Commit graph

2147 commits

Author SHA1 Message Date
Uli Schlachter
c7f8b28d8d Fix use-after-free in x11 backend during shutdown
The xcb_connection_t instance that is used here comes from
XGetXCBConnection(), is created by XOpenDisplay(), and is owned by the
returned Display*. Calling xcb_disconnect() directly on it leads to
various use-after-frees during shutdown, as reported by valgrind. The
first one of the about 30 errors is:

    Invalid read of size 4
       at 0x71F2051: xcb_take_socket (in /usr/lib64/libxcb.so.1.1.0)
       by 0x78551DD: ??? (in /usr/lib64/libX11.so.6.3.0)
       by 0x7855A14: _XFlush (in /usr/lib64/libX11.so.6.3.0)
       by 0x7858504: _XGetRequest (in /usr/lib64/libX11.so.6.3.0)
       by 0x7838966: XFreeGC (in /usr/lib64/libX11.so.6.3.0)
       by 0x783238B: XCloseDisplay (in /usr/lib64/libX11.so.6.3.0)
       by 0x4E680C2: wlr_x11_backend_destroy (backend.c:333)
       by 0x4E57E94: wlr_backend_destroy (backend.c:39)
       by 0x4E629FB: multi_backend_destroy (backend.c:47)
       by 0x4E62B5A: handle_display_destroy (backend.c:90)
       by 0x50B7E9F: ??? (in /usr/lib64/libwayland-server.so.0.1.0)
       by 0x50B8476: wl_display_destroy (in /usr/lib64/libwayland-server.so.0.1.0)
     Address 0xc14dda0 is 0 bytes inside a block of size 21,152 free'd
       at 0x4C2DD18: free (vg_replace_malloc.c:530)
       by 0x4E680A5: wlr_x11_backend_destroy (backend.c:330)
       by 0x4E57E94: wlr_backend_destroy (backend.c:39)
       by 0x4E629FB: multi_backend_destroy (backend.c:47)
       by 0x4E62B5A: handle_display_destroy (backend.c:90)
       by 0x50B7E9F: ??? (in /usr/lib64/libwayland-server.so.0.1.0)
       by 0x50B8476: wl_display_destroy (in /usr/lib64/libwayland-server.so.0.1.0)
       by 0x40C54E: main (main.c:84)
     Block was alloc'd at
       at 0x4C2EA1E: calloc (vg_replace_malloc.c:711)
       by 0x71F0C60: xcb_connect_to_fd (in /usr/lib64/libxcb.so.1.1.0)
       by 0x71F4BD4: xcb_connect_to_display_with_auth_info (in /usr/lib64/libxcb.so.1.1.0)
       by 0x7854AA1: _XConnectXCB (in /usr/lib64/libX11.so.6.3.0)
       by 0x7845481: XOpenDisplay (in /usr/lib64/libX11.so.6.3.0)
       by 0x4E681B6: wlr_x11_backend_create (backend.c:376)
       by 0x4E580EE: wlr_backend_autocreate (backend.c:99)
       by 0x40C27D: main (main.c:35)

Normally, one would expect this to crash during XCloseDisplay() when
xcb_disconnect() is called again and frees the same data again (glibc would
detect a double free). However, XCloseDisplay() tries to clean up some internal
caches first for which it has to send requests to the X11 server (e.g. the
XFreeGC() above). This fails since the file descriptor was already closed,
which causes an IO error. Xlib's _XDefaultIOError() handles this by printing an
error message and calling exit(1).

Thus, the only symptom of this problem was compositors exiting
mid-shutdown and printing an error message:

    XIO:  fatal IO error 11 (Resource temporarily unavailable) on X server ":0"
          after 6 requests (6 known processed) with 0 events remaining.

