wayland/src, branch main

connection: Replace calloc() by zalloc()

2026-08-30T13:03:14Z

Signed-off-by: ¥IGA

client: Document thread safety concerns in `wl_display_connect()`

2026-08-27T15:50:20Z

I believe this wording is accurate. The thread safety risks here are real, if uncommon in practice (partly since `WAYLAND_SOCKET` isn't set in the context most clients are run), and is non-obvious, so at least documenting it seems appropriate. It's also left unstated that a bogus `WAYLAND_SOCKET` value could cause all sorts of weirdness if it tries to treat some other socket file descriptor as a Wayland socket. That should generally only happen if `WAYLAND_SOCKET` is set by buggy or malicious code though. Fixes https://gitlab.freedesktop.org/wayland/wayland/-/work_items/424. Signed-off-by: Ian Douglas Scott

meson: Use can_run_host_binaries to test if the build machine can execute

2026-08-17T15:40:57Z

Use of a cross file does not in itself indicate that we're unable to execute the built wayland-scanner. Switch to using meson.can_run_host_binaries(), which is the correct check for this. Reviewed-by: Simon Ser Signed-off-by: Jeremy Huddleston Sequoia

client: Use poll() as fallback when ppoll() is unavailable

2026-08-03T14:47:24Z

On platforms like darwin that lack ppoll(), fall back to poll() with a millisecond timeout. Since the ppoll() call uses a NULL signal mask, the behavior is equivalent. Signed-off-by: Jeremy Huddleston Sequoia

shm: Avoid unused variable warning !HAVE_MEMFD_CREATE case

2026-08-03T14:47:24Z

../src/wayland-shm.c:307:14: warning: unused variable 'statbuf' struct stat statbuf; ^ ../src/wayland-shm.c:308:6: warning: unused variable 'seals' int seals; ^ 2 warnings generated. Signed-off-by: Jeremy Huddleston Sequoia

os: Provide wl_os_socketpair_cloexec wrapper for systems without SOCK_CLOEXEC

2026-08-03T14:47:24Z

Reviewed-by: Jeremy Huddleston Sequoia Signed-off-by: Weijia Wang

os: Use fallback implementations when *_CLOEXEC are unavailable at build time

2026-08-03T14:47:24Z

On platforms without F_DUPFD_CLOEXEC, MSG_CMSG_CLOEXEC, or SOCK_CLOEXEC, we should skip past their usage and just use the fcntl() fallback. Signed-off-by: Jeremy Huddleston Sequoia

os: Key wl_os_socket_peercred() on LOCAL_PEERCRED, not FreeBSD

2026-08-03T14:47:24Z

The LOCAL_PEERCRED socket option and its struct xucred contract are not unique to FreeBSD; darwin provides them as well. Key the existing implementation off the socket option rather than the host OS so that those platforms stop tripping the "Don't know how to read ucred on this platform" #error. Platforms whose struct xucred carries no cr_pid member (eg: darwin) still report a pid of 0 here. This limitation can be addressed through the use of LOCAL_PEERPID (see !290 for more details). Signed-off-by: Jeremy Huddleston Sequoia

build: remove redundant Meson version conditionals

2026-07-20T05:24:49Z

Fixes warning with Meson 1.12: src/meson.build:221: WARNING: Conditional on version '>= 0.54.0' always evaluates to true Signed-off-by: Benjamin Gilbert

WAYLAND_DEBUG: produce comparable timestamp values

2026-07-09T09:00:51Z

The previous way to print timestamps would overflow and produce numbers that didn't match any other system. The format was also somewhat unintuitive because it was milliseconds with the microseconds as fraction, which is a rarely used format. Instead, use a simple HH:MM:SS.xxxxxx format that is hopefully intuitively understandable as the POSIX/ISO8601 time format followed by the microseconds. Signed-off-by: Benjamin Otte

server: add wl_display_remove_socket_fd()

2026-07-03T10:57:58Z

Undoes wl_display_add_socket_fd(). Useful for protocols such as: https://gitlab.freedesktop.org/wayland/wayland-protocols/-/merge_requests/68 Signed-off-by: Simon Ser

scanner: Remove now unused arg_count

2026-04-14T12:11:51Z

Signed-off-by: Hannes Schulze

scanner: Fix types emitted for new_id arguments

2026-04-14T12:11:51Z

Previously, wayland-scanner would only emit one NULL entry in the wl_message.types array for every argument, even though requests with new_id arguments without an interface type additionally take a string and a uint argument. Signed-off-by: Hannes Schulze

scanner: drop redundant exit() after fail()

