Skip to content

Fix crash on server reset of Xwayland rootful with explicit sync

With explicit buffer synchronization in use, the window buffers use a file descriptor for event notification to keep the buffer alive for synchronization purpose.

When running rootful, the root window (which is visible) is destroyed directly from the resource manager on server reset, and the window buffer's eventfd will trigger after the window is destroyed, leading to a use after free and a crash of the xserver.

To avoid the issue, check whether the window being destroyed is the root window in rootless mode, and make sure to force the disposal of the window buffers in that case.

This also fixes a related memory leak of the xwl_window for the root window when running rootful:

    | 65,536 bytes in 1 blocks are possibly lost in loss record 12,462 of 12,488
    |    at 0x484A0FC: calloc (vg_replace_malloc.c:1675)
    |    by 0x48B661C: UnknownInlinedFun (pixman-bits-image.c:1273)
    |    by 0x48B661C: _pixman_bits_image_init (pixman-bits-image.c:1296)
    |    by 0x48B6754: create_bits_image_internal (pixman-bits-image.c:1349)
    |    by 0x64180DE: UnknownInlinedFun (cairo-image-surface.c:380)
    |    by 0x64180DE: UnknownInlinedFun (cairo-image-surface.c:366)
    |    by 0x64180DE: cairo_image_surface_create (cairo-image-surface.c:432)
    |    by 0x6346B44: UnknownInlinedFun (libdecor-gtk.c:467)
    |    by 0x6346B44: libdecor_plugin_gtk_frame_new (libdecor-gtk.c:546)
    |    by 0x4B7F297: libdecor_decorate (libdecor.c:559)
    |    by 0x42C6F3: xwl_create_root_surface (xwayland-window.c:1266)
    |    by 0x42CD97: ensure_surface_for_window (xwayland-window.c:1466)
    |    by 0x42D0D1: xwl_realize_window (xwayland-window.c:1560)
    |    by 0x50858F: compRealizeWindow (compwindow.c:279)
    |    by 0x4FF2A2: MapWindow (window.c:2706)
    |    by 0x4F9E7F: InitRootWindow (window.c:697)

Closes: #1699 (closed)

Edited by Olivier Fourdan

Merge request reports