GNOME Bugzilla – Bug 759499
wayland: DOS if an application set up as loop in transients
Last modified: 2016-02-18 08:07:29 UTC
Created attachment 317430 [details] Reproducer programm to trigger the issue Summary: If a broken or naughty application set up its windows to create a loop in the transient relationship, mutter will hang, looping forever in meta_window_foreach_ancestor() Steps to reproduce: 1. Log in GNOME on Wayland session (haven't tried in X11) 2. Save and build the attached reproducer: $ gcc -o cycling-transient-mutter -g cycling-transient-mutter.c `pkg-config --libs --cflags gtk+-3.0` 3. Run the program ./cycling-transient-mutter Actual result: gnome-shell will become unresponsive and take 100% CPU Expected result: gnome-shell survives a broken application.
Created attachment 317431 [details] [review] window: check for possible loop in transients If a broken or naughty application tries set up its windows to create a loop in the transient relationship, mutter will hang, looping forever in meta_window_foreach_ancestor() To avoid this, set the transient_for first to walk up the tree and detect all possibilities of a loop induced by this new transient relationship and deny the change if such a loop is found.
Review of attachment 317431 [details] [review]: ::: src/core/window.c @@ +7397,3 @@ + + previous = window->transient_for; + window->transient_for = parent; This actually sets the field, which is done slightly different further below in meta_window_set_transient_for. I think a check_ function should not set any field anyway.
Created attachment 317477 [details] [review] Updated patch Right, we don;t even need to set the transient for anyway, much simpler/safer patch attached.
This might still be useful to land for 3.20. Can it get reviewed ?
Review of attachment 317477 [details] [review]: Looks good to me. I suppose in the future we should, at least for Wayland clients, terminate abusing clients.
Comment on attachment 317477 [details] [review] Updated patch attachment 317477 [details] [review] pushed as commit 4e82a75 window: check for possible loop in transients