Mir

Some protobuf Closure objects can access dead objects

Bug #1433330 reported by Alberto Aguirre
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Mir
Fix Released
High
Alberto Aguirre
Mir 0.13.0
0.12
Fix Released
High
Alberto Aguirre
Mir 0.12.1
mir (Ubuntu)
Fix Released
High
Unassigned

Bug Description

ProtobufMessageProcessor::dispatch will create a protobuf closure object that references the ProtobufMessageProcessor "this" pointer.

The closure/callback object may be invoked by a different thread (e.g. SessionMediator::exchange_buffer). Since there's no protection there can be a race between dropping a connection (which destroys the ProtoBufMessageProcessor) and the callback being invoked by a compositor thread.

Related branches

lp://staging/~albaguirre/mir/fix-1433330
PS Jenkins bot (community): Approve (continuous-integration)
Kevin DuBois (community): Approve
Alexandros Frantzis (community): Approve
Alan Griffiths: Approve
Diff: 151 lines (+45/-18)
4 files modified
cmake/MirCommon.cmake (+0/-1)
src/server/frontend/protobuf_message_processor.cpp (+42/-15)
src/server/frontend/protobuf_message_processor.h (+2/-1)
tests/unit-tests/frontend/test_protobuf_message_processor.cpp (+1/-1)
lp://staging/mir/0.12
PS Jenkins bot (community): Needs Fixing (continuous-integration)
Mir development team: Pending requested
Diff: 2349 lines (+1697/-127)
23 files modified
3rd_party/android-input/android/frameworks/base/services/input/InputDispatcher.cpp (+36/-31)
cmake/MirCommon.cmake (+2/-0)
debian/changelog (+22/-0)
src/CMakeLists.txt (+1/-1)
src/platforms/android/server/hwc_blanking_control.cpp (+14/-1)
src/platforms/mesa/server/cursor.cpp (+31/-3)
src/server/frontend/protobuf_message_processor.cpp (+42/-15)
src/server/frontend/protobuf_message_processor.h (+2/-1)
src/server/frontend/protobuf_responder.cpp (+9/-5)
src/server/frontend/protobuf_responder.h (+2/-0)
src/server/frontend/session_mediator.cpp (+25/-26)
src/server/frontend/session_mediator.h (+2/-0)
src/server/frontend/surface_tracker.cpp (+8/-1)
src/server/frontend/surface_tracker.h (+6/-3)
src/server/graphics/software_cursor.cpp (+8/-20)
src/server/graphics/software_cursor.h (+1/-1)
tests/acceptance-tests/throwback/test_client_input.cpp (+3/-2)
tests/unit-tests/frontend/test_protobuf_message_processor.cpp (+1/-1)
tests/unit-tests/graphics/android/test_hwc_configuration.cpp (+28/-13)
tests/unit-tests/graphics/test_software_cursor.cpp (+20/-0)
tests/unit-tests/test_fatal.cpp (+3/-3)
tools/valgrind_suppressions_armhf (+27/-0)
tools/valgrind_suppressions_glibc_2.21 (+1404/-0)
lp://staging/ubuntu/vivid-proposed/mir
lp://staging/ubuntu/wily-proposed/mir
Alberto Aguirre (albaguirre)
Changed in mir:
importance: Undecided → High
milestone: none → 0.13.0
assignee: nobody → Alberto Aguirre (albaguirre)
status: New → In Progress
Revision history for this message
PS Jenkins bot (ps-jenkins) wrote :

Fix committed into lp:mir at revision None, scheduled for release in mir, milestone 0.13.0

Changed in mir:
status: In Progress → Fix Committed
Daniel van Vugt (vanvugt)
Changed in mir (Ubuntu):
status: New → Triaged
importance: Undecided → High
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package mir - 0.12.1+15.04.20150324-0ubuntu1

---------------
mir (0.12.1+15.04.20150324-0ubuntu1) vivid; urgency=medium

  [ Alexandros Frantzis ]
  * New upstream release 0.12.1 (https://launchpad.net/mir/+milestone/0.12.1)
    - Bug fixes:
      . [regression] mali, powervr locks up with around the introduction or
        removal of a third overlay (LP: #1413211)
      . USC - mouse cursor on AMD graphics is drawing incorrectly
        (LP: #1417581)
      . mir_demo_server doesn't emit hover_exit events (LP: #1418569)
      . SessionMediator locks mutexes in one thread and unlocks them in
        another (LP: #1427976)
      . ProtobufResponder::send_response_result race (LP: #1428402)
      . Some protobuf Closure objects can access dead objects (LP: #1433330)
      . DisplayConfigurationOutput.physical_size_mm is undefined/zero
        (LP: #1430315)
      . vivid fails to build Mir as of 2015-03-22: error: #warning
        "_BSD_SOURCE and _SVID_SOURCE are deprecated, use _DEFAULT_SOURCE"
        [-Werror=cpp] (LP: #1435127)
      . valgrind on armhf fails with with many errors (LP: #1435186)
 -- CI Train Bot <email address hidden> Tue, 24 Mar 2015 16:09:54 +0000

Changed in mir (Ubuntu):
status: Triaged → Fix Released
Alan Griffiths (alan-griffiths)
Changed in mir:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.