From 878aebfb74f0a83e9839db9c3b214c4063e67862 Mon Sep 17 00:00:00 2001 From: David96 Date: Sun, 2 Feb 2025 20:47:56 +0100 Subject: [PATCH 1/5] wlr_virtual_pointer: Set axis source on all axis Currently it is possible to crash a wlroots compositor by setting any axis source other than 0 and sending an axis event in the HORIZONTAL direction from wlr_virtual_pointer since the axis source is only set on the first axis. This then hits the assert in wlr_seat_pointer.c:332. Fix by always setting the source on all axis. (cherry picked from commit aef84f0e4d506dda18992f0213e3233a4ed2ac20) --- types/wlr_virtual_pointer_v1.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/types/wlr_virtual_pointer_v1.c b/types/wlr_virtual_pointer_v1.c index b867c8fb1..fed5790a9 100644 --- a/types/wlr_virtual_pointer_v1.c +++ b/types/wlr_virtual_pointer_v1.c @@ -134,8 +134,11 @@ static void virtual_pointer_axis_source(struct wl_client *client, if (pointer == NULL) { return; } - pointer->axis_event[pointer->axis].pointer = &pointer->pointer; - pointer->axis_event[pointer->axis].source = source; + int n_axis = sizeof(pointer->axis_event) / sizeof(pointer->axis_event[0]); + for (int i = 0; i < n_axis; i++) { + pointer->axis_event[i].pointer = &pointer->pointer; + pointer->axis_event[i].source = source; + } } static void virtual_pointer_axis_stop(struct wl_client *client, From aabe351207c6f57d5637f042dd523f643cf28c20 Mon Sep 17 00:00:00 2001 From: Dale Turner Date: Wed, 3 Dec 2025 20:02:29 -0400 Subject: [PATCH 2/5] =?UTF-8?q?Add=20"const"=20to=20eliminate=20"error:=20?= =?UTF-8?q?initialization=20discards=20=E2=80=98const=E2=80=99=20qualifier?= =?UTF-8?q?=20from=20pointer=20target=20type"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (cherry picked from commit 47486545b196987f6f07fffe2929bba8f515b8e9) --- xcursor/xcursor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xcursor/xcursor.c b/xcursor/xcursor.c index b5edb9de8..6627fb6cd 100644 --- a/xcursor/xcursor.c +++ b/xcursor/xcursor.c @@ -602,7 +602,7 @@ xcursor_build_fullname(const char *dir, const char *subdir, const char *file) static const char * xcursor_next_path(const char *path) { - char *colon = strchr(path, ':'); + const char *colon = strchr(path, ':'); if (!colon) return NULL; From 4279ee509110b020f197351b3fef37fe23ea9e04 Mon Sep 17 00:00:00 2001 From: John Lindgren Date: Sat, 20 Dec 2025 14:57:24 -0500 Subject: [PATCH 3/5] render/allocator: add missing wlr_buffer_finish() in destroy impls Fixes use-after-free on exit of labwc running nested: ==50906== Invalid write of size 8 ==50906== at 0x4A85403: wl_list_remove (wayland-util.c:57) ==50906== by 0x40BBAF9: destroy_wl_buffer (output.c:146) ==50906== by 0x40B9B4F: backend_destroy (backend.c:488) ==50906== by 0x409E96F: wlr_backend_destroy (backend.c:68) ==50906== by 0x40B78A6: multi_backend_destroy (backend.c:62) ==50906== by 0x409E96F: wlr_backend_destroy (backend.c:68) ==50906== by 0x4043DA0: server_finish (server.c:788) ==50906== by 0x403AA85: main (main.c:277) ==50906== Address 0xb4435e8 is 40 bytes inside a block of size 136 free'd ==50906== at 0x4A3E8EF: free (vg_replace_malloc.c:989) ==50906== by 0x409C954: buffer_destroy (shm.c:28) ==50906== by 0x40E96F4: buffer_consider_destroy (buffer.c:42) ==50906== by 0x40E9754: wlr_buffer_drop (buffer.c:52) ==50906== by 0x41498DA: slot_reset (swapchain.c:44) ==50906== by 0x4149933: wlr_swapchain_destroy (swapchain.c:53) ==50906== by 0x40CB1FA: wlr_output_finish (output.c:410) ==50906== by 0x40BE00B: output_destroy (output.c:957) ==50906== by 0x40CB2FC: wlr_output_destroy (output.c:436) ==50906== by 0x40B9AFC: backend_destroy (backend.c:481) ==50906== by 0x409E96F: wlr_backend_destroy (backend.c:68) ==50906== by 0x40B78A6: multi_backend_destroy (backend.c:62) ==50906== Block was alloc'd at ==50906== at 0x4A42C13: calloc (vg_replace_malloc.c:1675) ==50906== by 0x409CA84: allocator_create_buffer (shm.c:68) ==50906== by 0x409C7BA: wlr_allocator_create_buffer (allocator.c:186) ==50906== by 0x4149B80: wlr_swapchain_acquire (swapchain.c:102) ==50906== by 