2026-04-04T03:56:38Z

fail() already calls exit(), so the extra exit() is never reached. Remove it to avoid dead code. Signed-off-by: YaoBing Xiao

util: fix use-after-free in for_each_helper

2026-03-30T00:52:42Z

for_each_helper caches the entries->data pointer and array size before iterating. If a compositor calls wl_client_for_each_resource() and the provided callback triggers the creation of a new client object, the underlying wl_array may be reallocated via realloc(). When this happens, the cached start pointer becomes dangling. Subsequent iterations will read from the freed memory block, causing already-destroyed resources to be destroyed a second time (e.g., leading to a double-free crash in wl_list_remove()). Fix this by dynamically re-fetching entries->data and entries->size on every loop iteration, ensuring the iterator always accesses the valid live array. Signed-off-by: YaNing Lu

Send wl_registry.global_remove to global's offer list

2026-03-24T11:45:00Z

Since the globals track the registries that received global announcements, we can use that instead of going through all present registries and duplicate some filtering logic. Signed-off-by: Vlad Zahorodnii

Add wl_fixes.ack_global_remove()

2026-03-24T11:45:00Z

The wl_global_remove() function was introduce to help mitigate clients getting unintentionally disconnected if a global is added and removed in a short burst. The intended usage was: - the compositor calls wl_global_remove() - after a certain period of time, the compositor calls wl_global_destroy() Unfortunately, it did not fully fix the issue due to the way monotonic clock works on Linux. Specifically, it can tick even during sleep. This change adds a slightly better way to handle global removal. With the proposed changes, the clients need to signal to the compositor that they won't bind the global anymore. After all clients have acknowledged a wl_registry.global_remove, the compositor can finally destroy the global. Signed-off-by: Vlad Zahorodnii

server: improve wl_registry.bind error messages

2026-03-05T17:34:24Z

- Consistently use PRIu32 for global names (uint32_t) - Use expected/got instead of have/wanted (which were used differently anyway) Signed-off-by: Kirill Primak

server: don't disclose the existence of invisible globals

2026-03-05T17:34:24Z

Otherwise, a client iterate over a range of names binding with deliberately incorrect interfaces and receive error messages with expected interfaces regardless of global visibility. Signed-off-by: Kirill Primak

scanner: enforce frozen attribute

2026-03-05T12:00:35Z

Signed-off-by: Isaac Freund

server: improve version mismatch error message

2026-03-05T11:18:53Z

"1 < 2" is obviously true but not very useful information by itself. Provide a bit more context. Signed-off-by: Kirill Primak

util: assert alloc is consistent with data in wl_array_add()

2026-03-03T09:31:53Z

struct wl_array may be constructed by users manually from a foreign data pointer: uint32_t states[] = {1, 2, 3}; struct wl_array arr = { .data = states, .size = sizeof(states) / sizeof(states[0]), }; This is useful to avoid the need to allocate when sending Wayland messages. Users need to be careful not to use wl_array_add() on such arrays: the function will misbehave by leaving garbage at the start of the new buffer when reallocating. Add an assert to guard against wl_array_add() calls in this situation, to have a clear crash instead of undefined behavior. Signed-off-by: Simon Ser

client: fix crash when creating proxies with no queue

2026-03-01T01:03:37Z

Before, it worked if the client did set a queue on the proxy before any event was received. Now we have the "warning: queue xxx destroyed while proxies still attached", then a crash if one of the proxies is used to create a proxy. Fixes: 674145dc3f ("client: Track the proxies attached to a queue") Fixes: 0ba650202e ("client: Warn when a queue is destroyed with attached proxies") Signed-off-by: Loïc Yhuel

server: document protocol logger callback function

2026-01-03T14:16:50Z

This fixes a validation error in the documentation which are not fatal. The idea is the same as in 12ec67a ("server: document listener fields and a vfunc"), which seems to have missed the reference to the wl_protocol_logger_func_t from the note in wl_log_func_t. Signed-off-by: Sebastian Wick

server: document listener fields and a vfunc

2025-12-29T14:27:14Z

Adding these simple documentation comments allows us to have meaningful link targets in the generated API documentation. That will help getting rid of broken links which cause XML validation to fail. Signed-off-by: Pekka Paalanen

