Fork us on GitHub Follow us on Facebook Follow us on Twitter

Changeset 4b72e81 in mainline


Ignore:
Timestamp:
2021-06-09T11:56:03Z (6 months ago)
Author:
Jiri Svoboda <jiri@…>
Children:
1bebc906
Parents:
4055fe63
git-author:
Jiri Svoboda <jiri@…> (2021-06-08 17:55:50)
git-committer:
Jiri Svoboda <jiri@…> (2021-06-09 11:56:03)
Message:

Purge events from client event queue when destroying window

If the client had events queued for a particular window and that got
destroyed, later these events, pointing to freed (and reused) memory
would be handed to the client with the wrong window ID (which was
read from the wrong/recycled memory block).

Location:
uspace/srv/hid/display
Files:
3 edited

Legend:

Unmodified
Added
Removed
  • uspace/srv/hid/display/client.c

    r4055fe63 r4b72e81  
    119119        }
    120120
     121        /* Make sure no event in the queue is referencing the window */
     122        ds_client_purge_window_events(wnd->client, wnd);
     123
    121124        list_remove(&wnd->lcwindows);
    122125        wnd->client = NULL;
     
    199202}
    200203
     204/** Purge events from client event queue referring to a window.
     205 *
     206 * @param client Client
     207 * @param window Window
     208 */
     209void ds_client_purge_window_events(ds_client_t *client,
     210    ds_window_t *window)
     211{
     212        link_t *cur;
     213        link_t *next;
     214        ds_window_ev_t *wevent;
     215
     216        cur = list_first(&client->events);
     217        while (cur != NULL) {
     218                next = list_next(cur, &client->events);
     219                wevent = list_get_instance(cur, ds_window_ev_t, levents);
     220
     221                if (wevent->window == window)
     222                        list_remove(cur);
     223
     224                cur = next;
     225        }
     226}
     227
    201228/** Post close event to the client's message queue.
    202229 *
  • uspace/srv/hid/display/client.h

    r4055fe63 r4b72e81  
    5353extern errno_t ds_client_get_event(ds_client_t *, ds_window_t **,
    5454    display_wnd_ev_t *);
     55extern void ds_client_purge_window_events(ds_client_t *, ds_window_t *);
    5556extern errno_t ds_client_post_close_event(ds_client_t *, ds_window_t *);
    5657extern errno_t ds_client_post_focus_event(ds_client_t *, ds_window_t *);
  • uspace/srv/hid/display/test/client.c

    r4055fe63 r4b72e81  
    553553}
    554554
     555/** Test ds_client_purge_window_events() */
     556PCUT_TEST(client_purge_window_events)
     557{
     558        ds_display_t *disp;
     559        ds_client_t *client;
     560        ds_seat_t *seat;
     561        ds_window_t *wnd;
     562        display_wnd_params_t params;
     563        ds_window_t *rwindow;
     564        display_wnd_ev_t revent;
     565        bool called_cb = NULL;
     566        errno_t rc;
     567
     568        rc = ds_display_create(NULL, df_none, &disp);
     569        PCUT_ASSERT_ERRNO_VAL(EOK, rc);
     570
     571        rc = ds_client_create(disp, &test_ds_client_cb, &called_cb, &client);
     572        PCUT_ASSERT_ERRNO_VAL(EOK, rc);
     573
     574        rc = ds_seat_create(disp, &seat);
     575        PCUT_ASSERT_ERRNO_VAL(EOK, rc);
     576
     577        display_wnd_params_init(&params);
     578        params.rect.p0.x = params.rect.p0.y = 0;
     579        params.rect.p1.x = params.rect.p1.y = 1;
     580
     581        rc = ds_window_create(client, &params, &wnd);
     582        PCUT_ASSERT_ERRNO_VAL(EOK, rc);
     583
     584        /* New window gets focused event */
     585        PCUT_ASSERT_TRUE(called_cb);
     586
     587        /* Purge it */
     588        ds_client_purge_window_events(client, wnd);
     589
     590        /* The queue should be empty now */
     591        rc = ds_client_get_event(client, &rwindow, &revent);
     592        PCUT_ASSERT_ERRNO_VAL(ENOENT, rc);
     593
     594        ds_window_destroy(wnd);
     595        ds_seat_destroy(seat);
     596        ds_client_destroy(client);
     597        ds_display_destroy(disp);
     598}
     599
    555600/** Test client being destroyed while still having a window.
    556601 *
Note: See TracChangeset for help on using the changeset viewer.