glx: fix DrawableGone use-after-free without rejecting duplicate drawables

[kiyoshispreclerg]

This draft has another approach to fix #1491 while allowing duplicate GLX drawables for a window. Instead of rejecting their creation, we added a new function that frees exactly them, as the crash was happening in their teardown, not creation.

I'm no expert and can't guarantee this code is bulletproof, but in the only machine mine that can trigger the crash from #1491, the code in this PR makes not crash anymore, while still allowing clients broken by #3145 to keep working, even if they're working "wrongly" :)

This could fix #3284 and its duplicates.

Backport dashboard

Target branch	Backport PR	Status
release/25.2	#3333	🔄 Open
release/25.1	#3334	🔄 Open
release/25.0	#3335	🔄 Open

[r1w1s1]

PR #3329 Test Report

I built and installed PR #3329 at commit 743656ab5 and restarted Xorg.

Hardware and software:

• GPU: Intel Iris Xe Graphics, Tiger Lake GT2
• Kernel driver: i915
• CPU: Intel Core i7-1185G7
• Kernel: 7.1.4 x86_64
• Mesa renderer: Mesa Intel(R) Iris(R) Xe Graphics (TGL GT2)
• OpenGL: 4.6 Compatibility Profile
• Xorg display: :0

I compiled and ran the minimal reproducer linked from issue #1491:

cc -g -O0 -o minimal minimal.c -lX11 -lGL
./minimal

Result:

• Exit status: 0
• Xorg remained running
• No crash was observed

I also tested with software rendering:

LIBGL_ALWAYS_SOFTWARE=1 ./minimal

Result:

• Exit status: 0
• Xorg remained running
• No crash was observed

I could not reproduce the Xorg crash on this Intel Iris Xe system with either
hardware or software rendering.

This is not confirmation that the issue is fixed universally, but the
reproducer completed without crashing Xorg on this hardware with PR #3329.

[stefan11111]

A bit hacky, but lgtm. I can't test the patch yet, but it seems others did. If any further changes are made, don't forget to keep the revert commit clean for bisection purposes.

[metux]

@X11Libre/dev @kiyoshispreclerg shall this be backported ?

[metux]

🤖 Automated review — generated by Claude Code (ship: Yamato) on behalf of @metux. Not a human review.

Summary

Fixes a use-after-free in GLX DrawableGone() (issue #1491, also fixes #3284 and duplicates). The previous fix (#3145) rejected duplicate GLX drawables for a window, which some clients relied on. This PR reverts that approach and instead adds FreeResourceByTypeValue() — a new internal dix API that matches on id+type+value — so DrawableGone() frees the correct entry among several sharing the same id+type.

Backport assessment

Backport candidate (critical bugfix). This is a client-triggerable use-after-free (memory safety / crash). Likely applies to release/25.2, release/25.1, release/25.0. Applicability must be confirmed per branch — maintainer decides.

NVIDIA driver ABI

No ABI impact. The change adds one new _X_EXPORT symbol (FreeResourceByTypeValue) — adding exports does not break the NVIDIA blob (the blob never calls symbols it doesn't know about). No struct layouts or existing entry points are changed.

Verdict

Clean. Approve for master and recommend backport to all active release lines.

[stefan11111]

@metux @X11Libre/dev Why would clients be hitting this code path though?

Not that it matters for this patch. If clients do hit this, we can't break it.

As for the backports, I say we apply this where the broken commit was applied, and we leave things as-is (at least until this patch gets more testing) for the releases that don't contain the broken commit this series is reverting.

[kiyoshispreclerg]

I say we apply this where the broken commit was applied, and we leave things as-is

Only master had the broken commit now reverted, but I think backporting the other can be valid if the triggerable UAF can be exploited. Of course, wait for more testing is a very good idea.