server: fix wl_signal_add Doxygen warning

2025-12-29T09:19:01Z

$ meson compile -C build -v xml-Server-doc INFO: autodetecting backend as ninja INFO: calculating backend command to run: /usr/bin/ninja -C /home/pq/git/wayland/build -v doc/doxygen/xml/Server/combine.xslt doc/doxygen/xml/Server/index.xml ninja: Entering directory `/home/pq/git/wayland/build' [1/1] /home/pq/git/wayland/doc/doxygen/gen-doxygen.py --builddir=doc/doxygen/xml/Server --section=Server --output-format=xml doc/doxygen/wayland.doxygen ../doc/doxygen/../../src/wayland-util.h ../doc/doxygen/../../src/event-loop.c ../doc/doxygen/../../src/wayland-server.c ../doc/doxygen/../../src/wayland-server.h ../doc/doxygen/../../src/wayland-server-core.h ../doc/doxygen/../../src/wayland-shm.c /home/pq/git/wayland/src/wayland-server-core.h:394: warning: explicit link request to 'wl_signal_add' could not be resolved I don't know why, but the "explicit link" mark-up fails, while the automatic link mark-up works. This warning disappears. Signed-off-by: Pekka Paalanen

build: Bump to meson version 0.64.0

2025-11-27T15:39:11Z

This version will be required in the next commit. Bumps the CI image to get the required version from the debian package instead of from pip. Removes the bindir builtin directory from pkgconfig.generate() which is deprecated since 0.62.0. It will be automatically included when referenced. Use `meson setup` everywhere instead of relying on deprecated automatic detection of the setup command. Signed-off-by: Sebastian Wick

client: add wl_display_dispatch_pending_single

2025-09-16T08:48:33Z

As well as wl_display_dispatch_queue_pending_single. The motivation is writing libwayland bindings for a dynamic language with exceptions/non-local returns. Since it is invalid for a wl_dispatcher_func_t callback provided to libwayland to not return, there is no way to prevent dispatching of further events in the case of an exception in the dynamic language event handler. Furthermore, since creating/destroying Wayland objects in an event handler affects the dispatching of subsequent events by libwayland, it is not possible to collect Wayland events in a queue outside libwayland and dispatch them one-by-one after wl_display_dispatch_pending() returns. Adding libwayland API to dispatch at most one pending event solves this problem cleanly. The bindings can have libwayland dispatch a single event, wait for wl_display_dispatch_pending_single() to return, run the dynamic language event handler (which may longjmp away), and continue the loop for as long as there are more events to dispatch. References: https://codeberg.org/ifreund/janet-wayland Signed-off-by: Isaac Freund

connection: Add a thread ID to WAYLAND_DEBUG output.

2025-09-15T13:45:53Z

If WAYLAND_DEBUG contains the token "thread_id", and gettid() is available, then include the current thread ID in the output from wl_closure_print. If multiple threads are sending requests, then those requests can get interleaved. That's usually fine, but for wl_surface requests and commits, that can cause problems ranging from incorrect behavior to protocol errors. Being able to see which requests are sent by different threads would make such problems much easier to diagnose. Signed-off-by: Kyle Brenneman

connection: Add a function to parse WAYLAND_DEBUG tokens

2025-09-15T13:45:53Z

Add a new function, wl_check_env_token, to scan for a token in a comma-separated string. Change wl_display_create in wayland-server.c and wl_display_connect_to_fd in wayland-client.c to use that instead of a simple substring search. This means that WAYLAND_DEBUG will accept a value like "client,server" but not "clientserver". But, this will make it easier to add other tokens without worrying about overlap between them. Signed-off-by: Kyle Brenneman

connection: Do not busy-loop if a message exceeds the buffer size

2025-06-21T11:29:04Z

If the length of a message exceeds the maximum length of the buffer, the buffer size will reach its maximum value and stay there forever, with no message ever being successfully processed. Since libwayland uses level-triggered epoll, this will cause the compositor to loop forever and consume CPU time. In libwayland 1.22 and below, there was an explicit check that caused messages exceeding 4096 bytes to result in an EOVERFLOW error, preventing the loop. However, this check was removed between d074d5290263 ("connection: Dynamically resize connection buffers"). To prevent this problem, always limit the size of messages to 4096 bytes. Since the default and minimum buffer size is 4096 bytes, this ensures that a single message will always fit in the buffer. It would be possible to allow larger messages if the buffer size was larger, but the maximum size of a message should not depend on the buffer size chosen by the compositor. Rejecting messages that exceed 4092 bytes seems to have the advantage of reserving 4 bits, not 3, in the size field for future use. However, message sizes in the range [0x0, 0x7] are invalid, so one can obtain a fourth bit by negating the meaning of bit 12 if bits 0 through 11 (inclusive) are 0. Allowing 4096-byte messages provides the far more important advantage that regressions compared to 1.22 are impossible and regressions compared to 1.23 are extremely unlikely. The only case where a regression is possible is: - The receiving side is using libwayland 1.23. - The sending side is either using libwayland 1.23 or is not using libwayland. - The sender sends a message exceeding 4096 bytes. - If the sender of the large message is the client, the server has increased the buffer size from the default value. This combination is considered extremely unlikely, as libwayland 1.22 and below would disconnect upon receiving such a large message. 4096-byte messages, however, have always worked, so there was no reason to avoid sending them. Fixes: d074d5290263 ("connection: Dynamically resize connection buffers"). Fixes: #494 Signed-off-by: Demi Marie Obenour

