Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xwayland for openSUSE:Factory checked in at 2022-10-25 11:18:30 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xwayland (Old) and /work/SRC/openSUSE:Factory/.xwayland.new.2275 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "xwayland" Tue Oct 25 11:18:30 2022 rev:15 rq:1030894 version:22.1.4 Changes: -------- --- /work/SRC/openSUSE:Factory/xwayland/xwayland.changes 2022-10-20 11:10:12.767837489 +0200 +++ /work/SRC/openSUSE:Factory/.xwayland.new.2275/xwayland.changes 2022-10-25 11:18:35.441948243 +0200 @@ -1,0 +2,30 @@ +Mon Oct 24 13:50:22 UTC 2022 - Stefan Dirsch <sndirsch@suse.com> + +- U_Do-not-ignore-leave-events.patch + * fixes xwayland issue#1397, issue#1395 + +------------------------------------------------------------------- +Thu Oct 20 11:50:17 UTC 2022 - Stefan Dirsch <sndirsch@suse.com> + +- Update to version 22.1.4 + * xwayland: Aggregate scroll axis events to fix kinetic scrolling + * Forbid server grabs by non-WM on *rootless* XWayland + * xkb: Avoid length-check failure on empty strings. + * ci: remove redundant slash in libxcvt repository url + * dix: Skip more code in SetRootClip for ROOT_CLIP_INPUT_ONLY + * dix: Fix overzealous caching of ResourceClientBits() + * xwayland: Prevent Xserver grabs with rootless + * xwayland: Delay wl_surface destruction + * build: Bump wayland requirement to 1.18 + * xwayland: set tag on our surfaces + * xwayland: Clear the "xwl-window" tag on unrealize + * xwayland: correct the type for the discrete scroll events + * xkb: fix some possible memleaks in XkbGetKbdByName + * xkb: length-check XkbGetKbdByName before accessing the fields + * xkb: length-check XkbListComponents before accessing the fields + * xkb: proof GetCountedString against request length attacks +- supersedes security patches: + * U_xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch + * U_xkb-proof-GetCountedString-against-request-length-at.patch + +------------------------------------------------------------------- Old: ---- U_xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch U_xkb-proof-GetCountedString-against-request-length-at.patch xwayland-22.1.3.tar.xz xwayland-22.1.3.tar.xz.sig New: ---- U_Do-not-ignore-leave-events.patch xwayland-22.1.4.tar.xz xwayland-22.1.4.tar.xz.sig ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xwayland.spec ++++++ --- /var/tmp/diff_new_pack.fwDWfQ/_old 2022-10-25 11:18:35.969949414 +0200 +++ /var/tmp/diff_new_pack.fwDWfQ/_new 2022-10-25 11:18:35.973949423 +0200 @@ -24,7 +24,7 @@ %endif Name: xwayland -Version: 22.1.3 +Version: 22.1.4 Release: 0 URL: http://xorg.freedesktop.org/ Summary: X @@ -33,8 +33,7 @@ Source0: %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz Source1: %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz.sig Source2: xwayland.keyring -Patch1204412: U_xkb-proof-GetCountedString-against-request-length-at.patch -Patch1204416: U_xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch +Patch0: U_Do-not-ignore-leave-events.patch BuildRequires: meson BuildRequires: ninja BuildRequires: pkgconfig ++++++ U_Do-not-ignore-leave-events.patch ++++++ From bd39c17e2398f82910978ed55ac772c67d8f940a Mon Sep 17 00:00:00 2001 From: Olivier Fourdan <ofourdan@redhat.com> Date: Mon, 24 Oct 2022 09:24:01 +0200 Subject: [PATCH] xwayland/input: Do not ignore leave events Commit 8a5f3ddb2 ("set tag on our surface") introduced