mirrors/wlroots
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wlroots/wlroots.git synced 2025-11-08 13:29:45 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

backend/wayland: don't cache next item when destroying buffers

Browse source 
Because wl_buffer.release is per-buffer and not per-commit, the
Wayland backend might create multiple struct wlr_wl_buffer per
struct wlr_buffer. As a result, the wlr_buffer_unlock() call inside
destroy_wl_buffer() can cause another struct wlr_wl_buffer to be
destroyed.

In backend_destroy() we were iterating the list of buffers with
wl_list_for_each_safe(), which is actually not safe in this case:
the next buffer is cached, but might be destroyed as a side-effect
of calling destroy_wl_buffer().

Closes: https://gitlab.freedesktop.org/wlroots/wlroots/-/issues/3572
(cherry picked from commit c88ad532ad)
This commit is contained in:
Simon Ser 2023-02-02 11:43:00 +01:00
parent 1e345c74c3
commit a9c6ae6fcc
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
backend/wayland/backend.c
View file

@ -451,8 +451,10 @@ static void backend_destroy(struct wlr_backend *backend) {
wlr_output_destroy(&output->wlr_output); wlr_output_destroy(&output->wlr_output);
} }
struct wlr_wl_buffer *buffer, *tmp_buffer; // Avoid using wl_list_for_each_safe() here: destroying a buffer may
wl_list_for_each_safe(buffer, tmp_buffer, &wl->buffers, link) { // have the side-effect of destroying the next one in the list
while (!wl_list_empty(&wl->buffers)) {
struct wlr_wl_buffer *buffer = wl_container_of(wl->buffers.next, buffer, link);
destroy_wl_buffer(buffer); destroy_wl_buffer(buffer);
} }