mirrors/wlroots
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wlroots/wlroots.git synced 2025-11-04 13:29:45 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

backend/drm: fix a use-after-free

Browse source 
The page_flip can be destroyed, but it is unconditionally accessed later
on when setting present_flags. Fix this by simply setting the
present_flags before the page_flip gets destroyed.

(cherry picked from commit 3d2f09bace)
This commit is contained in:
Dudemanguy 2024-08-19 11:33:36 -05:00 • committed by Simon Zeni
parent 0992422493
commit 1f96bcc1db
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
backend/drm/drm.c
View file

@ -2010,6 +2010,12 @@ static void handle_page_flip(int fd, unsigned seq,
if (conn != NULL) { if (conn != NULL) {
conn->pending_page_flip = NULL; conn->pending_page_flip = NULL;
} }
uint32_t present_flags = WLR_OUTPUT_PRESENT_HW_CLOCK | WLR_OUTPUT_PRESENT_HW_COMPLETION;
if (!page_flip->async) {
present_flags |= WLR_OUTPUT_PRESENT_VSYNC;
}
if (page_flip->connectors_len == 0) { if (page_flip->connectors_len == 0) {
drm_page_flip_destroy(page_flip); drm_page_flip_destroy(page_flip);
} }
@ -2040,10 +2046,6 @@ static void handle_page_flip(int fd, unsigned seq,
drm_fb_move(&layer->current_fb, &layer->queued_fb); drm_fb_move(&layer->current_fb, &layer->queued_fb);
} }
uint32_t present_flags = WLR_OUTPUT_PRESENT_HW_CLOCK | WLR_OUTPUT_PRESENT_HW_COMPLETION;
if (!page_flip->async) {
present_flags |= WLR_OUTPUT_PRESENT_VSYNC;
}
/* Don't report ZERO_COPY in multi-gpu situations, because we had to copy /* Don't report ZERO_COPY in multi-gpu situations, because we had to copy
* data between the GPUs, even if we were using the direct scanout * data between the GPUs, even if we were using the direct scanout
* interface. * interface.