xwayland/selection: destroy all selections on Xwayland restart

Previously, Xwayland could restart, and we'd get events for transfers
pointing to the previous (now freed) xwm instance. This led to
use-after-free segfaults.

Closes #2565.

1 files changed, 24 insertions, 2 deletions

diff --git a/xwayland/selection/selection.c b/xwayland/selection/selection.c
index ea0910d7..a6042582 100644
--- a/xwayland/selection/selection.c
+++ b/xwayland/selection/selection.c
@@ -249,25 +249,47 @@ void xwm_selection_finish(struct wlr_xwm *xwm) {
 	if (!xwm) {
 		return;
 	}
+
+	struct wlr_xwm_selection *selections[] = {
+		&xwm->clipboard_selection,
+		&xwm->primary_selection,
+		&xwm->dnd_selection,
+	};
+
+	for (size_t i = 0; i < sizeof(selections)/sizeof(selections[0]); i++) {
+		struct wlr_xwm_selection *selection = selections[i];
+
+		struct wlr_xwm_selection_transfer *outgoing, *tmp;
+		wl_list_for_each_safe(outgoing, tmp, &selection->outgoing, outgoing_link) {
+			wlr_log(WLR_INFO, "destroyed pending transfer %ld/%p", i, outgoing);
+			xwm_selection_transfer_destroy_outgoing(outgoing);
+		}
+
+		xwm_selection_transfer_finish(&selection->incoming);
+	}
+
 	if (xwm->selection_window) {
 		xcb_destroy_window(xwm->xcb_conn, xwm->selection_window);
 	}
+
 	if (xwm->dnd_window) {
 		xcb_destroy_window(xwm->xcb_conn, xwm->dnd_window);
 	}
+
 	if (xwm->seat) {
 		if (xwm->seat->selection_source &&
-				data_source_is_xwayland(
-					xwm->seat->selection_source)) {
+				data_source_is_xwayland(xwm->seat->selection_source)) {
 			wlr_seat_set_selection(xwm->seat, NULL,
 				wl_display_next_serial(xwm->xwayland->wl_display));
 		}
+
 		if (xwm->seat->primary_selection_source &&
 				primary_selection_source_is_xwayland(
 					xwm->seat->primary_selection_source)) {
 			wlr_seat_set_primary_selection(xwm->seat, NULL,
 				wl_display_next_serial(xwm->xwayland->wl_display));
 		}
+
 		wlr_xwayland_set_seat(xwm->xwayland, NULL);
 	}
 }