server: Document wl_display_add_socket_auto

2025-06-08T16:20:35Z

The exact sequence of names tried has de facto become part of the API. Signed-off-by: Manuel Stoeckl

client: fix conversion specifier in the discarded event log message

2025-06-01T11:56:34Z

Signed-off-by: Kirill Primak

debug: Colorize output for easier reading

2025-06-01T11:21:36Z

Signed-off-by: Caitlyn

connection: fix segfault in wl_closure_invoke()

2025-05-27T13:45:32Z

Signed-off-by: Caitlyn Stewart

Fix typos

2025-05-20T20:49:32Z

Typos found with codespell and during code audit. Signed-off-by: Tobias Stoeckmann

server: add wl_resource_get_interface()

2025-05-20T20:31:16Z

This is useful for the wayland bindings/scanner I'm working on for a dynamically typed language. Signed-off-by: Isaac Freund

client: add wl_proxy_get_interface()

2025-05-20T20:31:16Z

This is useful for the wayland bindings/scanner I'm working on for a dynamically typed language. Signed-off-by: Isaac Freund

shm: linkify function references in docs

2025-05-20T20:14:52Z

Parentheses make it so the generated HTML documentation contains links, which makes navigation easier. Signed-off-by: Simon Ser

shm: fix comment about wl_shm_buffer_begin_access() safety

2025-05-20T20:14:52Z

The paragraph later says that accessing different buffers is allowed. The function checks whether the same pool is accessed. Signed-off-by: Simon Ser

shm: Generate an error when shm access failed even without a resource

2025-05-20T19:50:22Z

Signed-off-by: Sebastian Wick

shm: Add wl_shm_buffer ref and unref functions

2025-05-20T19:50:22Z

Shared memory buffers are currently tied to the lifetime of their underlying wl_buffer resource. This becomes problematic when the client destroys the resource after committing new state which references the wl_buffer because a compositor might have to defer applying the commit. This commit adds methods to keep the wl_shm_buffer alive longer than the underlying resource. This implicitly also keeps the buffer pool alive and because the wl_shm_buffer uses offsets into the pool, it even works when the underlying storage gets remapped somewhere else, which can happen when the client resizes the pool. Signed-off-by: Sebastian Wick

shm: Remove refcount check which cannot be triggered

2025-05-20T19:50:09Z

If the pool refcount reaches zero, it is freed, so accessing its members is UB which ASan would catch. Also simplify check for negative refcounts. Signed-off-by: Sebastian Wick

shm: Linkify wl_shm_pool_unref in the ref_pool documentation

2025-05-20T19:30:56Z

Signed-off-by: Sebastian Wick

client: document get_listener behavior for dispatchers

2025-03-15T23:07:39Z

This seems to have been the case since 2013. This is useful for wrappers that need two pointers to identify proxies. One pointer (stored in the user data) pointing to a singleton object to identify that the proxy has a known structure. And one pointer (stored in the dispatcher data) pointing to per-proxy data. Signed-off-by: Julian Orth

scanner: use separate guards for validator functions

2025-02-23T22:38:15Z

Generated XXX_is_valid() functions for enums are guarded behind the same #define as the enum itself. This worked fine until recently, but since fbd7460737c9 ("scanner: add new enum-header mode") we're also generating enum-only headers. When including the enum-only header first, and then the server header, the validator functions are missing. Define a separate guard to fix this. Signed-off-by: Simon Ser

Forward declarate timespec struct

2025-02-06T10:18:17Z

The `timespec` struct is defined in `time.h` header but only if `_POSIX_C_SOURCE` is set or when using the C11 standard. Signed-off-by: Vlad Zahorodnii

Also use [[deprecated]] when compiling with at least C++14

2025-02-05T08:43:21Z

Signed-off-by: David Redondo

Make wayland-util.h -Wundef safe when compiled by a C++ compiler

2025-02-05T08:21:43Z

Fixes #522 Signed-off-by: David Redondo

build: Add -lm to pkg-config dependencies

2025-02-05T06:52:53Z

Now that wl_fixed_from_double() calls round() from a function declared in a header, our users need to explicitly pick that dependency up in order to avoid build errors. Signed-off-by: Daniel Stone Closes: wayland/weston#991

client: Add wl_display_dispatch_timeout

2025-02-04T14:09:51Z

A variant of wl_display_dispatch_queue_timeout for the default queue. Signed-off-by: Sebastian Wick

