hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-09-11 18:42:23 +00:00
Code Issues Projects Releases Wiki Activity

miext/sync/misyncfd.c: fix NULL deref on uninitialized screens

Browse source 
852128f18 made the screen private preallocated, so it exists on every
screen as soon as the single global key is registered. sync_fd_screen_priv()
therefore never returns NULL again, which breaks the "already initialized"
check in miSyncFdScreenInit() and the guards in miSyncInitFenceFromFD() /
miSyncFDFromFence(), which then call through a zeroed funcs pointer.

Multi-GPU setups crash on this: with glamor on one screen and a non-glamor
driver (NVIDIA blob under PRIME) on the other, XSyncCreateFenceFromFD on
the latter kills the server.

Use a filled-in funcs as the sentinel instead of the private's presence.

Assisted-by: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Kiyoshi Spreclerg <kiyoshi_pip@protonmail.com>
This commit is contained in:
Kiyoshi Spreclerg 2026-08-28 17:34:13 -03:00 • committed by Enrico Weigelt, metux IT consult
commit 22fcc8cca0
1 changed files with 13 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
miext/sync/misyncfd.c
View file

@ -38,9 +38,20 @@ typedef struct _SyncFdScreenPrivate {
static inline SyncFdScreenPrivatePtr sync_fd_screen_priv(ScreenPtr pScreen)
{
SyncFdScreenPrivatePtr priv;
if (!dixPrivateKeyRegistered(&syncFdScreenPrivateKey))
return NULL;
return dixLookupPrivate(&pScreen->devPrivates, &syncFdScreenPrivateKey);
/* The private is preallocated on every screen as soon as the key is
* registered by any single screen, so its mere presence says nothing.
* Only screens that went through miSyncFdScreenInit() have funcs set.
*/
priv = dixLookupPrivate(&pScreen->devPrivates, &syncFdScreenPrivateKey);
if (priv->funcs.version <= 0)
return NULL;
return priv;
}
int
@ -83,7 +94,7 @@ Bool miSyncFdScreenInit(ScreenPtr pScreen,
return FALSE;
}
priv = sync_fd_screen_priv(pScreen);
priv = dixLookupPrivate(&pScreen->devPrivates, &syncFdScreenPrivateKey);
memset(priv, 0, sizeof(*priv));
/* Will require version checks when there are multiple versions