<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - weston/wayland: Invalid read/write with rdp-backend.so"
href="https://bugs.freedesktop.org/show_bug.cgi?id=66830#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW --- - weston/wayland: Invalid read/write with rdp-backend.so"
href="https://bugs.freedesktop.org/show_bug.cgi?id=66830">bug 66830</a>
from <span class="vcard"><a class="email" href="mailto:mceier+freedesktop@gmail.com" title="Mariusz Ceier <mceier+freedesktop@gmail.com>"> <span class="fn">Mariusz Ceier</span></a>
</span></b>
<pre>rdp_client_activity function in weston/src/compositor-rdp.c frees rdp peer
context and rdp peer, which in turn release weston structures e.g. wl_seat
the problem is these structures can still be in use e.g. in registry_bind in
wayland-server.c which calls bind_seat with zeroed or often garbage wl_seat.
it's easily reproduceable (at least for me, running under X) with rdesktop :
./weston -Brdp-backend.so
for x in `seq 0 100`; do rdesktop -b -4 127.0.0.1 & done ; killall rdesktop
below is example of contents of wl_seat structure passed to bind_seat:
{base_resource_list = {prev = 0x0, next = 0x0}, global = 0x0, pointer = 0x0,
keyboard = 0x0, touch = 0x0, output = 0x0,
destroy_signal = {listener_list = {prev = 0x0, next = 0x0}}, compositor =
0x0, link = {prev = 0x31, next = 0x74ef80},
modifier_state = (unknown: 8153568), saved_kbd_focus = 0x75ef7f,
saved_kbd_focus_listener = {link = {prev = 0x74ef80, next = 0x0},
notify = 0x6a1}, drag_resource_list = {prev = 0x0, next = 0x6599d0},
selection_serial = 0, selection_data_source = 0x0,
selection_data_source_listener = {link = {prev = 0x0, next = 0x0}, notify =
0x0}, selection_signal = {listener_list = {prev = 0x0,
next = 0x0}}, num_tp = 0, led_update = 0x0, xkb_info = {keymap = 0x0,
keymap_fd = 0, keymap_size = 0, keymap_area = 0x0,
shift_mod = 0, caps_mod = 0, ctrl_mod = 0, alt_mod = 0, mod2_mod = 0,
mod3_mod = 0, super_mod = 6658800, mod5_mod = 0,
num_led = 0, caps_led = 0, scroll_led = 0}, xkb_state = {state = 0x0, leds
= (unknown: 0)}, input_method = 0x0,
seat_name = 0x65b4a0 "\220>i"}
base_resource_list has NULL in prev and next, which should never happen, unless
we're just after calloc/memset or when we removed head of the list
(wl_list_remove(&seat->base_resource_list) somewhere).</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>