blankie
/
wlroots
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

render/egl: fix gbm_device use-after-free 

The GBM device needs to be destroyed after the EGL display.

    ==50931==ERROR: AddressSanitizer: SEGV on unknown address 0x7fe40a000049 (pc 0x7fe446121d30 bp 0x60400001bbd0 sp 0x7ffc99c774d0 T0)
    ==50931==The signal is caused by a READ memory access.
        #0 0x7fe446121d30  (/usr/lib/dri/radeonsi_dri.so+0x5f0d30)
        #1 0x7fe4474717bd  (/usr/lib/../lib/libEGL_mesa.so.0+0x177bd)
        #2 0x7fe4474677d9  (/usr/lib/../lib/libEGL_mesa.so.0+0xd7d9)
        #3 0x7fe44cca7b6f in wlr_egl_destroy ../subprojects/wlroots/render/egl.c:379
        #4 0x7fe44ccc2626 in gles2_destroy ../subprojects/wlroots/render/gles2/renderer.c:705
        #5 0x7fe44ccb5041 in wlr_renderer_destroy ../subprojects/wlroots/render/wlr_renderer.c:37
        #6 0x7fe44cd17850 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:296
        #7 0x7fe44ccca4de in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:48
        #8 0x7fe44cd11b21 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:58
        #9 0x7fe44cd125b0 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:125
        #10 0x7fe44c315e0e  (/usr/lib/libwayland-server.so.0+0x8e0e)
        #11 0x7fe44c3165a6 in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x95a6)
        #12 0x55a2c8870683 in server_fini ../sway/server.c:203
        #13 0x55a2c886cbf2 in main ../sway/main.c:436
        #14 0x7fe44b77c151 in __libc_start_main (/usr/lib/libc.so.6+0x28151)
        #15 0x55a2c883172d in _start (/home/simon/src/sway/build/sway/sway+0x33472d)
This commit is contained in:
Simon Ser 2021-01-16 09:07:56 +01:00
parent b3e76d6678
commit 32c30481d3
No known key found for this signature in database
GPG Key ID: 0FDE7BE0E88F5E48
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
render/egl.c
View File

@ -363,10 +363,6 @@ void wlr_egl_destroy(struct wlr_egl *egl) {
return;
}
if (egl->gbm_device) {
gbm_device_destroy(egl->gbm_device);
}
wlr_drm_format_set_finish(&egl->dmabuf_render_formats);
wlr_drm_format_set_finish(&egl->dmabuf_texture_formats);
@ -379,6 +375,11 @@ void wlr_egl_destroy(struct wlr_egl *egl) {
eglDestroyContext(egl->display, egl->context);
eglTerminate(egl->display);
eglReleaseThread();
if (egl->gbm_device) {
gbm_device_destroy(egl->gbm_device);
}
free(egl);
}