mirrors/wlroots
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wlroots/wlroots.git synced 2026-06-13 14:32:57 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

types/linux_dmabuf: fix use-after-free of device node name

Browse source 
The name pointer points into the drmDevice structure, which is freed by
drmFreeDevice(). The error log was using name after the free, which is
undefined behavior.

Move the error log before drmFreeDevice() so name is still valid when
used in the log message.

Signed-off-by: Wang Yu <wangyu@uniontech.com>
This commit is contained in:
Wang Yu 2026-06-09 16:08:16 +08:00 • committed by yu wang
parent fc1cc7656a
commit a5691ea7c3
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
types/wlr_linux_dmabuf_v1.c
View file

@ -901,9 +901,9 @@ static bool set_default_feedback(struct wlr_linux_dmabuf_v1 *linux_dmabuf,
if (device->available_nodes & (1 << DRM_NODE_RENDER)) {
const char *name = device->nodes[DRM_NODE_RENDER];
main_device_fd = open(name, O_RDWR | O_CLOEXEC);
drmFreeDevice(&device);
if (main_device_fd < 0) {
wlr_log_errno(WLR_ERROR, "Failed to open DRM device %s", name);
drmFreeDevice(&device);
goto error_compiled;
}
} else {
@ -913,8 +913,8 @@ static bool set_default_feedback(struct wlr_linux_dmabuf_v1 *linux_dmabuf,
assert(device->available_nodes & (1 << DRM_NODE_PRIMARY));
wlr_log(WLR_DEBUG, "DRM device %s has no render node, "
"skipping DMA-BUF import checks", device->nodes[DRM_NODE_PRIMARY]);
drmFreeDevice(&device);
}
drmFreeDevice(&device);
size_t tranches_len =
feedback->tranches.size / sizeof(struct wlr_linux_dmabuf_feedback_v1_tranche);