diff options
| author | John Lindgren <john@jlindgren.net> | 2022-09-15 21:20:27 -0400 |
|---|---|---|
| committer | John Lindgren <john@jlindgren.net> | 2022-09-15 21:24:05 -0400 |
| commit | 1facdeabe5a8712b43fd157adadd79a027e29c07 (patch) | |
| tree | 2d77ec2fc1e1a47da9964727aa30f5d2bb3a9e70 | |
| parent | 7d9c595f19b7180aaed1dd229e9b5b9907c14478 (diff) | |
wlr_drm_lease_v1: Fix use-after-free in backend_destroy()
valgrind said (on exit from labwc):
Invalid write of size 8
at 0x487DEAF: wl_list_remove (wayland-util.c:56)
by 0x487DF80: wl_signal_emit_mutable (wayland-server.c:2182)
by 0x48CD6B7: backend_destroy.part.0.lto_priv.0 (backend.c:41)
by 0x48DC19D: multi_backend_destroy (backend.c:58)
by 0x4880286: UnknownInlinedFun (wayland-server.c:2315)
by 0x4880286: wl_display_destroy (wayland-server.c:1170)
by 0x112491: UnknownInlinedFun (server.c:485)
by 0x112491: main (main.c:110)
Address 0x1f9d0210 is 112 bytes inside a block of size 136 free'd
at 0x484426F: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
by 0x487DF6D: wl_signal_emit_mutable (wayland-server.c:2179)
by 0x48CD6B7: backend_destroy.part.0.lto_priv.0 (backend.c:41)
by 0x48DC19D: multi_backend_destroy (backend.c:58)
by 0x4880286: UnknownInlinedFun (wayland-server.c:2315)
by 0x4880286: wl_display_destroy (wayland-server.c:1170)
by 0x112491: UnknownInlinedFun (server.c:485)
by 0x112491: main (main.c:110)
Block was alloc'd at
at 0x4846A73: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
by 0x4918D4E: drm_lease_device_v1_create (wlr_drm_lease_v1.c:639)
by 0x48D3B00: wlr_multi_for_each_backend (backend.c:249)
by 0x49191D2: wlr_drm_lease_v1_manager_create (wlr_drm_lease_v1.c:706)
by 0x111EE9: UnknownInlinedFun (server.c:384)
by 0x111EE9: main (main.c:92)
| -rw-r--r-- | types/wlr_drm_lease_v1.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/types/wlr_drm_lease_v1.c b/types/wlr_drm_lease_v1.c index 315c5ff9..463e2918 100644 --- a/types/wlr_drm_lease_v1.c +++ b/types/wlr_drm_lease_v1.c @@ -126,6 +126,7 @@ static void drm_lease_device_v1_destroy( } wl_list_remove(&device->link); + wl_list_remove(&device->backend_destroy.link); wlr_global_destroy_safe(device->global); free(device); |