Fixes: https://github.com/swaywm/wlroots/issues/745
Signed-off-by: Uli Schlachter <psychon@znc.in>
2018-03-26 10:48:30 +02:00
emersion
e78252adab
Fix segfault in xwm_read_data_source 2018-03-25 18:18:26 -04:00
Tony Crisci
5617a59598
Merge pull request #741 from emersion/unmapped-surface-destroy
xdg-shell, xdg-shell-v6: don't emit unmap if surface is unmapped
2018-03-25 11:04:37 -04:00
emersion
80d3561d32
Merge pull request #743 from acrisci/xdg-surface-close
unified xdg-surface close
2018-03-24 22:02:40 +01:00
Tony Crisci
f53575e3a3 unified xdg-surface close 2018-03-24 15:11:26 -04:00
Drew DeVault
7cc042f54c
Merge pull request #724 from agx/linux-dmabuf-mp
Linux-dmabuf with n_planes > 1
2018-03-23 09:41:31 -04:00
Cedric Sodhi
51141dd11e Minor corrections 2018-03-23 10:28:36 +01:00
Guido Günther
b1852096c5 linux-dmabuf: Support multi plane formats like NV12 2018-03-23 09:03:31 +01:00
Guido Günther
805039457a wlr_surface: fix indentation 2018-03-23 08:59:48 +01:00
Drew DeVault
77d3be66ea
Merge pull request #738 from emersion/gles2-renderer-redesign
Redesign GLES2 renderer
2018-03-22 19:59:15 -04:00
emersion
a854c2f246
Merge branch 'master' into gles2-renderer-redesign 2018-03-23 00:55:55 +01:00
Drew DeVault
ef3769851f
Merge pull request #740 from emersion/egl-debug
render/egl: use EGL_KHR_debug
2018-03-22 18:54:21 -04:00
Tony Crisci
00bb9de29b
Merge pull request #727 from martinetd/x11_wl_backend_fixes
Address sanitizer fixes
2018-03-22 17:28:37 -04:00
Dominique Martinet
e86cd4dc33 wlr_pointer: fix potential null deref
if pointer is null here we'd access pointer->events... anyway
2018-03-22 21:27:49 +01:00
Dominique Martinet
d5e14ab247 wayland backend: fix use-after free on output destroy
==12021==ERROR: AddressSanitizer: heap-use-after-free on address 0x617000015698 at pc 0x7f1a9abe1c09 bp 0x7ffe9068f6b0 sp 0x7ffe9068f6a0
WRITE of size 4 at 0x617000015698 thread T0
    #0 0x7f1a9abe1c08 in pointer_handle_leave ../backend/wayland/wl_seat.c:40
    #1 0x7f1a96ae7d1d in ffi_call_unix64 (/lib64/libffi.so.6+0x5d1d)
    #2 0x7f1a96ae768e in ffi_call (/lib64/libffi.so.6+0x568e)
    #3 0x7f1a988e0d8a  (/lib64/libwayland-client.so.0+0x8d8a)
    #4 0x7f1a988dd927  (/lib64/libwayland-client.so.0+0x5927)
    #5 0x7f1a988debe3 in wl_display_dispatch_queue_pending (/lib64/libwayland-client.so.0+0x6be3)
    #6 0x7f1a9abdd6d6 in dispatch_events ../backend/wayland/backend.c:28
    #7 0x7f1a9a968c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11)
    #8 0x7f1a9a967449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449)
    #9 0x418dff in main ../rootston/main.c:81
    #10 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
    #11 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)

