2 files changed, 69 insertions, 4 deletions

diff --git a/xorg-server/Xext/shm.c b/xorg-server/Xext/shm.c
index 0bf27f4c6..c9d39b22e 100644
--- a/xorg-server/Xext/shm.c
+++ b/xorg-server/Xext/shm.c
@@ -401,7 +401,7 @@ ProcShmAttach(ClientPtr client)
         return BadValue;
     }
     for (shmdesc = Shmsegs; shmdesc; shmdesc = shmdesc->next) {
-        if (!shmdesc->is_fd && shmdesc->shmid == stuff->shmid)
+        if (!SHMDESC_IS_FD(shmdesc) && shmdesc->shmid == stuff->shmid)
             break;
     }
     if (shmdesc) {
@@ -413,7 +413,9 @@ ProcShmAttach(ClientPtr client)
         shmdesc = malloc(sizeof(ShmDescRec));
         if (!shmdesc)
             return BadAlloc;
+#ifdef SHM_FD_PASSING
         shmdesc->is_fd = FALSE;
+#endif
         shmdesc->addr = shmat(stuff->shmid, 0,
                               stuff->readOnly ? SHM_RDONLY : 0);
         if ((shmdesc->addr == ((char *) -1)) || SHMSTAT(stuff->shmid, &buf)) {
@@ -453,9 +455,13 @@ ShmDetachSegment(pointer value, /* must conform to DeleteType */
     if (--shmdesc->refcnt)
         return TRUE;
 #ifndef _MSC_VER
-    if (shmdesc->is_fd)
+#if SHM_FD_PASSING
+    if (shmdesc->is_fd) {
+        if (shmdesc->busfault)
+            busfault_unregister(shmdesc->busfault);
         munmap(shmdesc->addr, shmdesc->size);
-    else
+    } else
+#endif
         shmdt(shmdesc->addr);
 #endif
     for (prev = &Shmsegs; *prev != shmdesc; prev = &(*prev)->next);
@@ -1113,6 +1119,20 @@ ProcShmCreatePixmap(ClientPtr client)
     return BadAlloc;
 }
 
+#ifdef SHM_FD_PASSING
+
+static void
+ShmBusfaultNotify(void *context)
+{
+    ShmDescPtr shmdesc = context;
+
+    ErrorF("shared memory 0x%x truncated by client\n",
+           (unsigned int) shmdesc->resource);
+    busfault_unregister(shmdesc->busfault);
+    shmdesc->busfault = NULL;
+    FreeResource (shmdesc->resource, RT_NONE);
+}
+
 static int
 ProcShmAttachFd(ClientPtr client)
 {
@@ -1157,6 +1177,15 @@ ProcShmAttachFd(ClientPtr client)
     shmdesc->refcnt = 1;
     shmdesc->writable = !stuff->readOnly;
     shmdesc->size = statb.st_size;
+    shmdesc->resource = stuff->shmseg;
+
+    shmdesc->busfault = busfault_register_mmap(shmdesc->addr, shmdesc->size, ShmBusfaultNotify, shmdesc);
+    if (!shmdesc->busfault) {
+        munmap(shmdesc->addr, shmdesc->size);
+        free(shmdesc);
+        return BadAlloc;
+    }
+
     shmdesc->next = Shmsegs;
     Shmsegs = shmdesc;
 
@@ -1212,6 +1241,15 @@ ProcShmCreateSegment(ClientPtr client)
     shmdesc->refcnt = 1;
     shmdesc->writable = !stuff->readOnly;
     shmdesc->size = stuff->size;
+
+    shmdesc->busfault = busfault_register_mmap(shmdesc->addr, shmdesc->size, ShmBusfaultNotify, shmdesc);
+    if (!shmdesc->busfault) {
+        close(fd);
+        munmap(shmdesc->addr, shmdesc->size);
+        free(shmdesc);
+        return BadAlloc;
+    }
+
     shmdesc->next = Shmsegs;
     Shmsegs = shmdesc;
 
@@ -1228,6 +1266,7 @@ ProcShmCreateSegment(ClientPtr client)
     WriteToClient(client, sizeof (xShmCreateSegmentReply), &rep);
     return Success;
 }
+#endif /* SHM_FD_PASSING */
 
 static int
 ProcShmDispatch(ClientPtr client)
@@ -1258,10 +1297,12 @@ ProcShmDispatch(ClientPtr client)
             return ProcPanoramiXShmCreatePixmap(client);
 #endif
         return ProcShmCreatePixmap(client);
+#ifdef SHM_FD_PASSING
     case X_ShmAttachFd:
         return ProcShmAttachFd(client);
     case X_ShmCreateSegment:
         return ProcShmCreateSegment(client);
+#endif
     default:
         return BadRequest;
     }
@@ -1362,6 +1403,7 @@ SProcShmCreatePixmap(ClientPtr client)
     return ProcShmCreatePixmap(client);
 }
 
+#ifdef SHM_FD_PASSING
 static int
 SProcShmAttachFd(ClientPtr client)
 {
@@ -1383,6 +1425,7 @@ SProcShmCreateSegment(ClientPtr client)
     swapl(&stuff->size);
     return ProcShmCreateSegment(client);
 }
+#endif  /* SHM_FD_PASSING */
 
 static int
 SProcShmDispatch(ClientPtr client)
@@ -1401,10 +1444,12 @@ SProcShmDispatch(ClientPtr client)
         return SProcShmGetImage(client);
     case X_ShmCreatePixmap:
         return SProcShmCreatePixmap(client);
+#ifdef SHM_FD_PASSING
     case X_ShmAttachFd:
         return SProcShmAttachFd(client);
     case X_ShmCreateSegment:
         return SProcShmCreateSegment(client);
+#endif
     default:
         return BadRequest;
     }
diff --git a/xorg-server/Xext/shmint.h b/xorg-server/Xext/shmint.h
index db35fbbbe..21d6cc4ee 100644
--- a/xorg-server/Xext/shmint.h
+++ b/xorg-server/Xext/shmint.h
@@ -56,16 +56,36 @@ typedef struct _ShmFuncs {
     void (*PutImage) (XSHM_PUT_IMAGE_ARGS);
 } ShmFuncs, *ShmFuncsPtr;
 
+#include <protocol-versions.h>
+
+#if SERVER_SHM_MAJOR_VERSION == 1 && SERVER_SHM_MINOR_VERSION >= 2
+#define SHM_FD_PASSING  1
+#endif
+
+#ifdef SHM_FD_PASSING
+#include "busfault.h"
+#endif
+
 typedef struct _ShmDesc {
     struct _ShmDesc *next;
     int shmid;
     int refcnt;
     char *addr;
-    Bool is_fd;
     Bool writable;
     unsigned long size;
+#ifdef SHM_FD_PASSING
+    Bool is_fd;
+    struct busfault *busfault;
+    XID resource;
+#endif
 } ShmDescRec, *ShmDescPtr;
 
+#ifdef SHM_FD_PASSING
+#define SHMDESC_IS_FD(shmdesc)  ((shmdesc)->is_fd)
+#else
+#define SHMDESC_IS_FD(shmdesc)  (0)
+#endif
+
 extern _X_EXPORT void
  ShmRegisterFuncs(ScreenPtr pScreen, ShmFuncsPtr funcs);