pid)
if (pScrPriv->primaryOutput == output)
pScrPriv->primaryOutput = NULL;
if (pScreen->isGPU) {
primary = pScreen->current_primary;
if (primary) {
primarysp = rrGetScrPriv(primary);
if (primarysp->primaryOutput == output)
primarysp->primaryOutput = NULL;
}
}
for (i = 0; i < pScrPriv->numOutputs; i++) {
if (pScrPriv->outputs[i] == output) {
memmove(pScrPriv->outputs + i, pScrPriv->outputs + i + 1,