0x40C90DA: render_cursor_buffer (cursor.c:246) ==50906== by 0x40C93DC: output_cursor_attempt_hardware (cursor.c:303) ==50906== by 0x40C9A61: output_cursor_set_texture (cursor.c:420) ==50906== by 0x40C9738: wlr_output_cursor_set_buffer (cursor.c:352) ==50906== by 0x40F13A0: output_cursor_set_xcursor_image (wlr_cursor.c:507) ==50906== by 0x40F1B28: cursor_output_cursor_update (wlr_cursor.c:630) ==50906== by 0x40F1C2A: cursor_update_outputs (wlr_cursor.c:657) ==50906== by 0x40F1CF9: wlr_cursor_set_xcursor (wlr_cursor.c:674) Fixes: 7963ba6a0deb5b696050d914ac395bca9c4c06b2 ("buffer: introduce wlr_buffer_finish()") (cherry picked from commit 16cb509a6e21c8d9d74f4dfa98c7df5f176720c5) --- render/allocator/shm.c | 1 + render/allocator/udmabuf.c | 1 + 2 files changed, 2 insertions(+) diff --git a/render/allocator/shm.c b/render/allocator/shm.c index 2622f99aa..b5be7d014 100644 --- a/render/allocator/shm.c +++ b/render/allocator/shm.c @@ -23,6 +23,7 @@ static struct wlr_shm_buffer *shm_buffer_from_buffer( static void buffer_destroy(struct wlr_buffer *wlr_buffer) { struct wlr_shm_buffer *buffer = shm_buffer_from_buffer(wlr_buffer); + wlr_buffer_finish(wlr_buffer); munmap(buffer->data, buffer->size); close(buffer->shm.fd); free(buffer); diff --git a/render/allocator/udmabuf.c b/render/allocator/udmabuf.c index e0b01b70a..8a7109aa5 100644 --- a/render/allocator/udmabuf.c +++ b/render/allocator/udmabuf.c @@ -31,6 +31,7 @@ static bool buffer_get_dmabuf(struct wlr_buffer *wlr_buffer, struct wlr_dmabuf_a static void buffer_destroy(struct wlr_buffer *wlr_buffer) { struct wlr_udmabuf_buffer *buffer = wl_container_of(wlr_buffer, buffer, base); + wlr_buffer_finish(wlr_buffer); wlr_dmabuf_attributes_finish(&buffer->dmabuf); close(buffer->shm.fd); free(buffer); From b08af0962615ae8f54eef1fbdfe1cebbf2436839 Mon Sep 17 00:00:00 2001 From: liupeng Date: Wed, 17 Dec 2025 20:47:33 +0800 Subject: [PATCH 4/5] backend/session: respond to event hangup or error Signed-off-by: liupeng (cherry picked from commit 0ad8395ae67d4cbd32b7974246ab6c91bb217b0c) --- backend/session/session.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/backend/session/session.c b/backend/session/session.c index 48f4ab187..9a36dd953 100644 --- a/backend/session/session.c +++ b/backend/session/session.c @@ -36,6 +36,15 @@ static void handle_disable_seat(struct libseat *seat, void *data) { static int libseat_event(int fd, uint32_t mask, void *data) { struct wlr_session *session = data; + if (mask & (WL_EVENT_HANGUP | WL_EVENT_ERROR)) { + if (mask & WL_EVENT_ERROR) { + wlr_log(WLR_ERROR, "Failed to wait for libseat event"); + } else { + wlr_log(WLR_INFO, "Failed to wait for libseat event"); + } + wlr_session_destroy(session); + return 0; + } if (libseat_dispatch(session->seat_handle, 0) == -1) { wlr_log_errno(WLR_ERROR, "Failed to dispatch libseat"); wlr_session_destroy(session); From b85823039488d35941d8e6344455dd6c90ab538a Mon Sep 17 00:00:00 2001 From: Simon Ser Date: Thu, 18 Dec 2025 15:22:33 +0100 Subject: [PATCH 5/5] tinywl: fix duplicate object files passed to linker On BSD make, $> is an alias for $^. On both GNU and BSD make, $^ is supported. Specifying both resulted in duplicate object files passed to the linker: ld: error: duplicate symbol: main >>> defined at tinywl.c:887 >>> tinywl.o:(main) >>> defined at tinywl.c:887 >>> tinywl.o:(.text+0x0) cc: error: linker command failed with exit code 1 (use -v to see invocation) Only use $^ and remove $>. (cherry picked from commit 322291cdcfe1ea29fd6987f4922c90c5a2798d18) --- tinywl/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tinywl/Makefile b/tinywl/Makefile index a5cedfcc8..76c33bb31 100644 --- a/tinywl/Makefile +++ b/tinywl/Makefile @@ -19,7 +19,7 @@ xdg-shell-protocol.h: tinywl.o: tinywl.c xdg-shell-protocol.h $(CC) -c $< -g -Werror $(CFLAGS) -I. -DWLR_USE_UNSTABLE -o $@ tinywl: tinywl.o - $(CC) $^ $> -g -Werror $(CFLAGS) $(LDFLAGS) $(LIBS) -o $@ + $(CC) $^ -g -Werror $(CFLAGS) $(LDFLAGS) $(LIBS) -o $@ clean: rm -f tinywl tinywl.o xdg-shell-protocol.h