client: Add wl_display_dispatch_queue_timeout

2025-02-04T14:09:51Z

For dispatching messages on a queue with a timeout. This slightly changes the samantics of wl_display_dispatch. Previously it was possible for it to return even though there wasn't a single dispatched event. The function correctly returned 0 in this case but it is now used to indicate a timeout. Signed-off-by: Sebastian Wick

event-loop: Use timespec utils instead of hand-rolling our own

2025-02-04T14:09:51Z

Signed-off-by: Sebastian Wick

timespec: Implement saturating timespec substraction

2025-02-04T14:09:51Z

Signed-off-by: Sebastian Wick

timespec: Pull in timespec_after and timespec_add from mesa

2025-02-04T14:09:51Z

Signed-off-by: Sebastian Wick

timespec: Pull in timespec.h from weston

2025-02-04T14:09:51Z

Signed-off-by: Sebastian Wick

server: add const qualifier to function arguments where possible

2025-01-22T14:28:50Z

Makes it possible to e.g. `call wl_client_get_credentials` with a `const struct wl_client *` from a global filter callback. Signed-off-by: Sebastian Wick

util: reduce error of wl_fixed_from_double()

2025-01-09T00:58:32Z

when cast double to fixed pointer, there will be big error, eg 1919.9998 to 1919. Call round before cast to get nearest value 1920 of 1919.9998 Signed-off-by: Haihua Hu

connection: Fix wrong format string

2024-11-30T21:02:55Z

Prevents undefined behavior if there is not enough space in the buffer for a queued message. Signed-off-by: Demi Marie Obenour

connection: Avoid undefined pointer arithmetic

2024-11-30T00:19:45Z

Creating a pointer that is more than one element past the end of an array is undefined behavior, even if the pointer is not dereferenced. Avoid this undefined behavior by using `p >= end` instead of `p + 1 > end` and `SOMETHING > end - p` instead of `p + SOMETHING > end`. Signed-off-by: Demi Marie Obenour

connection: Reject strings containing NUL bytes

2024-08-18T17:08:56Z

libwayland cannot construct these messages as it uses strlen() to determine string lengths. libwayland is also guaranteed to misinterpret these messages, since message handlers only get a pointer and no length. Therefore, reject strings containing NUL bytes. Also remove a redundant check from the unmarshalling code. The zero-length case has already been checked for. Signed-off-by: Demi Marie Obenour

client: Log the object and methods when marshalling or sending fails

2024-08-12T19:49:14Z

The log that appears before a display_error can be captured as crash signature. Useful to know what it is. This is cherry-picked from chromium https://crrev.com/c/4697877 Signed-off-by: Fangzhou Ge

src: Finish assert() clean-up

2024-08-09T20:38:52Z

From cleanup commit 0cecde304: assert()s can be compiled away by #defining NDEBUG. Some build systems do this. Using wl_abort gives a human readable error message and it isn't compiled away. That commit missed one final assert, presumably due to missing it with grep because of a coding style issue. Fix that up, and remove inclusion of as appropriate. Signed-off-by: Derek Foreman

server: expose wl_resource_post_error_vargs()

2024-08-09T20:29:24Z

Signed-off-by: Kirill Primak

server: add wl_resource_post_error() docs

2024-08-09T20:29:24Z

Signed-off-by: Kirill Primak

Put WL_DEPRECATED in front of the function declarations

2024-08-09T20:25:11Z

This fixes the following clang error when using C23: ../src/wayland-server-core.h:680:41: error: 'deprecated' attribute cannot be applied to types 680 | int32_t stride, uint32_t format) WL_DEPRECATED; | ^ ../src/wayland-util.h:52:25: note: expanded from macro 'WL_DEPRECATED' 52 | #define WL_DEPRECATED [[deprecated]] | ^ Signed-off-by: Kirill Primak

client: Handle proxies with no queue

2024-07-26T16:33:28Z

wl_proxy_get_queue can return NULL if the queue of the proxy was already destroyed with wl_event_queue_destroy. In this case, the queue also has no name anymore. Fixes: b42218f ("client: Allow setting names for queues") Signed-off-by: Sebastian Wick

src: switch asserts to wl_abort

2024-07-11T17:44:04Z

assert()s can be compiled away by #defining NDEBUG. Some build systems do this. Using wl_abort gives a human readable error message and it isn't compiled away. This commit closes issue #230. Signed-off-by: meltq

scanner: fix validator for bitfields

2024-07-09T16:22:10Z

Bitfields are valid if the value only contains bits inside of the supported entries for the given version. Signed-off-by: Simon Ser

scanner: extract validator function emission to helper function

2024-07-09T16:22:10Z

This function will grow in the next commit. Signed-off-by: Simon Ser

server: document wl_display_add_socket_fd() ownership

2024-05-22T08:55:03Z

wl_socket_destroy() will close the socket. Signed-off-by: Simon Ser

server: Clarify fd ownership in wl_client_create()

