diff options
| author | Simon Ser <contact@emersion.fr> | 2021-01-15 11:26:35 +0100 |
|---|---|---|
| committer | Simon Ser <contact@emersion.fr> | 2021-01-15 19:27:49 +0100 |
| commit | c73a8cde832d9fa1e51156f895bf7344bdc0e3e8 (patch) | |
| tree | fbfe60ea8f5a3ea6f027df3c3d26406889fe8441 /include/render/gbm_allocator.h | |
| parent | 9dd059376c87369b239ec99612b9a3a2abac9485 (diff) | |
render/gbm_allocator: fix gbm_device use-after-free
We need to destroy any gbm_bo we've created before gbm_device_destroy.
Closes: https://github.com/swaywm/wlroots/issues/2601
Diffstat (limited to 'include/render/gbm_allocator.h')
| -rw-r--r-- | include/render/gbm_allocator.h | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/include/render/gbm_allocator.h b/include/render/gbm_allocator.h index d4cd233e..d8121328 100644 --- a/include/render/gbm_allocator.h +++ b/include/render/gbm_allocator.h @@ -8,7 +8,9 @@ struct wlr_gbm_buffer { struct wlr_buffer base; - struct gbm_bo *gbm_bo; + struct wl_list link; // wlr_gbm_allocator.buffers + + struct gbm_bo *gbm_bo; // NULL if the gbm_device has been destroyed struct wlr_dmabuf_attributes dmabuf; }; @@ -17,6 +19,8 @@ struct wlr_gbm_allocator { int fd; struct gbm_device *gbm_device; + + struct wl_list buffers; // wlr_gbm_buffer.link }; /** |