the use of tags to differentiate our own surfaces, and commit a1d14aa8c ("Clear the "xwl-window" tag on unrealize") removed the tags before the surfaces are actually destroyed. Xwayland would then rely on these tags on the surface to decide whether to ignore or to process the Wayland event in various places. However, in doing so, it also checked for the tag on keyboard leave events. As a result, if the keyboard leave events is received after the X11 window is unrealized, keyboard_handle_leave() would not queue the LeaveNotify events for the DIX to proceed, and the key repeat would kick in and repeat the key event indefinitely. To avoid the issue, process events regardless of the tag as before in keyboard_handle_leave(). Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> Fixes: 8a5f3ddb2 - "xwayland: set tag on our surface" Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1395 --- hw/xwayland/xwayland-input.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/hw/xwayland/xwayland-input.c b/hw/xwayland/xwayland-input.c index 240eb0139..9eda1ef71 100644 --- a/hw/xwayland/xwayland-input.c +++ b/hw/xwayland/xwayland-input.c @@ -1147,9 +1147,6 @@ keyboard_handle_leave(void *data, struct wl_keyboard *keyboard, struct xwl_seat *xwl_seat = data; uint32_t *k; - if (surface != NULL && !is_surface_from_xwl_window(surface)) - return; - xwl_seat->xwl_screen->serial = serial; wl_array_for_each(k, &xwl_seat->keys) -- GitLab ++++++ xwayland-22.1.3.tar.xz -> xwayland-22.1.4.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-22.1.3/.gitlab-ci/debian-install.sh new/xwayland-22.1.4/.gitlab-ci/debian-install.sh --- old/xwayland-22.1.3/.gitlab-ci/debian-install.sh 2022-07-12 15:48:31.000000000 +0200 +++ new/xwayland-22.1.4/.gitlab-ci/debian-install.sh 2022-10-20 09:24:51.000000000 +0200 @@ -102,7 +102,7 @@ cd /root # xserver requires libxcvt -git clone https://gitlab.freedesktop.org/xorg/lib//libxcvt.git --depth 1 --branch=libxcvt-0.1.0 +git clone https://gitlab.freedesktop.org/xorg/lib/libxcvt.git --depth 1 --branch=libxcvt-0.1.0 cd libxcvt meson _build ninja -C _build -j${FDO_CI_CONCURRENT:-4} install diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-22.1.3/dix/resource.c new/xwayland-22.1.4/dix/resource.c --- old/xwayland-22.1.3/dix/resource.c 2022-07-12 15:48:31.000000000 +0200 +++ new/xwayland-22.1.4/dix/resource.c 2022-10-20 09:24:51.000000000 +0200 @@ -620,12 +620,15 @@ unsigned int ResourceClientBits(void) { - static unsigned int cached = 0; + static unsigned int cache_ilog2 = 0; + static unsigned int cache_limit = 0; - if (cached == 0) - cached = ilog2(LimitClients); + if (LimitClients != cache_limit) { + cache_limit = LimitClients; + cache_ilog2 = ilog2(LimitClients); + } - return cached; + return cache_ilog2; } /***************** diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-22.1.3/dix/window.c new/xwayland-22.1.4/dix/window.c --- old/xwayland-22.1.3/dix/window.c 2022-07-12 15:48:31.000000000 +0200 +++ new/xwayland-22.1.4/dix/window.c 2022-10-20 09:24:51.000000000 +0200 @@ -3642,7 +3642,7 @@ if (!pWin) return; WasViewable = (Bool) (pWin->viewable); - if (WasViewable) { + if (WasViewable && mode != ROOT_CLIP_INPUT_ONLY) { for (pChild = pWin->firstChild; pChild; pChild = pChild->nextSib) { (void) (*pScreen->MarkOverlappedWindows) (pChild, pChild, &pLayerWin); @@ -3696,7 +3696,7 @@ ResizeChildrenWinSize(pWin, 0, 0, 0, 0); - if (WasViewable) { + if (WasViewable && mode != ROOT_CLIP_INPUT_ONLY) { if (pWin->firstChild) { anyMarked |= (*pScreen->MarkOverlappedWindows) (pWin->firstChild, pWin->firstChild, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-22.1.3/hw/xwayland/xwayland-input.c new/xwayland-22.1.4/hw/xwayland/xwayland-input.c --- old/xwayland-22.1.3/hw/xwayland/xwayland-input.c 2022-07-12 15:48:31.000000000 +0200 +++ new/xwayland-22.1.4/hw/xwayland/xwayland-input.c 2022-10-20 09:24:51.000000000 +0200 @@ -50,12 +50,6 @@ #include "pointer-gestures-unstable-v1-client-protocol.h" #include "xwayland-keyboard-grab-unstable-v1-client-protocol.h" -struct axis_discrete_pending { - struct xorg_list l; - uint32_t axis; - int32_t discrete; -}; - struct sync_pending { struct xorg_list l; DeviceIntPtr pending_dev; @@ -473,6 +467,9 @@ if (surface == NULL) return; + if (!is_surface_from_xwl_window(surface)) + return; + xwl_seat->xwl_screen->serial = serial; xwl_seat->pointer_enter_serial = serial; @@ -611,6 +608,36 @@ } static void +dispatch_scroll_motion(struct xwl_seat *xwl_seat) +{ + ValuatorMask mask; + const int divisor = 10; + wl_fixed_t dy = xwl_seat->pending_pointer_event.scroll_dy; + wl_fixed_t dx = xwl_seat->pending_pointer_event.scroll_dx; + int32_t discrete_dy = xwl_seat->pending_pointer_event.scroll_discrete_dy; + int32_t discrete_dx = xwl_seat->pending_pointer_event.scroll_discrete_dx; + + valuator_mask_zero(&mask); + if (xwl_seat->pending_pointer_event.has_vertical_scroll) + valuator_mask_set_double(&mask, + 3, + wl_fixed_to_double(dy) / divisor); + else if (xwl_seat->pending_pointer_event.has_vertical_scroll_discrete) + valuator_mask_set(&mask, 3, discrete_dy); + + if (xwl_seat->pending_pointer_event.has_horizontal_scroll) + valuator_mask_set_double(&mask, + 2, + wl_fixed_to_double(dx) / divisor); + else if (xwl_seat->pending_pointer_event.has_horizontal_scroll_discrete) + valuator_mask_set(&mask, 2, discrete_dx); + + QueuePointerEvents(get_pointer_device(xwl_seat), + MotionNotify, 0, POINTER_RELATIVE, &mask); +} + + +static void dispatch_pointer_motion_event(struct xwl_seat *xwl_seat) { Bool has_relative = xwl_seat->pending_pointer_event.has_relative; @@ -626,8 +653,18 @@ dispatch_absolute_motion(xwl_seat); } + if (xwl_seat->pending_pointer_event.has_vertical_scroll || + xwl_seat->pending_pointer_event.has_horizontal_scroll || + xwl_seat->pending_pointer_event.has_vertical_scroll_discrete || + xwl_seat->pending_pointer_event.has_horizontal_scroll_discrete) + dispatch_scroll_motion(xwl_seat); + xwl_seat->pending_pointer_event.has_absolute = FALSE; xwl_seat->pending_pointer_event.has_relative = FALSE; + xwl_seat->pending_pointer_event.has_vertical_scroll = FALSE; + xwl_seat->pending_pointer_event.has_horizontal_scroll = FALSE; + xwl_seat->pending_pointer_event.has_vertical_scroll_discrete = FALSE; + xwl_seat->pending_pointer_event.has_horizontal_scroll_discrete = FALSE; } static void @@ -684,42 +721,17 @@ uint32_t time, uint32_t axis, wl_fixed_t value) { struct xwl_seat *xwl_seat = data; - int index; - const int divisor = 10; - ValuatorMask mask; - struct axis_discrete_pending *pending = NULL; - struct axis_discrete_pending *iter; switch (axis) { case WL_POINTER_AXIS_VERTICAL_SCROLL: - index = 3; + xwl_seat->pending_pointer_event.has_vertical_scroll = TRUE; + xwl_seat->pending_pointer_event.scroll_dy = value; break; case WL_POINTER_AXIS_HORIZONTAL_SCROLL: - index = 