2024-05-16T09:57:42Z

It's unclear whether one needs to call close() if wl_client_create() fails. Hopefully this change makes it more clear. Signed-off-by: Vlad Zahorodnii

client: print debug events that have no listener

2024-04-24T16:40:18Z

Currently WAYLAND_DEBUG text ignores events that have no listener. It can be helpful to know when you're receiving unhandled events, as you may have forgotten to add a listener, or adding a dispatch may have magically seemed to fix code that doesn't appear to be dispatching anything. Signed-off-by: Derek Foreman

client: fix invalid doc command for WL_MARSHAL_FLAG_DESTROY

2024-04-24T16:27:50Z

Fixes the following warning: src/wayland-client-core.h:125: warning: Found non-existing group 'wl_proxy' for the command '@ingroup', ignoring command "\memberof" cannot be used here because it only works on functions. The docs for "\memberof" say that "\relates" works in a similar way. While at it, use a "\" command instead of a "@" command for consistency with the rest of the file. Signed-off-by: Simon Ser

Add support for the deprecated-since XML attribute

2024-04-24T16:18:28Z

This marks a request, event or enum entry as deprecated since a given version. Note that it's not clear what it means if an entry is deprecated at some version, and the enum is used from some completely different interface than where it was defined. However, that's a more general issue with enums, see: https://gitlab.freedesktop.org/wayland/wayland/-/issues/435 Signed-off-by: Simon Ser References: https://gitlab.freedesktop.org/wayland/wayland/-/issues/89

scanner: add validators for enums

2024-04-23T09:17:02Z

Right now compositors need to manually check that enum values sent by the client are valid. In particular: - Check that the value sent by the client is not outside of the enum. - Check that the version of the enum entry is consistent with the object version. Automatically generate validator functions to perform these tasks. Signed-off-by: Simon Ser Closes: https://gitlab.freedesktop.org/wayland/wayland/-/issues/104

connection: Dynamically resize connection buffers

2024-04-08T14:05:32Z

When using fixed size connection buffers, if either the client or the server is sending requests faster than the other end can cope with, the connection buffers will fill up, eventually killing the connection. This can be a problem for example with Xwayland mapping a lot of windows, faster than the Wayland compositor can cope with, or a high-rate mouse flooding the Wayland client with pointer events. To avoid the issue, resize the connection buffers dynamically when they get full. Both data and fd buffers are resized on demand. The default max buffer size is controlled via the wl_display interface while each client's connection buffer size is adjustable for finer control. The purpose is to explicitly have larger connection buffers for specific clients such as Xwayland, or set a larger buffer size for the client with pointer focus to deal with a higher input events rate. v0: Manuel: Dynamically resize connection buffers - Both data and fd buffers are resized on demand. v1: Olivier 1. Add support for unbounded buffers on the client side and growable (yet limited) connection buffers on the server side. 2. Add the API to set the default maximum size and a limit for a given client. 3. Add tests for growable connection buffers and adjustable limits. v2: Additional fixes by John: 1. Fix the size calculation in ring_buffer_check_space() 2. Fix wl_connection_read() to return gracefully once it has read up to the max buffer size, rather than returning an error. 3. If wl_connection_flush() fails with EAGAIN but the transmit ring-buffer has space remaining (or can be expanded), wl_connection_queue() should store the message rather than returning an error. 4. When the receive ring-buffer is at capacity but more data is available to be read, wl_connection_read() should attempt to expand the ring-buffer in order to read the remaining data. v3: Thomas Lukaszewicz Add a test for unbounded buffers v4: Add a client API as well to force bounded buffers (unbounded by default (Olivier) v5: Simplify ring_buffer_ensure_space() (Sebastian) Co-authored-by: Olivier Fourdan Co-authored-by: John Lindgren Co-authored-by: Sebastian Wick Signed-off-by: Manuel Stoeckl Signed-off-by: Olivier Fourdan Signed-off-by: John Lindgren Signed-off-by: Sebastian Wick Closes: https://gitlab.freedesktop.org/wayland/wayland/-/issues/237

util: convert macros to inline functions

2024-03-28T16:56:34Z

Functionally equivalent except the usual macro footguns are avoided and type safety is increased. Signed-off-by: Simon Ser

scanner: add new enum-header mode

2024-03-28T13:21:28Z

This generates a header with only enum definitions. This is useful to share enum headers between libraries and library users. Signed-off-by: Simon Ser

