xserver/hw
Olivier Fourdan 002d7d3754 xwayland: Force disposal of windows buffers for root on destroy
With explicit buffer synchronization in use, the window buffers use a
file descriptor for event notification to keep the buffer alive for
synchronization purpose.

When running rootful, the root window (which is visible) is destroyed
directly from the resource manager on server reset, and the window
buffer's eventfd will trigger after the window is destroyed, leading to
a use after free and a crash of the xserver.

To avoid the issue, check whether the window being destroyed is the root
window in rootless mode, and make sure to force the disposal of the
window buffers in that case.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1699
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1589>
(cherry picked from commit a5e863963e)
2026-01-25 10:39:55 -08:00
..
kdrive kdrive: drop Solaris specific hack 2026-01-25 10:39:53 -08:00
vfb Xvfb: Support up to 13 mouse buttons 2024-01-08 11:16:11 +00:00
xfree86 modesetting: Fix hang when all probed cursor sizes fail to find a minimum one 2026-01-25 10:39:54 -08:00
xnest rename remaining RT_* defines to X11_RESTYPE_* 2026-01-19 12:48:30 -08:00
xquartz xquartz: Remove invalid Unicode sequence 2026-01-25 10:39:53 -08:00
xwayland xwayland: Force disposal of windows buffers for root on destroy 2026-01-25 10:39:55 -08:00
xwin rename remaining RT_* defines to X11_RESTYPE_* 2026-01-19 12:48:30 -08:00
meson.build Drop DMX DDX 2021-09-07 09:34:31 +00:00