0x617000015698 is located 664 bytes inside of 696-byte region [0x617000015400,0x6170000156b8)
freed by thread T0 here:
    #0 0x7f1a9af754b8 in __interceptor_free (/lib64/libasan.so.4+0xde4b8)
    #1 0x7f1a9abe01ee in wlr_wl_output_destroy ../backend/wayland/output.c:194
    #2 0x7f1a9ac12918 in wlr_output_destroy ../types/wlr_output.c:299
    #3 0x7f1a9abe061b in xdg_toplevel_handle_close ../backend/wayland/output.c:255
    #4 0x7f1a96ae7d1d in ffi_call_unix64 (/lib64/libffi.so.6+0x5d1d)
    #5 0x7f1a96ae768e in ffi_call (/lib64/libffi.so.6+0x568e)
    #6 0x7f1a988e0d8a  (/lib64/libwayland-client.so.0+0x8d8a)
    #7 0x7f1a988dd927  (/lib64/libwayland-client.so.0+0x5927)
    #8 0x7f1a988debe3 in wl_display_dispatch_queue_pending (/lib64/libwayland-client.so.0+0x6be3)
    #9 0x7f1a9abdd6d6 in dispatch_events ../backend/wayland/backend.c:28
    #10 0x7f1a9a968c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11)
    #11 0x7f1a9a967449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449)
    #12 0x418dff in main ../rootston/main.c:81
    #13 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
    #14 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)

previously allocated by thread T0 here:
    #0 0x7f1a9af75a38 in __interceptor_calloc (/lib64/libasan.so.4+0xdea38)
    #1 0x7f1a9abe0703 in wlr_wl_output_create ../backend/wayland/output.c:272
    #2 0x7f1a9abdd8eb in wlr_wl_backend_start ../backend/wayland/backend.c:55
    #3 0x7f1a9abbeb49 in wlr_backend_start ../backend/backend.c:28
    #4 0x7f1a9abd8ce1 in multi_backend_start ../backend/multi/backend.c:24
    #5 0x7f1a9abbeb49 in wlr_backend_start ../backend/backend.c:28
    #6 0x418c32 in main ../rootston/main.c:58
    #7 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
    #8 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)
2018-03-22 21:27:49 +01:00
Dominique Martinet
b0c2bbebd1 x11 backend: fix various leaks
- xcb_query_pointer_reply return value needs to be freed
 - call XCloseDisplay
 - remove wl event_source
2018-03-22 21:25:41 +01:00
Dominique Martinet
d9a3c66942 rootston/output: fix leak in damage_from_surface 2018-03-22 21:25:41 +01:00
Dominique Martinet
de955a0f63 xdg_popup_grab: add listener on seat destroy 2018-03-22 21:25:41 +01:00
emersion
731ee24089
xdg-shell, xdg-shell-v6: don't emit unmap if surface is unmapped
Some clients create an xdg_surface, then create an xdg_toplevel,
but don't map it and destroy it right after. The xdg_surface ends
up in a state where it isn't mapped but role-specific resources
have been allocated. xdg_surface_unmap needs to free these
resources without emitting the unmap signal.
2018-03-21 20:11:53 +01:00
emersion
60bfe0a6aa
backend/drm: remove remaining raw GL call
This makes the hardware cursor code a less efficient. Can be
fixed with a GLES3 renderer.
2018-03-21 11:34:08 +01:00
emersion
b1f93bc5cc
render/egl: use EGL_KHR_debug 2018-03-21 10:42:43 +01:00
emersion
8207f0f081
render/gles2: use gles2_pixel_format::has_alpha for shader selection 2018-03-21 08:53:36 +01:00
emersion
cc5ef1d2ff
render/gles2: move list of supported WL formats to pixel_format.c 2018-03-21 08:50:59 +01:00
emersion
3581573bdc
render/gles2: make wlr_renderer_begin take viewport size
This allows raw GL calls outside wlr_renderer to be removed.
2018-03-21 07:37:09 +01:00
emersion
95e86e675a
render/gles2: remove global state, use OpenGL debug extension 2018-03-20 19:14:33 +01:00
Drew DeVault
ff2e08aa74
Merge pull request #736 from agx/gles2-tex-target
Gles2 tex target
2018-03-20 13:16:30 -04:00
Guido Günther
2d01663b25 gles2: Honor alpha in fragment_src_external
By using the same vertex shader and adding alpha to the fragment shader
for external textures we can:

