input/seat: Clean up focus_stack in seat_destroy()

This fixes use-after-free when seat_destroy() has been called.

1 files changed, 11 insertions, 6 deletions

diff --git a/sway/input/seat.c b/sway/input/seat.c
index de1a1881..dbb69ba0 100644
--- a/sway/input/seat.c
+++ b/sway/input/seat.c
@@ -46,11 +46,22 @@ static void seat_device_destroy(struct sway_seat_device *seat_device) {
 	free(seat_device);
 }
 
+static void seat_node_destroy(struct sway_seat_node *seat_node) {
+	wl_list_remove(&seat_node->destroy.link);
+	wl_list_remove(&seat_node->link);
+	free(seat_node);
+}
+
 void seat_destroy(struct sway_seat *seat) {
 	struct sway_seat_device *seat_device, *next;
 	wl_list_for_each_safe(seat_device, next, &seat->devices, link) {
 		seat_device_destroy(seat_device);
 	}
+	struct sway_seat_node *seat_node, *next_seat_node;
+	wl_list_for_each_safe(seat_node, next_seat_node, &seat->focus_stack,
+			link) {
+		seat_node_destroy(seat_node);
+	}
 	sway_input_method_relay_finish(&seat->im_relay);
 	sway_cursor_destroy(seat->cursor);
 	wl_list_remove(&seat->new_node.link);
@@ -68,12 +79,6 @@ void seat_destroy(struct sway_seat *seat) {
 	free(seat);
 }
 
-static void seat_node_destroy(struct sway_seat_node *seat_node) {
-	wl_list_remove(&seat_node->destroy.link);
-	wl_list_remove(&seat_node->link);
-	free(seat_node);
-}
-
 void seat_idle_notify_activity(struct sway_seat *seat,
 		enum sway_input_idle_source source) {
 	uint32_t mask = seat->idle_inhibit_sources;