Changeset 4b72e81 in mainline

Timestamp:

2021-06-09T11:56:03Z (3 years ago)

Author:

Jiri Svoboda <jiri@…>

Children:

1bebc906

Parents:

4055fe63

git-author:

Jiri Svoboda <jiri@…> (2021-06-08 17:55:50)

git-committer:

Jiri Svoboda <jiri@…> (2021-06-09 11:56:03)

Message:

Purge events from client event queue when destroying window

If the client had events queued for a particular window and that got
destroyed, later these events, pointing to freed (and reused) memory
would be handed to the client with the wrong window ID (which was
read from the wrong/recycled memory block).

Location:

uspace/srv/hid/display

Files:

• client.c (modified) (2 diffs)
• client.h (modified) (1 diff)
• test/client.c (modified) (1 diff)

uspace/srv/hid/display/client.c

@@ -119 +119 @@
         }
 
+        /* Make sure no event in the queue is referencing the window */
+        ds_client_purge_window_events(wnd->client, wnd);
+
         list_remove(&wnd->lcwindows);
         wnd->client = NULL;
@@ -199 +202 @@
 }
 
+/** Purge events from client event queue referring to a window.
+ *
+ * @param client Client
+ * @param window Window
+ */
+void ds_client_purge_window_events(ds_client_t *client,
+    ds_window_t *window)
+{
+        link_t *cur;
+        link_t *next;
+        ds_window_ev_t *wevent;
+
+        cur = list_first(&client->events);
+        while (cur != NULL) {
+                next = list_next(cur, &client->events);
+                wevent = list_get_instance(cur, ds_window_ev_t, levents);
+
+                if (wevent->window == window)
+                        list_remove(cur);
+
+                cur = next;
+        }
+}
+
 /** Post close event to the client's message queue.
  *

uspace/srv/hid/display/client.h

@@ -53 +53 @@
 extern errno_t ds_client_get_event(ds_client_t *, ds_window_t **,
     display_wnd_ev_t *);
+extern void ds_client_purge_window_events(ds_client_t *, ds_window_t *);
 extern errno_t ds_client_post_close_event(ds_client_t *, ds_window_t *);
 extern errno_t ds_client_post_focus_event(ds_client_t *, ds_window_t *);

uspace/srv/hid/display/test/client.c

@@ -553 +553 @@
 }
 
+/** Test ds_client_purge_window_events() */
+PCUT_TEST(client_purge_window_events)
+{
+        ds_display_t *disp;
+        ds_client_t *client;
+        ds_seat_t *seat;
+        ds_window_t *wnd;
+        display_wnd_params_t params;
+        ds_window_t *rwindow;
+        display_wnd_ev_t revent;
+        bool called_cb = NULL;
+        errno_t rc;
+
+        rc = ds_display_create(NULL, df_none, &disp);
+        PCUT_ASSERT_ERRNO_VAL(EOK, rc);
+
+        rc = ds_client_create(disp, &test_ds_client_cb, &called_cb, &client);
+        PCUT_ASSERT_ERRNO_VAL(EOK, rc);
+
+        rc = ds_seat_create(disp, &seat);
+        PCUT_ASSERT_ERRNO_VAL(EOK, rc);
+
+        display_wnd_params_init(&params);
+        params.rect.p0.x = params.rect.p0.y = 0;
+        params.rect.p1.x = params.rect.p1.y = 1;
+
+        rc = ds_window_create(client, &params, &wnd);
+        PCUT_ASSERT_ERRNO_VAL(EOK, rc);
+
+        /* New window gets focused event */
+        PCUT_ASSERT_TRUE(called_cb);
+
+        /* Purge it */
+        ds_client_purge_window_events(client, wnd);
+
+        /* The queue should be empty now */
+        rc = ds_client_get_event(client, &rwindow, &revent);
+        PCUT_ASSERT_ERRNO_VAL(ENOENT, rc);
+
+        ds_window_destroy(wnd);
+        ds_seat_destroy(seat);
+        ds_client_destroy(client);
+        ds_display_destroy(disp);
+}
+
 /** Test client being destroyed while still having a window.
  *