util: fix undefined behavior in wl_array_for_each

2024-03-25T00:00:01Z

If a wl_array has size zero, wl_array_for_each computes NULL + 0 to get to the end pointer. This should be fine, and indeed it would be fine in C++. But the C specification has a mistake here and it is actually undefined behavior. See https://davidben.net/2024/01/15/empty-slices.html Clang's -fsanitize=undefined flags this. I ran into this in Chromium's build with wayland-scanner on one of our XML files. ../../third_party/wayland/src/src/scanner.c:1853:2: runtime error: applying zero offset to null pointer #0 0x55c979b8e02c in emit_code third_party/wayland/src/src/scanner.c:1853:2 #1 0x55c979b89323 in main third_party/wayland/src/src/scanner.c #2 0x7f8dfdb8c6c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #3 0x7f8dfdb8c784 in __libc_start_main csu/../csu/libc-start.c:360:3 #4 0x55c979b70f39 in _start (...) An empty XML file is sufficient to hit this case, so I've added it as a test. To reproduce, undo the fix and include only the test, then build with: CC=clang CFLAGS="-fno-sanitize-recover=undefined" meson build/ -Db_sanitize=undefined -Db_lundef=false ninja -C build test Signed-off-by: David Benjamin

connection: use enum wl_arg_type in wl_message_count_arrays()

2024-03-06T18:09:35Z

Missed it in 155dd63b58b8 ("Introduce enum wl_arg_type"). Signed-off-by: Simon Ser

client: simplify create_proxies() loop

2024-03-06T13:18:37Z

Decrease the indentation a bit. No functional change. Signed-off-by: Simon Ser

client: simplify create_outgoing_proxy() loop

2024-03-06T13:18:18Z

Decrease the indentation a bit. No functional change. Signed-off-by: Simon Ser

connection: simplify wl_closure_lookup_objects() loop

2024-03-06T13:18:18Z

Decrease the indentation a bit. No functional change. Signed-off-by: Simon Ser

Introduce enum wl_arg_type

2024-03-06T13:17:48Z

This is less cryptic to read than letters, and allows the compiler to check switch statements exhaustiveness. Signed-off-by: Simon Ser

Mitigate UAF crashes due to wl_client_destroy reentrancy

2024-02-23T00:40:32Z

There are situations in which a call into wl_client_destroy() can result in a reentrant call into wl_client_destroy() - which results in UAF / double free crashes. For example, this can occur in the following scenario. 1. Server receives a message notifying it that a client has disconnected (WL_EVENT_HANGUP [1]) 2. This beings client destruction with a call to wl_client_destroy() 3. wl_client_destroy() kicks off callbacks as client-associated resources are cleaned up and their destructors and destruction signals are invoked. 4. These callbacks eventually lead to an explicit call to wl_display_flush_clients() as the server attempts to flush events to other connected clients. 5. Since the client has already begun destruction, when it is reached in the iteration the flush fails wl_client_destroy() is called again [2]. This patch guards against this reentrant condition by removing the client from the display's client list when wl_client_destroy() is first called. This prevents access / iteration over the client after wl_client_destroy() is called. In the example above, wl_display_flush_clients() will pass over the client currently undergoing destruction and the reentrant call is avoided. [1] https://gitlab.freedesktop.org/wayland/wayland/-/blob/8f499bf4045f88f3a4b4b0a445befca467bebe20/src/wayland-server.c#L342 [2] https://gitlab.freedesktop.org/wayland/wayland/-/blob/8f499bf4045f88f3a4b4b0a445befca467bebe20/src/wayland-server.c#L1512 Signed-off-by: Thomas Lukaszewicz [thomaslukaszewicz@gmail.com](mailto:thomaslukaszewicz@gmail.com)

build: fix build and provide compat for OpenBSD

2024-02-21T15:46:41Z

- wayland-egl-abi-check: try to use llvm-nm first instead of BSD nm (incompatible options) - avoid forcing _POSIX_C_SOURCE=200809L (SOCK_CLOEXEC become available) - epoll(7) is provided by a userspace wrapper around kqueue(2) as FreeBSD - when using SO_PEERCRED, the struct to use is `struct sockpeercred` instead of `struct ucred` on OpenBSD - provide a compatibility layer for count_open_fds() using sysctl(2) as FreeBSD Signed-off-by: Sebastien Marie

server: add wl_client_get_user_data/wl_client_set_user_data

2024-02-15T10:53:21Z

The only way to attach some data to a wl_client seems to be setting up a destroy listener and use wl_container_of. Let's make it straight forward to attach some data. Having an explicit destroy callback for the user data makes managing the user data lifetime much more convenient. All other callbacks, be they wl_resource request listeners, destroy listeners or destructors, or wl_client destroy listeners, can assume that the wl_client user data still exists if it was set. Otherwise making that guarantee would be complicated. Co-authored-by: Pekka Paalanen Signed-off-by: Sebastian Wick

