5 files changed, 31 insertions, 29 deletions

diff --git a/libxcb/src/xcb_conn.c b/libxcb/src/xcb_conn.c
index 3655725e2..72c4af7c2 100644
--- a/libxcb/src/xcb_conn.c
+++ b/libxcb/src/xcb_conn.c
@@ -237,13 +237,16 @@ static int write_vec(xcb_connection_t *c, struct iovec **vector, int *count)
 
 #if HAVE_SENDMSG
     if (c->out.out_fd.nfd) {
-        char cmsgbuf[CMSG_SPACE(sizeof(int) * XCB_MAX_PASS_FD)];
+        union {
+            struct cmsghdr cmsghdr;
+            char buf[CMSG_SPACE(XCB_MAX_PASS_FD * sizeof(int))];
+        } cmsgbuf;
         struct msghdr msg = {
             .msg_name = NULL,
             .msg_namelen = 0,
             .msg_iov = *vector,
             .msg_iovlen = n,
-            .msg_control = cmsgbuf,
+            .msg_control = cmsgbuf.buf,
             .msg_controllen = CMSG_LEN(c->out.out_fd.nfd * sizeof (int)),
         };
         int i;
diff --git a/libxcb/src/xcb_in.c b/libxcb/src/xcb_in.c
index b9b65d5ca..5506e3088 100644
--- a/libxcb/src/xcb_in.c
+++ b/libxcb/src/xcb_in.c
@@ -889,13 +889,16 @@ int _xcb_in_read(xcb_connection_t *c)
         .iov_base = c->in.queue + c->in.queue_len,
         .iov_len = sizeof(c->in.queue) - c->in.queue_len,
     };
-    char cmsgbuf[CMSG_SPACE(sizeof(int) * XCB_MAX_PASS_FD)];
+    union {
+        struct cmsghdr cmsghdr;
+        char buf[CMSG_SPACE(XCB_MAX_PASS_FD * sizeof(int))];
+    } cmsgbuf;
     struct msghdr msg = {
         .msg_name = NULL,
         .msg_namelen = 0,
         .msg_iov = &iov,
         .msg_iovlen = 1,
-        .msg_control = cmsgbuf,
+        .msg_control = cmsgbuf.buf,
         .msg_controllen = CMSG_SPACE(sizeof(int) * (XCB_MAX_PASS_FD - c->in.in_fd.nfd)),
     };
     n = recvmsg(c->fd, &msg, 0);
diff --git a/libxcb/src/xcb_out.c b/libxcb/src/xcb_out.c
index 3a1c3e59f..f11e2966f 100644
--- a/libxcb/src/xcb_out.c
+++ b/libxcb/src/xcb_out.c
@@ -87,24 +87,21 @@ static void send_sync(xcb_connection_t *c)
 
 static void get_socket_back(xcb_connection_t *c)
 {
-    while (c->out.return_socket) {
-        /* we are about to release the lock,
-           so make a copy of the current status */
-        xcb_return_socket_func_t return_socket = c->out.return_socket;
-        void *socket_closure = c->out.socket_closure;
-        int socket_seq = c->out.socket_seq;
-
-        pthread_mutex_unlock(&c->iolock);
-        return_socket(socket_closure);
-        pthread_mutex_lock(&c->iolock);
-
-        /* make sure nobody else has acquired the socket */
-        if (socket_seq == c->out.socket_seq) {
-            c->out.return_socket = 0;
-            c->out.socket_closure = 0;
-            _xcb_in_replies_done(c);
-        }
-    }
+    while(c->out.return_socket && c->out.socket_moving)
+        pthread_cond_wait(&c->out.socket_cond, &c->iolock);
+    if(!c->out.return_socket)
+        return;
+
+    c->out.socket_moving = 1;
+    pthread_mutex_unlock(&c->iolock);
+    c->out.return_socket(c->out.socket_closure);
+    pthread_mutex_lock(&c->iolock);
+    c->out.socket_moving = 0;
+
+    pthread_cond_broadcast(&c->out.socket_cond);
+    c->out.return_socket = 0;
+    c->out.socket_closure = 0;
+    _xcb_in_replies_done(c);
 }
 
 /* Public interface */
@@ -300,7 +297,6 @@ int xcb_take_socket(xcb_connection_t *c, void (*return_socket)(void *closure), v
     {
         c->out.return_socket = return_socket;
         c->out.socket_closure = closure;
-        ++c->out.socket_seq;
         if(flags)
             _xcb_in_expect_reply(c, c->out.request, WORKAROUND_EXTERNAL_SOCKET_OWNER, flags);
         assert(c->out.request == c->out.request_written);
@@ -337,9 +333,11 @@ int xcb_flush(xcb_connection_t *c)
 
 int _xcb_out_init(_xcb_out *out)
 {
+    if(pthread_cond_init(&out->socket_cond, 0))
+        return 0;
     out->return_socket = 0;
     out->socket_closure = 0;
-    out->socket_seq = 0;
+    out->socket_moving = 0;
 
     if(pthread_cond_init(&out->cond, 0))
         return 0;
diff --git a/libxcb/src/xcbext.h b/libxcb/src/xcbext.h
index 1eb1be77f..20ec1c37a 100644
--- a/libxcb/src/xcbext.h
+++ b/libxcb/src/xcbext.h
@@ -69,7 +69,6 @@ void xcb_send_fd(xcb_connection_t *c, int fd);
  * callback which XCB can call when it wants the write side of the
  * socket back to make a request. This callback synchronizes with the
  * external socket owner and flushes any output queues if appropriate.
- * The callback might be called from different threads at the same time.
  * If you are sending requests which won't cause a reply, please note the
  * comment for xcb_writev which explains some sequence number wrap issues.
  * */
diff --git a/libxcb/src/xcbint.h b/libxcb/src/xcbint.h
index 5c904fbb7..b25f03b3e 100644
--- a/libxcb/src/xcbint.h
+++ b/libxcb/src/xcbint.h
@@ -79,8 +79,6 @@ void *_xcb_map_remove(_xcb_map *q, unsigned int key);
 
 /* xcb_out.c */
 
-typedef void (*xcb_return_socket_func_t)(void *closure);
-
 #if HAVE_SENDMSG
 #define XCB_MAX_PASS_FD	16
 
@@ -95,9 +93,10 @@ typedef struct _xcb_out {
     pthread_cond_t cond;
     int writing;
 
-    xcb_return_socket_func_t return_socket;
+    pthread_cond_t socket_cond;
+    void (*return_socket)(void *closure);
     void *socket_closure;
-    unsigned int socket_seq;
+    int socket_moving;
 
     char queue[XCB_QUEUE_BUFFER_SIZE];
     int queue_len;