  - use alpha blending
  - have wlr_gles2_render_texture_with_matrix work with
    the GL_TEXTURE_EXTERNAL_OES. So far this failed
    since we passed in alpha which was unknown by fragment_src_external
2018-03-20 14:30:30 +01:00
Guido Günther
13e4ba4867 gles2_texture_bind: use texture's target type
Hardcoding GL_TEXTURE_2D leads to rendering errors when using
GL_TEXTURE_EXTERNAL_OES textures.
2018-03-20 14:30:30 +01:00
Guido Günther
b3cb5a36c7 gles2: allow to specify texture target type
Allow to set the texture target type when generating/binding the
texture.  This allows us to attach the texture type to the texture so we
don't have to keep the logic elsewhere.
2018-03-20 14:30:30 +01:00
Drew DeVault
453516a621
Merge pull request #735 from emersion/split-render-h
render: split render.h into wlr_renderer.h and wlr_texture.h
2018-03-19 18:21:41 -04:00
emersion
c41de2d1be
render: split render.h into wlr_renderer.h and wlr_texture.h 2018-03-19 23:16:29 +01:00
Drew DeVault
a76cef475b
Merge pull request #733 from emersion/fix-matrix-transpose
Don't use OpenGL matrix transposition
2018-03-19 16:36:17 -04:00
Drew DeVault
8d490fdb34 Write some more docs 2018-03-19 15:46:28 -04:00
emersion
6ecb0eefcb
render/gles2: transpose matrices before binding them
Setting glUniformMatrix3fv's transpose parameter to GL_TRUE is
not allowed for OpenGL ES 2.

This adds a wlr_matrix_transpose function.
2018-03-19 20:21:02 +01:00
emersion
6227da96b1
backend/drm: don't hardcode matrix 2018-03-18 11:34:23 +01:00
emersion
bfc9b13dcd
Merge pull request #730 from martinetd/matrix_rotate
Rootston: fix rotation heading (was: wlr_matrix: fix matrix_rotate)
2018-03-18 09:25:33 +01:00
Dominique Martinet
a491f780b8 rootston rotation: change view->rotation sign
The convetion with wlr_matrix changed and it's a good time to remove
all these pesky minus signs
2018-03-18 09:19:09 +01:00
Drew DeVault
1956d3cedb
Merge pull request #722 from emersion/matrix-redesign
Matrix redesign
2018-03-17 15:22:00 -04:00
Tony Crisci
09413aa7f1
Merge pull request #711 from emersion/map-unmap
Add map/unmap to xdg-shell
2018-03-17 10:00:54 -04:00
emersion
9cc875429b
Merge pull request #726 from agx/egl-print-dmabuf-formats
egl: print supported dmabuf formats
2018-03-16 09:52:27 +01:00
Guido Günther
7fd7dff26f egl: print supported dmabuf formats
Useful for debugging dmabuf related problems e.g. when a client requests
a certain and we fail to support it.
2018-03-16 09:47:21 +01:00
emersion
303883ce49
rootston: properly emit view unmap event 2018-03-15 21:47:20 +01:00
Tony Crisci
8ad0c5376c
Merge pull request #721 from emersion/simplify-screenshot-client
examples: simplify screenshot client
2018-03-15 16:42:10 -04:00
emersion
f1cbbac636
render/gles2: remove matrix transposition in shaders 2018-03-15 21:30:31 +01:00
emersion
7894fca224
matrix: rename wlr_matrix_texture to wlr_matrix_projection 2018-03-15 21:26:45 +01:00
emersion
e607d0f7ee
xdg-shell: add map/unmap support 2018-03-15 20:15:09 +01:00
emersion
42cc575266
xdg-shell-v6: fix wl_list_remove called twice 2018-03-15 20:14:47 +01:00
emersion
361d7c857e
xdg-shell-v6: don't leak wlr_xdg_surface_v6_configure.toplevel_state 2018-03-15 19:40:57 +01:00
emersion
876f07e9f1
renderer: replace wlr_texture_get_matrix by wlr_render_texture 2018-03-15 19:31:02 +01:00
emersion
1914a1aa2b
surface: drop wlr_surface_get_matrix 2018-03-15 18:35:22 +01:00