event-loop: use wl_priv_signal for the destroy signal

2024-02-08T17:18:28Z

Signed-off-by: Kirill Primak

Mitigate UAF crashes due to iteration over freed wl_resources

2024-02-07T09:45:41Z

Currently it is possible to iterate over client-owned resources during client destruction that have had their associated memory released. This can occur when client code calls wl_client_destroy(). The following sequence illustrates how this may occur. 1. The server initiates destruction of the connected client via call to wl_client_destroy(). 2. Resource destroy listeners / destructors are invoked and resource memory is freed one resource at a time [1]. 3. If a listener / destructor for a resource results in a call to wl_client_for_each_resource(), the iteration will proceed over resources that have been previously freed in step 2, resulting in UAFs / crashes. The issue is that resources remain in the client's object map even after they have had their memory freed, and are removed from the map only after each individual resource has had its memory released. This patch corrects this by ensuring resource destruction first invokes listeners / destructors and then removing them from the client's object map before releasing the associated memory. [1] https://gitlab.freedesktop.org/wayland/wayland/-/blob/main/src/wayland-server.c?ref_type=heads#L928 Signed-off-by: Thomas Lukaszewicz thomaslukaszewicz@gmail.com

client: Allow setting names for queues

2024-01-22T12:34:14Z

Allow setting a name for an event queue. The queue is used only for printing additional debug information. Debug output can now show the name of the event queue an event is dispatched from, or the event queue of a proxy when a request is made. Signed-off-by: Derek Foreman

connection: Spruce up logging for client errors.

2024-01-19T15:51:33Z

Some code paths that lead to a client error and connection termination have no associated logging, or insufficient logging. This makes it difficult to understand what went wrong. This commit adds or supplements logging for all these code paths. Signed-off-by: Erik Chen

connection: Small simplification to wl_connection_write()

2024-01-19T15:25:54Z

wl_connection_write() contained an exact copy of the logic in wl_connection_queue(). Simplify things by just calling wl_connection_queue() from wl_connection_write(). Signed-off-by: John Lindgren

Consider pkgconfig sysroot for pkgdatadir

2024-01-19T15:18:23Z

For libs/cflags this is done automatically, but not for manually accessed variables. This matches what wayland-protocols does. Signed-off-by: Andreas Cord-Landwehr

shm: implement version 2

2024-01-19T15:12:29Z

This version adds a release request. Signed-off-by: Simon Ser

shm: fix resource versions

2024-01-19T15:12:29Z

This was hardcoded to 1 regardless of the version passed to the callback or the version of the parent resource. Signed-off-by: Simon Ser

util: use C23 deprecated attribute

2024-01-19T14:21:59Z

Signed-off-by: Simon Ser

util: use C23 typeof if available

2024-01-19T14:21:59Z

Instead of using the non-standard __typeof__, prefer the standard typeof operator introduced in C23. Signed-off-by: Simon Ser

util: simplify wl_fixed_from_double()

2023-11-21T15:47:13Z

Same as 0e0ae7e290f2 ("util: simplify wl_fixed_to_double()"), but for the reverse function. Signed-off-by: Simon Ser

connection: avoid calling memcpy on NULL, 0

2023-11-08T13:41:16Z

Due to what is arguably a mistake in the C language specification, passing NULL to memcpy and friends is undefined behavior (UB) even when the count is 0. C additionally mistakenly leaves NULL + 0 and NULL - NULL undefined. (C++ fixes this mistake.) These are very problematic because (NULL, 0) is a natural representation of the empty slice. Some details: https://github.com/llvm/llvm-project/issues/49459 https://www.imperialviolet.org/2016/06/26/nonnull.html Unfortunately, despite how clearly this is a mistake, glibc headers and GCC now try to exploit this specification mistake and will miscompile code, so C projects need to workaround this. In particular, UBSan from Clang will flag this as a bug (although Clang itself has the good sense to never lean on this bug). We've run into a few UBSan errors in Chromium stemming from Wayland's memcpy calls. Add runtime guards as needed to avoid these cases. Note: Chromium's copy of wayland has https://gitlab.freedesktop.org/wayland/wayland/-/merge_requests/188 applied. It is possible the ring_buffer_copy UB cases are only reachable with that MR applied, I'm not sure. But it seemed simplest to just add the fix to wayland as-is. Then when/if that MR lands, it will pick this up. Signed-off-by: David Benjamin