mirrors/wlroots
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wlroots/wlroots.git synced 2025-12-16 08:56:26 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

backend: fix use-after-free when destroying backends

Browse source 
The backend destroy signal is emitted before the output_remove
signal is. When the destroy signal is emitted listeners remove
their output_remove listener, so the output_remove signal is never
received and listeners have an invalid output pointer.

The correct way to solve this would be to remove the output_remove
signal completely and use the wlr_output.events.destroy signal
instead. This isn't yet possible because wl_signal_emit is unsafe
and listeners cannot be removed in listeners.
This commit is contained in:
emersion 2018-01-30 19:45:57 +01:00
parent 704130cc11
commit babdd6ccf7
No known key found for this signature in database
GPG key ID: 0FDE7BE0E88F5E48
10 changed files with 27 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

8
backend/libinput/backend.c
View file

@ -95,12 +95,12 @@ static bool wlr_libinput_backend_start(struct wlr_backend *_backend) {
return true;
}
static void wlr_libinput_backend_destroy(struct wlr_backend *_backend) {
if (!_backend) {
static void wlr_libinput_backend_destroy(struct wlr_backend *wlr_backend) {
if (!wlr_backend) {
return;
}
struct wlr_libinput_backend *backend =
(struct wlr_libinput_backend *)_backend;
(struct wlr_libinput_backend *)wlr_backend;
for (size_t i = 0; i < backend->wlr_device_lists.length; i++) {
struct wl_list *wlr_devices = backend->wlr_device_lists.items[i];
@ -112,6 +112,8 @@ static void wlr_libinput_backend_destroy(struct wlr_backend *_backend) {
free(wlr_devices);
}
wl_signal_emit(&wlr_backend->events.destroy, wlr_backend);
wl_list_remove(&backend->display_destroy.link);
wl_list_remove(&backend->session_signal.link);