RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 05:58:11 +00:00
Code Issues Activity Actions

Kernel: Make Process a Weakable class.

Browse source 
Use this to fix a use-after-free in ~GraphicsBitmap(). We'd hit this when
the WindowServer was doing a deferred destruction of a WSWindow whose
backing store referred to a now-reaped Process.
This commit is contained in:
Andreas Kling 2019-01-31 07:02:40 +01:00
parent fc0b63ca3c
commit 2dc9c86bad
3 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Kernel/Process.h
View file

@ -12,6 +12,7 @@
#include <AK/AKString.h> #include <AK/AKString.h>
#include <AK/Vector.h> #include <AK/Vector.h>
#include <AK/WeakPtr.h> #include <AK/WeakPtr.h>
#include <AK/Weakable.h>
#include <AK/Lock.h> #include <AK/Lock.h>
class FileDescriptor; class FileDescriptor;
@ -45,7 +46,7 @@ struct DisplayInfo {
byte* framebuffer; byte* framebuffer;
}; };
class Process : public InlineLinkedListNode<Process> { class Process : public InlineLinkedListNode<Process>, public Weakable<Process> {
friend class InlineLinkedListNode<Process>; friend class InlineLinkedListNode<Process>;
friend class WSWindowManager; // FIXME: Make a better API for allocate_region(). friend class WSWindowManager; // FIXME: Make a better API for allocate_region().
friend class GraphicsBitmap; // FIXME: Make a better API for allocate_region(). friend class GraphicsBitmap; // FIXME: Make a better API for allocate_region().

4
SharedGraphics/GraphicsBitmap.cpp
View file

@ -16,7 +16,7 @@ RetainPtr<GraphicsBitmap> GraphicsBitmap::create(Process& process, const Size& s
GraphicsBitmap::GraphicsBitmap(Process& process, const Size& size) GraphicsBitmap::GraphicsBitmap(Process& process, const Size& size)
: m_size(size) : m_size(size)
, m_pitch(size.width() * sizeof(RGBA32)) , m_pitch(size.width() * sizeof(RGBA32))
, m_client_process(&process) , m_client_process(process.makeWeakPtr())
{ {
InterruptDisabler disabler; InterruptDisabler disabler;
size_t size_in_bytes = size.width() * size.height() * sizeof(RGBA32); size_t size_in_bytes = size.width() * size.height() * sizeof(RGBA32);
@ -47,7 +47,7 @@ GraphicsBitmap::GraphicsBitmap(const Size& size, RGBA32* data)
GraphicsBitmap::~GraphicsBitmap() GraphicsBitmap::~GraphicsBitmap()
{ {
#ifdef KERNEL #ifdef KERNEL
if (m_client_region) if (m_client_region && m_client_process)
m_client_process->deallocate_region(*m_client_region); m_client_process->deallocate_region(*m_client_region);
if (m_server_region) if (m_server_region)
WSMessageLoop::the().server_process().deallocate_region(*m_server_region); WSMessageLoop::the().server_process().deallocate_region(*m_server_region);

2
SharedGraphics/GraphicsBitmap.h
View file

@ -43,7 +43,7 @@ private:
size_t m_pitch { 0 }; size_t m_pitch { 0 };
#ifdef KERNEL #ifdef KERNEL
Process* m_client_process { nullptr }; WeakPtr<Process> m_client_process;
Region* m_client_region { nullptr }; Region* m_client_region { nullptr };
Region* m_server_region { nullptr }; Region* m_server_region { nullptr };
#endif #endif