From c73a8cde832d9fa1e51156f895bf7344bdc0e3e8 Mon Sep 17 00:00:00 2001 From: Simon Ser Date: Fri, 15 Jan 2021 11:26:35 +0100 Subject: render/gbm_allocator: fix gbm_device use-after-free We need to destroy any gbm_bo we've created before gbm_device_destroy. Closes: https://github.com/swaywm/wlroots/issues/2601 --- include/render/gbm_allocator.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/render/gbm_allocator.h b/include/render/gbm_allocator.h index d4cd233e..d8121328 100644 --- a/include/render/gbm_allocator.h +++ b/include/render/gbm_allocator.h @@ -8,7 +8,9 @@ struct wlr_gbm_buffer { struct wlr_buffer base; - struct gbm_bo *gbm_bo; + struct wl_list link; // wlr_gbm_allocator.buffers + + struct gbm_bo *gbm_bo; // NULL if the gbm_device has been destroyed struct wlr_dmabuf_attributes dmabuf; }; @@ -17,6 +19,8 @@ struct wlr_gbm_allocator { int fd; struct gbm_device *gbm_device; + + struct wl_list buffers; // wlr_gbm_buffer.link }; /** -- cgit v1.2.3