From 3315a400fcfe355f5056f65aade20454cbdd4928 Mon Sep 17 00:00:00 2001
From: Rainer Keller <Rainer.Keller@qt.io>
Date: Thu, 10 Oct 2019 13:32:31 +0200
Subject: [PATCH] Protect global variable g_pointIdMap with mutexes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The evdev touch handler is thread based and calls
QWindowSystemInterface::handleTouchEvent. The global variable
in qwindowsysteminterface.cpp is used without being protected by mutexes
which causes data loss and crashes when multiple touch screens are used.

Fixes: QTBUG-63584
Change-Id: I8b5bb04cc517fab96ac428b2bd2bc128b2ca1a54
Reviewed-by: Johan Helsing <johan.helsing@qt.io>
Reviewed-by: Shawn Rutledge <shawn.rutledge@qt.io>
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@qt.io>
(cherry picked from commit 23d73208524d3ab2166121d08594da88e6b4460b)
Reviewed-by: Laszlo Agocs <laszlo.agocs@qt.io>
---
 src/gui/kernel/qwindowsysteminterface.cpp | 6 ++++++
 src/gui/kernel/qwindowsysteminterface_p.h | 1 +
 2 files changed, 7 insertions(+)

diff --git a/src/gui/kernel/qwindowsysteminterface.cpp b/src/gui/kernel/qwindowsysteminterface.cpp
index b0f28691289..8e50e5ef9e6 100644
--- a/src/gui/kernel/qwindowsysteminterface.cpp
+++ b/src/gui/kernel/qwindowsysteminterface.cpp
@@ -619,6 +619,7 @@ bool QWindowSystemInterface::isTouchDeviceRegistered(const QTouchDevice *device)
 static int g_nextPointId = 1;
 
 // map from device-independent point id (arbitrary) to "Qt point" ids
+QMutex QWindowSystemInterfacePrivate::pointIdMapMutex;
 typedef QMap<quint64, int> PointIdMap;
 Q_GLOBAL_STATIC(PointIdMap, g_pointIdMap)
 
@@ -636,6 +637,8 @@ Q_GLOBAL_STATIC(PointIdMap, g_pointIdMap)
 */
 static int acquireCombinedPointId(quint8 deviceId, int pointId)
 {
+    QMutexLocker locker(&QWindowSystemInterfacePrivate::pointIdMapMutex);
+
     quint64 combinedId64 = (quint64(deviceId) << 32) + pointId;
     auto it = g_pointIdMap->constFind(combinedId64);
     int uid;
@@ -695,6 +698,8 @@ QList<QTouchEvent::TouchPoint>
     }
 
     if (states == Qt::TouchPointReleased) {
+        QMutexLocker locker(&QWindowSystemInterfacePrivate::pointIdMapMutex);
+
         // All points on deviceId have been released.
         // Remove all points associated with that device from g_pointIdMap.
         // (On other devices, some touchpoints might still be pressed.
@@ -714,6 +719,7 @@ QList<QTouchEvent::TouchPoint>
 
 void QWindowSystemInterfacePrivate::clearPointIdMap()
 {
+    QMutexLocker locker(&QWindowSystemInterfacePrivate::pointIdMapMutex);
     g_pointIdMap->clear();
     g_nextPointId = 1;
 }
diff --git a/src/gui/kernel/qwindowsysteminterface_p.h b/src/gui/kernel/qwindowsysteminterface_p.h
index cea02fb8b76..7b065a4a169 100644
--- a/src/gui/kernel/qwindowsysteminterface_p.h
+++ b/src/gui/kernel/qwindowsysteminterface_p.h
@@ -529,6 +529,7 @@ public:
 
     static QWaitCondition eventsFlushed;
     static QMutex flushEventMutex;
+    static QMutex pointIdMapMutex;
     static QAtomicInt eventAccepted;
 
     static QList<QTouchEvent::TouchPoint>