Mitigate UAF crashes due to iteration over freed wl_resources

Currently it is possible to iterate over client-owned resources
during client destruction that have had their associated memory
released.

This can occur when client code calls wl_client_destroy(). The
following sequence illustrates how this may occur.

 1. The server initiates destruction of the connected client via
    call to wl_client_destroy().

 2. Resource destroy listeners / destructors are invoked and
    resource memory is freed one resource at a time [1].

 3. If a listener / destructor for a resource results in a call
    to wl_client_for_each_resource(), the iteration will proceed
    over resources that have been previously freed in step 2,
    resulting in UAFs / crashes.

The issue is that resources remain in the client's object map
even after they have had their memory freed, and are removed
from the map only after each individual resource has had its
memory released.

This patch corrects this by ensuring resource destruction first
invokes listeners / destructors and then removing them from the
client's object map before releasing the associated memory.

[1] https://gitlab.freedesktop.org/wayland/wayland/-/blob/main/src/wayland-server.c?ref_type=heads#L928

Signed-off-by: Thomas Lukaszewicz thomaslukaszewicz@gmail.com

1 files changed, 57 insertions, 0 deletions

diff --git a/tests/resources-test.c b/tests/resources-test.c
index fa6ba2b..9270729 100644
--- a/tests/resources-test.c
+++ b/tests/resources-test.c
@@ -206,3 +206,60 @@ TEST(free_without_remove)
 	assert(a.link.next == a.link.prev && a.link.next == NULL);
 	assert(b.link.next == b.link.prev && b.link.next == NULL);
 }
+
+static enum wl_iterator_result
+client_resource_check(struct wl_resource* resource, void* data)
+{
+	/* Ensure there is no iteration over already freed resources. */
+	assert(!wl_resource_get_user_data(resource));
+	return WL_ITERATOR_CONTINUE;
+}
+
+static void
+resource_destroy_notify(struct wl_listener *l, void *data)
+{
+	struct wl_resource* resource = data;
+	struct wl_client* client = resource->client;
+
+	wl_client_for_each_resource(client, client_resource_check, NULL);
+
+	/* Set user data to flag the resource has been deleted. The resource should
+	 * not be accessible from this point forward. */
+	wl_resource_set_user_data(resource, client);
+}
+
+TEST(resource_destroy_iteration)
+{
+	struct wl_display *display;
+	struct wl_client *client;
+	struct wl_resource *resource1;
+	struct wl_resource *resource2;
+	int s[2];
+
+	struct wl_listener destroy_listener1 = {
+		.notify = &resource_destroy_notify
+	};
+	struct wl_listener destroy_listener2 = {
+		.notify = &resource_destroy_notify
+	};
+
+	assert(socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0, s) == 0);
+	display = wl_display_create();
+	assert(display);
+	client = wl_client_create(display, s[0]);
+	assert(client);
+	resource1 = wl_resource_create(client, &wl_callback_interface, 1, 0);
+	resource2 = wl_resource_create(client, &wl_callback_interface, 1, 0);
+	assert(resource1);
+	assert(resource2);
+
+	wl_resource_add_destroy_listener(resource1, &destroy_listener1);
+	wl_resource_add_destroy_listener(resource2, &destroy_listener2);
+
+	wl_client_destroy(client);
+
+	close(s[0]);
+	close(s[1]);
+
+	wl_display_destroy(display);
+}