2; + xwl_seat->pending_pointer_event.has_horizontal_scroll = TRUE; + xwl_seat->pending_pointer_event.scroll_dx = value; break; - default: - return; - } - - xorg_list_for_each_entry(iter, &xwl_seat->axis_discrete_pending, l) { - if (iter->axis == axis) { - pending = iter; - break; - } - } - - valuator_mask_zero(&mask); - - if (pending) { - valuator_mask_set(&mask, index, pending->discrete); - xorg_list_del(&pending->l); - free(pending); - } else { - valuator_mask_set_double(&mask, index, wl_fixed_to_double(value) / divisor); } - - QueuePointerEvents(get_pointer_device(xwl_seat), - MotionNotify, 0, POINTER_RELATIVE, &mask); } static void @@ -742,6 +754,18 @@ pointer_handle_axis_stop(void *data, struct wl_pointer *wl_pointer, uint32_t time, uint32_t axis) { + struct xwl_seat *xwl_seat = data; + + switch (axis) { + case WL_POINTER_AXIS_VERTICAL_SCROLL: + xwl_seat->pending_pointer_event.has_vertical_scroll = TRUE; + xwl_seat->pending_pointer_event.scroll_dy = 0; + break; + case WL_POINTER_AXIS_HORIZONTAL_SCROLL: + xwl_seat->pending_pointer_event.has_horizontal_scroll = TRUE; + xwl_seat->pending_pointer_event.scroll_dx = 0; + break; + } } static void @@ -750,14 +774,16 @@ { struct xwl_seat *xwl_seat = data; - struct axis_discrete_pending *pending = malloc(sizeof *pending); - if (!pending) - return; - - pending->axis = axis; - pending->discrete = discrete; - - xorg_list_add(&pending->l, &xwl_seat->axis_discrete_pending); + switch (axis) { + case WL_POINTER_AXIS_VERTICAL_SCROLL: + xwl_seat->pending_pointer_event.has_vertical_scroll_discrete = TRUE; + xwl_seat->pending_pointer_event.scroll_discrete_dy = discrete; + break; + case WL_POINTER_AXIS_HORIZONTAL_SCROLL: + xwl_seat->pending_pointer_event.has_horizontal_scroll_discrete = TRUE; + xwl_seat->pending_pointer_event.scroll_discrete_dx = discrete; + break; + } } static const struct wl_pointer_listener pointer_listener = { @@ -811,6 +837,9 @@ { struct xwl_seat *xwl_seat = data; + if (surface != NULL && !is_surface_from_xwl_window(surface)) + return; + xwl_seat->pointer_gesture_swipe_fingers = fingers; QueueGestureSwipeEvents(xwl_seat->pointer_gestures, XI_GestureSwipeBegin, fingers, 0, 0.0, 0.0, 0.0, 0.0); @@ -870,6 +899,9 @@ { struct xwl_seat *xwl_seat = data; + if (surface != NULL && !is_surface_from_xwl_window(surface)) + return; + xwl_seat->pointer_gesture_pinch_fingers = fingers; xwl_seat->pointer_gesture_pinch_last_scale = 1.0; QueueGesturePinchEvents(xwl_seat->pointer_gestures, @@ -1003,6 +1035,9 @@ struct xwl_seat *xwl_seat = data; uint32_t *k; + if (surface != NULL && !is_surface_from_xwl_window(surface)) + return; + xwl_seat->xwl_screen->serial = serial; xwl_seat->keyboard_focus = surface; @@ -1018,6 +1053,9 @@ struct xwl_seat *xwl_seat = data; uint32_t *k; + if (surface != NULL && !is_surface_from_xwl_window(surface)) + return; + xwl_seat->xwl_screen->serial = serial; wl_array_for_each(k, &xwl_seat->keys) @@ -1218,6 +1256,9 @@ if (surface == NULL) return; + if (!is_surface_from_xwl_window(surface)) + return; + xwl_touch = calloc(1, sizeof *xwl_touch); if (xwl_touch == NULL) { ErrorF("%s: ENOMEM\n", __func__); @@ -1718,7 +1759,6 @@ wl_array_init(&xwl_seat->keys); xorg_list_init(&xwl_seat->touches); - xorg_list_init(&xwl_seat->axis_discrete_pending); xorg_list_init(&xwl_seat->sync_pending); } @@ -1727,7 +1767,6 @@ { struct xwl_touch *xwl_touch, *next_xwl_touch; struct sync_pending *p, *npd; - struct axis_discrete_pending *ad, *ad_next; xorg_list_for_each_entry_safe(xwl_touch, next_xwl_touch, &xwl_seat->touches, link_touch) { @@ -1740,11 +1779,6 @@ free (p); } - xorg_list_for_each_entry_safe(ad, ad_next, &xwl_seat->axis_discrete_pending, l) { - xorg_list_del(&ad->l); - free(ad); - } - release_tablet_manager_seat(xwl_seat); release_grab(xwl_seat); @@ -1901,6 +1935,9 @@ if (wl_surface == NULL) return; + if (!is_surface_from_xwl_window(wl_surface)) + return; + xwl_tablet_tool->proximity_in_serial = serial; xwl_seat->tablet_focus_window = wl_surface_get_user_data(wl_surface); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-22.1.3/hw/xwayland/xwayland-input.h new/xwayland-22.1.4/hw/xwayland/xwayland-input.h --- old/xwayland-22.1.3/hw/xwayland/xwayland-input.h 2022-07-12 15:48:31.000000000 +0200 +++ new/xwayland-22.1.4/hw/xwayland/xwayland-input.h 2022-10-20 09:24:51.000000000 +0200 @@ -93,7 +93,6 @@ char *keymap; struct wl_surface *keyboard_focus; - struct xorg_list axis_discrete_pending; struct xorg_list sync_pending; struct xwl_pointer_warp_emulator *pointer_warp_emulator; @@ -111,6 +110,15 @@ double dy; double dx_unaccel; double dy_unaccel; + + wl_fixed_t scroll_dy; + wl_fixed_t scroll_dx; + int32_t scroll_discrete_dy; + int32_t scroll_discrete_dx; + Bool has_vertical_scroll; + Bool has_horizontal_scroll; + Bool has_vertical_scroll_discrete; + Bool has_horizontal_scroll_discrete; } pending_pointer_event; struct xorg_list tablets; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-22.1.3/hw/xwayland/xwayland-screen.c new/xwayland-22.1.4/hw/xwayland/xwayland-screen.c --- old/xwayland-22.1.3/hw/xwayland/xwayland-screen.c 2022-07-12 15:48:31.000000000 +0200 +++ new/xwayland-22.1.4/hw/xwayland/xwayland-screen.c 2022-10-20 09:24:51.000000000 +0200 @@ -173,6 +173,7 @@ struct xwl_screen *xwl_screen = xwl_screen_get(screen); struct xwl_output *xwl_output, *next_xwl_output; struct xwl_seat *xwl_seat, *next_xwl_seat; + struct xwl_wl_surface *xwl_wl_surface, *xwl_wl_surface_next; DeleteCallback(&PropertyStateCallback, xwl_property_callback, screen); @@ -192,6 +193,10 @@ xwl_screen_destroy_drm_lease_device(xwl_screen, device_data->drm_lease_device); + xorg_list_for_each_entry_safe(xwl_wl_surface, xwl_wl_surface_next, + &xwl_screen->pending_wl_surface_destroy, link) + xwl_window_surface_do_destroy(xwl_wl_surface); + RemoveNotifyFd(xwl_screen->wayland_fd); wl_display_disconnect(xwl_screen->display); @@ -580,6 +585,53 @@ xwl_give_up("could not connect to wayland server\n"); } +static int +xwl_server_grab(ClientPtr client) +{ + struct xwl_screen *xwl_screen; + + /* Allow GrabServer for the X11 window manager. + * Xwayland only has 1 screen (no Zaphod for Xwayland) so we check + * for the first and only screen here. + */ + xwl_screen = xwl_screen_get(screenInfo.screens[0]); + if (xwl_screen->wm_client_id == client->index) + return xwl_screen->GrabServer(client); + + /* For all other clients, just pretend it works for compatibility, + but do nothing */ + return Success; +} + +static int +xwl_server_ungrab(ClientPtr client) +{ + struct xwl_screen *xwl_screen; + + /* Same as above, allow UngrabServer for the X11 window manager only */ + xwl_screen = xwl_screen_get(screenInfo.screens[0]); + if (xwl_screen->wm_client_id == client->index) + return xwl_screen->UngrabServer(client); + + /* For all other clients, just pretend it works for compatibility, + but do nothing */ + return