shm: close client buffers in the cpu worker

src/cli/input.rs

@@ -353,9 +353,10 @@ impl Input {
     async fn handle_keymap(&self, input: JayInputId) -> Vec<u8> {
         let data = Rc::new(RefCell::new(Vec::new()));
         jay_input::Keymap::handle(&self.tc, input, data.clone(), |d, map| {
-            let mem =
+            let mem = Rc::new(
-                Rc::new(ClientMem::new(&map.keymap, map.keymap_len as _, true, None).unwrap())
+                ClientMem::new(&map.keymap, map.keymap_len as _, true, None, None).unwrap(),
-                    .offset(0);
+            )
+            .offset(0);
             mem.read(d.borrow_mut().deref_mut()).unwrap();
         });
         self.tc.round_trip().await;

src/clientmem.rs

@@ -1,8 +1,12 @@
 use {
-    crate::{client::Client, utils::vec_ext::VecExt},
+    crate::{
+        client::Client,
+        cpu_worker::{AsyncCpuWork, CpuJob, CpuWork, CpuWorker},
+        utils::vec_ext::VecExt,
+    },
     std::{
         cell::Cell,
-        mem::MaybeUninit,
+        mem::{ManuallyDrop, MaybeUninit},
         ptr,
         rc::Rc,
         sync::atomic::{compiler_fence, Ordering},
@@ -25,10 +29,11 @@ pub enum ClientMemError {
 }
 
 pub struct ClientMem {
-    fd: Rc<OwnedFd>,
+    fd: ManuallyDrop<Rc<OwnedFd>>,
     failed: Cell<bool>,
     sigbus_impossible: bool,
     data: *const [Cell<u8>],
+    cpu: Option<Rc<CpuWorker>>,
 }
 
 #[derive(Clone)]
@@ -44,6 +49,7 @@ impl ClientMem {
         len: usize,
         read_only: bool,
         client: Option<&Client>,
+        cpu: Option<&Rc<CpuWorker>>,
     ) -> Result<Self, ClientMemError> {
         let mut sigbus_impossible = false;
         if let Ok(seals) = uapi::fcntl_get_seals(fd.raw()) {
@@ -78,10 +84,11 @@ impl ClientMem {
             }
         };
         Ok(Self {
-            fd: fd.clone(),
+            fd: ManuallyDrop::new(fd.clone()),
             failed: Cell::new(false),
             sigbus_impossible,
             data,
+            cpu: cpu.cloned(),
         })
     }
 
@@ -155,8 +162,17 @@ impl ClientMemOffset {
 
 impl Drop for ClientMem {
     fn drop(&mut self) {
-        unsafe {
+        let fd = unsafe { ManuallyDrop::take(&mut self.fd) };
-            c::munmap(self.data as _, self.len());
+        if let Some(cpu) = &self.cpu {
+            let pending = cpu.submit(Box::new(CloseMemWork {
+                fd: Rc::try_unwrap(fd).ok(),
+                data: self.data,
+            }));
+            pending.detach();
+        } else {
+            unsafe {
+                c::munmap(self.data as _, self.len());
+            }
         }
     }
 }
@@ -219,3 +235,30 @@ pub fn init() -> Result<(), ClientMemError> {
         }
     }
 }
+
+struct CloseMemWork {
+    fd: Option<OwnedFd>,
+    data: *const [Cell<u8>],
+}
+
+unsafe impl Send for CloseMemWork {}
+
+impl CpuJob for CloseMemWork {
+    fn work(&mut self) -> &mut dyn CpuWork {
+        self
+    }
+
+    fn completed(self: Box<Self>) {
+        // nothing
+    }
+}
+
+impl CpuWork for CloseMemWork {
+    fn run(&mut self) -> Option<Box<dyn AsyncCpuWork>> {
+        self.fd.take();
+        unsafe {
+            c::munmap(self.data as _, self.data.len());
+        }
+        None
+    }
+}

src/cpu_worker.rs

@@ -140,7 +140,6 @@ pub enum CpuWorkerError {
 }
 
 impl PendingJob {
-    #[expect(dead_code)]
     pub fn detach(self) {
         match self.job_data.state.get() {
             PendingJobState::Waiting => {

src/ifs/jay_input.rs

@@ -169,7 +169,14 @@ impl JayInput {
     where
         F: FnOnce(&Rc<XkbKeymap>) -> Result<(), JayInputError>,
     {
-        let cm = Rc::new(ClientMem::new(keymap, len as _, true, Some(&self.client))?).offset(0);
+        let cm = Rc::new(ClientMem::new(
+            keymap,
+            len as _,
+            true,
+            Some(&self.client),
+            None,
+        )?)
+        .offset(0);
         let mut map = vec![];
         cm.read(&mut map)?;
         self.or_error(|| {

src/ifs/wl_seat/zwp_virtual_keyboard_v1.rs

@@ -56,9 +56,15 @@ impl ZwpVirtualKeyboardV1RequestHandler for ZwpVirtualKeyboardV1 {
         if req.size > MAX_SIZE {
             return Err(ZwpVirtualKeyboardV1Error::OversizedKeymap);
         }
-        let client_mem = ClientMem::new(&req.fd, req.size as usize - 1, true, Some(&self.client))
+        let client_mem = ClientMem::new(
-            .map(Rc::new)
+            &req.fd,
-            .map_err(ZwpVirtualKeyboardV1Error::MapKeymap)?;
+            req.size as usize - 1,
+            true,
+            Some(&self.client),
+            None,
+        )
+        .map(Rc::new)
+        .map_err(ZwpVirtualKeyboardV1Error::MapKeymap)?;
         let mut map = vec![];
         client_mem
             .offset(0)

src/ifs/wl_shm_pool.rs

@@ -34,7 +34,13 @@ impl WlShmPool {
         Ok(Self {
             id,
             client: client.clone(),
-            mem: CloneCell::new(Rc::new(ClientMem::new(&fd, len, false, Some(client))?)),
+            mem: CloneCell::new(Rc::new(ClientMem::new(
+                &fd,
+                len,
+                false,
+                Some(client),
+                Some(&client.state.cpu_worker),
+            )?)),
             fd,
             tracker: Default::default(),
             version,
@@ -86,6 +92,7 @@ impl WlShmPoolRequestHandler for WlShmPool {
             req.size as usize,
             false,
             Some(&self.client),
+            Some(&self.client.state.cpu_worker),
         )?));
         Ok(())
     }

src/it/tests/t0040_virtual_keyboard.rs

@@ -149,7 +149,7 @@ async fn test(run: Rc<TestRun>) -> TestResult {
 }
 
 fn read_keymap(fd: &Rc<OwnedFd>, size: usize) -> String {
-    let client_mem = ClientMem::new(fd, size - 1, true, None).unwrap();
+    let client_mem = ClientMem::new(fd, size - 1, true, None, None).unwrap();
     let client_mem = Rc::new(client_mem).offset(0);
     let mut v = vec![];
     client_mem.read(&mut v).unwrap();