This fixes a race that causes UAF when turning on multiple outputs after they've been off for a while. When output_begin_destroy is called while a transaction that references the output is in-flight, node_set_dirty adds the node to server.dirty_nodes list and ntxnrefs is still held by that transaction. Once the transaction completes and ntxnrefs drops to 0, transaction_destroy frees the output, leaving a dangling pointer in server.dirty_nodes. The next transaction_commit_dirty call then walks the dirty_nodes list and crashes The fix is to skip the free in transaction_destroy if node->dirty is set, this means transaction_commit_dirty hasn't processed this node yet and will bump ntxnrefs shortly. The free will happen once that transaction completes and ntxnrefs reaches 0 again and transaction_commit_dirty will allocate a fresh instruction and increment ntxnrefs again when it processes the node. |
||
|---|---|---|
| .builds | ||
| .github/ISSUE_TEMPLATE | ||
| assets | ||
| client | ||
| common | ||
| completions | ||
| include | ||
| protocols | ||
| sway | ||
| swaybar | ||
| swaymsg | ||
| swaynag | ||
| .editorconfig | ||
| .gitignore | ||
| .mailmap | ||
| config.in | ||
| CONTRIBUTING.md | ||
| LICENSE | ||
| meson.build | ||
| meson_options.txt | ||
| README.ar.md | ||
| README.az.md | ||
| README.cs.md | ||
| README.de.md | ||
| README.dk.md | ||
| README.es.md | ||
| README.fr.md | ||
| README.ge.md | ||
| README.gr.md | ||
| README.hi.md | ||
| README.hu.md | ||
| README.ir.md | ||
| README.it.md | ||
| README.ja.md | ||
| README.ko.md | ||
| README.md | ||
| README.nl.md | ||
| README.no.md | ||
| README.pl.md | ||
| README.pt.md | ||
| README.ro.md | ||
| README.ru.md | ||
| README.sr.md | ||
| README.sv.md | ||
| README.tr.md | ||
| README.uk.md | ||
| README.zh-CN.md | ||
| README.zh-TW.md | ||
| release.sh | ||
| sway.desktop | ||
sway
English - عربي - Azərbaycanca - Česky - Deutsch - Dansk - Español - Français - ქართული - Ελληνικά - हिन्दी - Magyar - فارسی - Italiano - 日本語 - 한국어 - Nederlands - Norsk - Polski - Português - Română - Русский - Српски - Svenska - Türkçe - Українська - 中文-简体 - 中文-繁體
sway is an i3-compatible Wayland compositor. Read the FAQ. Join the IRC channel (#sway on irc.libera.chat).
Release Signatures
Releases are signed with E88F5E48 and published on GitHub.
Installation
From Packages
Sway is available in many distributions. Try installing the "sway" package for yours.
Compiling from Source
Check out this wiki page if you want to build the HEAD of sway and wlroots for testing or development.
Install dependencies:
- meson *
- wlroots
- wayland
- wayland-protocols *
- pcre2
- json-c
- pango
- cairo
- gdk-pixbuf2 (optional: additional image formats for system tray)
- swaybg (optional: wallpaper)
- scdoc (optional: man pages) *
- git (optional: version info) *
* Compile-time dep
Run these commands:
meson setup build/
ninja -C build/
sudo ninja -C build/ install
Configuration
If you already use i3, then copy your i3 config to ~/.config/sway/config and
it'll work out of the box. Otherwise, copy the sample configuration file to
~/.config/sway/config. It is usually located at /etc/sway/config.
Run man 5 sway for information on the configuration.
Running
Run sway from a TTY or from a display manager.