Success; +} + +static void +xwl_screen_setup_custom_vector(struct xwl_screen *xwl_screen) +{ + /* Rootfull Xwayland does not need a custom ProcVector (yet?) */ + if (!xwl_screen->rootless) + return; + + xwl_screen->GrabServer = ProcVector[X_GrabServer]; + xwl_screen->UngrabServer = ProcVector[X_UngrabServer]; + + ProcVector[X_GrabServer] = xwl_server_grab; + ProcVector[X_UngrabServer] = xwl_server_ungrab; +} + Bool xwl_screen_init(ScreenPtr pScreen, int argc, char **argv) { @@ -664,6 +716,7 @@ xorg_list_init(&xwl_screen->drm_lease_devices); xorg_list_init(&xwl_screen->queued_drm_lease_devices); xorg_list_init(&xwl_screen->drm_leases); + xorg_list_init(&xwl_screen->pending_wl_surface_destroy); xwl_screen->depth = 24; if (!monitorResolution) @@ -791,6 +844,8 @@ AddCallback(&PropertyStateCallback, xwl_property_callback, pScreen); AddCallback(&RootWindowFinalizeCallback, xwl_root_window_finalized_callback, pScreen); + xwl_screen_setup_custom_vector(xwl_screen); + xwl_screen_roundtrip(xwl_screen); return ret; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-22.1.3/hw/xwayland/xwayland-screen.h new/xwayland-22.1.4/hw/xwayland/xwayland-screen.h --- old/xwayland-22.1.3/hw/xwayland/xwayland-screen.h 2022-07-12 15:48:31.000000000 +0200 +++ new/xwayland-22.1.4/hw/xwayland/xwayland-screen.h 2022-10-20 09:24:51.000000000 +0200 @@ -68,6 +68,9 @@ ResizeWindowProcPtr ResizeWindow; MoveWindowProcPtr MoveWindow; + int (*GrabServer) (ClientPtr client); + int (*UngrabServer) (ClientPtr client); + struct xorg_list output_list; struct xorg_list seat_list; struct xorg_list damage_window_list; @@ -91,6 +94,7 @@ struct xorg_list drm_lease_devices; struct xorg_list queued_drm_lease_devices; struct xorg_list drm_leases; + struct xorg_list pending_wl_surface_destroy; uint32_t serial; #define XWL_FORMAT_ARGB8888 (1 << 0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-22.1.3/hw/xwayland/xwayland-window.c new/xwayland-22.1.4/hw/xwayland/xwayland-window.c --- old/xwayland-22.1.3/hw/xwayland/xwayland-window.c 2022-07-12 15:48:31.000000000 +0200 +++ new/xwayland-22.1.4/hw/xwayland/xwayland-window.c 2022-10-20 09:24:51.000000000 +0200 @@ -46,8 +46,11 @@ #include "viewporter-client-protocol.h" #include "xdg-shell-client-protocol.h" +#define DELAYED_WL_SURFACE_DESTROY 1000 /* ms */ + static DevPrivateKeyRec xwl_window_private_key; static DevPrivateKeyRec xwl_damage_private_key; +static const char *xwl_surface_tag = "xwl-surface"; static void xwl_window_set_allow_commits(struct xwl_window *xwl_window, Bool allow, @@ -112,6 +115,24 @@ return NULL; } +static void +xwl_window_set_xwayland_tag(struct xwl_window *xwl_window) +{ + wl_proxy_set_tag((struct wl_proxy *)xwl_window->surface, &xwl_surface_tag); +} + +static void +xwl_window_clear_xwayland_tag(struct xwl_window *xwl_window) +{ + wl_proxy_set_tag((struct wl_proxy *)xwl_window->surface, NULL); +} + +Bool +is_surface_from_xwl_window(struct wl_surface *surface) +{ + return wl_proxy_get_tag((struct wl_proxy *) surface) == &xwl_surface_tag; +} + void xwl_window_update_property(struct xwl_window *xwl_window, PropertyStateRec *propstate) @@ -480,6 +501,7 @@ send_surface_id_event(xwl_window); wl_surface_set_user_data(xwl_window->surface, xwl_window); + xwl_window_set_xwayland_tag(xwl_window); compRedirectWindow(serverClient, window, CompositeRedirectManual); @@ -563,6 +585,62 @@ return ensure_surface_for_window(window); } +static void +xwl_surface_destroy_free_timer(struct xwl_wl_surface *xwl_wl_surface) +{ + if (xwl_wl_surface->wl_surface_destroy_timer) { + TimerFree(xwl_wl_surface->wl_surface_destroy_timer); + xwl_wl_surface->wl_surface_destroy_timer = NULL; + } +} + +void +xwl_window_surface_do_destroy(struct xwl_wl_surface *xwl_wl_surface) +{ + wl_surface_destroy(xwl_wl_surface->wl_surface); + xorg_list_del(&xwl_wl_surface->link); + xwl_surface_destroy_free_timer(xwl_wl_surface); + free(xwl_wl_surface); +} + +static CARD32 +xwl_surface_destroy_callback(OsTimerPtr timer, CARD32 now, void *arg) +{ + struct xwl_wl_surface *xwl_wl_surface = arg; + + xwl_window_surface_do_destroy(xwl_wl_surface); + + return 0; +} + +static void +release_wl_surface_for_window(struct xwl_window *xwl_window) +{ + struct xwl_wl_surface *xwl_wl_surface; + + /* If the Xserver is terminating, destroy the surface immediately */ + if ((dispatchException & DE_TERMINATE) == DE_TERMINATE) { + wl_surface_destroy(xwl_window->surface); + return; + } + + /* Break the wl_surface / xwl_window relationship */ + wl_surface_set_user_data(xwl_window->surface, NULL); + xwl_window_clear_xwayland_tag(xwl_window); + + /* Schedule the destruction later, to mitigate the race between X11 + * and Wayland processing so that the compositor has the time to + * establish the association before the wl_surface is destroyed. + */ + xwl_wl_surface = xnfcalloc(1, sizeof *xwl_wl_surface); + xwl_wl_surface->wl_surface = xwl_window->surface; + xorg_list_add(&xwl_wl_surface->link, + &xwl_window->xwl_screen->pending_wl_surface_destroy); + xwl_wl_surface->wl_surface_destroy_timer = + TimerSet(NULL, 0, DELAYED_WL_SURFACE_DESTROY, + xwl_surface_destroy_callback, xwl_wl_surface); +} + Bool xwl_unrealize_window(WindowPtr window) { @@ -617,7 +695,7 @@ } #endif - wl_surface_destroy(xwl_window->surface); + release_wl_surface_for_window(xwl_window); xorg_list_del(&xwl_window->link_damage); xorg_list_del(&xwl_window->link_window); unregister_damage(window); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-22.1.3/hw/xwayland/xwayland-window.h new/xwayland-22.1.4/hw/xwayland/xwayland-window.h --- old/xwayland-22.1.3/hw/xwayland/xwayland-window.h 2022-07-12 15:48:31.000000000 +0200 +++ new/xwayland-22.1.4/hw/xwayland/xwayland-window.h 2022-10-20 09:24:51.000000000 +0200 @@ -37,6 +37,12 @@ #include "xwayland-types.h" +struct xwl_wl_surface { + OsTimerPtr wl_surface_destroy_timer; + struct wl_surface *wl_surface; + struct xorg_list link; +}; + struct xwl_window { struct xwl_screen *xwl_screen; struct wl_surface *surface; @@ -60,6 +66,8 @@ struct xwl_window *xwl_window_get(WindowPtr window); struct xwl_window *xwl_window_from_window(WindowPtr window); +Bool is_surface_from_xwl_window(struct wl_surface *surface); + void xwl_window_update_property(struct xwl_window *xwl_window, PropertyStateRec *propstate); Bool xwl_window_has_viewport_enabled(struct xwl_window *xwl_window); @@ -81,6 +89,8 @@ Bool xwl_destroy_window(WindowPtr window); void xwl_window_post_damage(struct xwl_window *xwl_window); void xwl_window_create_frame_callback(struct xwl_window *xwl_window); +void xwl_window_surface_do_destroy(struct xwl_wl_surface *xwl_wl_surface); + Bool xwl_window_init(void); #endif /* XWAYLAND_WINDOW_H */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-22.1.3/meson.build new/xwayland-22.1.4/meson.build --- old/xwayland-22.1.3/meson.build 2022-07-12 15:48:31.000000000 +0200 +++ new/xwayland-22.1.4/meson.build 2022-10-20 09:24:51.000000000 +0200 @@ -3,7 +3,7 @@ 'buildtype=debugoptimized', 'c_std=gnu99', ], - version: '22.1.3', + version: '22.1.4', meson_version: '>= 0.47.0', ) release_date = '2021-07-05' @@ -63,7 +63,7 @@ libdrm_req = '>= 2.4.89' libselinux_req = '>= 2.0.86' xext_req = '>= 1.0.99.4' -wayland_req = '>= 1.5.0' +wayland_req = '>= 1.18.0' wayland_protocols_req = '>= 1.22' gbm_req = '>= 10.2' diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-22.1.3/xkb/xkb.c new/xwayland-22.1.4/xkb/xkb.c --- old/xwayland-22.1.3/xkb/xkb.c 2022-07-12 15:48:31.000000000 +0200 +++ new/xwayland-22.1.4/xkb/xkb.c 2022-10-20 09:24:51.000000000 +0200 @@ -5138,6 +5138,11 @@ CARD16 len; wire = *wire_inout; + + if (client->req_len < + bytes_to_int32(wire + 2 - (char *) client->requestBuffer)) + return BadValue; + len = *(CARD16 *) wire; if (client->swapped) { swaps(&len); @@ -5795,7 +5800,8 @@ }; static char * -GetComponentSpec(unsigned char **pWire, Bool allowExpr, int *errRtrn) +GetComponentSpec(ClientPtr client, xkbGetKbdByNameReq *stuff, + unsigned char **pWire, Bool allowExpr, int *errRtrn) { int len; register int i; @@ -5807,8 +5813,16 @@ legal = &componentSpecLegal[0]; wire = *pWire; + if (!_XkbCheckRequestBounds(client, stuff, wire, wire + 1)) { + *errRtrn = BadLength; + return NULL; + } len = (*(unsigned char *) wire++); if (len > 0) { + if (!_XkbCheckRequestBounds(client, stuff, wire, wire + len)) { + *errRtrn = BadLength; + return NULL; + } str = calloc(1, len + 1); if (str) { tmp = str; @@ -5862,6 +5876,8 @@ * length wrong. */ str = (unsigned char *) &stuff[1]; for (i = 0; i < 6; i++) { + if (!_XkbCheckRequestBounds(client, stuff, str, str + 1)) + return BadLength; size = *((uint8_t *)str); len = (str + size + 1) - ((unsigned char *) stuff); if ((XkbPaddedSize(len) / 4) > stuff->length) @@ -5936,18 +5952,32 @@ xkb = dev->key->xkbInfo->desc; status = Success; str = (unsigned char *) &stuff[1]; - if (GetComponentSpec(&str, TRUE, &status)) /* keymap, unsupported */ - return BadMatch; - names.keycodes = GetComponentSpec(&str, TRUE, &status); - names.types = GetComponentSpec(&str, TRUE, &status); - names.compat = GetComponentSpec(&str, TRUE, &status); - names.symbols = GetComponentSpec(&str, TRUE, &status); - names.geometry = GetComponentSpec(&str, TRUE, &status); - if (status != Success) + { + char *keymap = GetComponentSpec(client, stuff, &str, TRUE, &status); /* keymap, unsupported */ + if (keymap) { + free(keymap); + return BadMatch; + } + } + names.keycodes = GetComponentSpec(client, stuff, &str, TRUE, &status); + names.types = GetComponentSpec(client, stuff, &str, TRUE, &status); + names.compat = GetComponentSpec(client, stuff, &str, TRUE, &status); + names.symbols = GetComponentSpec(client, stuff, &str, TRUE, &status); + names.geometry = GetComponentSpec(client, stuff, &str, TRUE, &status); + if (status == Success) { + len = str - ((unsigned char *) stuff); + if ((XkbPaddedSize(len) / 4) != stuff->length) + status = BadLength; + } + + if (status != Success) { + free(names.keycodes); + free(names.types); + free(names.compat); + free(names.symbols); + free(names.geometry); return status; - len = str - ((unsigned char *) stuff); - if ((XkbPaddedSize(len) / 4) != stuff->length) - return BadLength; + } CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask); CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask);