mirror of
				https://gitlab.freedesktop.org/wlroots/wlroots.git
				synced 2025-11-03 09:01:40 -05:00 
			
		
		
		
	wlr_drm_lease_v1: Fix use-after-free in backend_destroy()
valgrind said (on exit from labwc):
    Invalid write of size 8
       at 0x487DEAF: wl_list_remove (wayland-util.c:56)
       by 0x487DF80: wl_signal_emit_mutable (wayland-server.c:2182)
       by 0x48CD6B7: backend_destroy.part.0.lto_priv.0 (backend.c:41)
       by 0x48DC19D: multi_backend_destroy (backend.c:58)
       by 0x4880286: UnknownInlinedFun (wayland-server.c:2315)
       by 0x4880286: wl_display_destroy (wayland-server.c:1170)
       by 0x112491: UnknownInlinedFun (server.c:485)
       by 0x112491: main (main.c:110)
     Address 0x1f9d0210 is 112 bytes inside a block of size 136 free'd
       at 0x484426F: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
       by 0x487DF6D: wl_signal_emit_mutable (wayland-server.c:2179)
       by 0x48CD6B7: backend_destroy.part.0.lto_priv.0 (backend.c:41)
       by 0x48DC19D: multi_backend_destroy (backend.c:58)
       by 0x4880286: UnknownInlinedFun (wayland-server.c:2315)
       by 0x4880286: wl_display_destroy (wayland-server.c:1170)
       by 0x112491: UnknownInlinedFun (server.c:485)
       by 0x112491: main (main.c:110)
     Block was alloc'd at
       at 0x4846A73: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
       by 0x4918D4E: drm_lease_device_v1_create (wlr_drm_lease_v1.c:639)
       by 0x48D3B00: wlr_multi_for_each_backend (backend.c:249)
       by 0x49191D2: wlr_drm_lease_v1_manager_create (wlr_drm_lease_v1.c:706)
       by 0x111EE9: UnknownInlinedFun (server.c:384)
       by 0x111EE9: main (main.c:92)
			
			
This commit is contained in:
		
							parent
							
								
									7d9c595f19
								
							
						
					
					
						commit
						1facdeabe5
					
				
					 1 changed files with 1 additions and 0 deletions
				
			
		| 
						 | 
				
			
			@ -126,6 +126,7 @@ static void drm_lease_device_v1_destroy(
 | 
			
		|||
	}
 | 
			
		||||
 | 
			
		||||
	wl_list_remove(&device->link);
 | 
			
		||||
	wl_list_remove(&device->backend_destroy.link);
 | 
			
		||||
	wlr_global_destroy_safe(device->global);
 | 
			
		||||
 | 
			
		||||
	free(device);
 | 
			
		||||
| 
						 | 
				
			
			
 | 
			
		|||
		Loading…
	
	Add table
		Add a link
		
	
		Reference in a new issue