desktop-shell: fix bug referencing invalid surface list

Submitted by Ryo Munakata on July 29, 2015, 6:12 p.m.

Details

Message ID 1438193558-30358-1-git-send-email-ryomnktml@gmail.com
State Superseded
Delegated to: Derek Foreman
Headers show

Not browsing as part of any series.

Commit Message

Ryo Munakata July 29, 2015, 6:12 p.m.
In shell_destroy_shell_surface, we remove the link of a shell_surface.
There is a case which the link references shell_client::surface_list
which is already free'd.
Therefore we have to remove shell_client::surface_list when freeing
a shell_client.

Signed-off-by: Ryo Munakata <ryomnktml@gmail.com>
---
 desktop-shell/shell.c | 3 +++
 1 file changed, 3 insertions(+)

Patch hide | download patch | download mbox

diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c
index 9e3701f..9caf5bc 100644
--- a/desktop-shell/shell.c
+++ b/desktop-shell/shell.c
@@ -5791,6 +5791,9 @@  handle_shell_client_destroy(struct wl_listener *listener, void *data)
 
 	if (sc->ping_timer)
 		wl_event_source_remove(sc->ping_timer);
+
+	wl_list_remove(&sc->surface_list);
+
 	free(sc);
 }
 

Comments

On 29/07/15 01:12 PM, Ryo Munakata wrote:
> In shell_destroy_shell_surface, we remove the link of a shell_surface.
> There is a case which the link references shell_client::surface_list
> which is already free'd.
> Therefore we have to remove shell_client::surface_list when freeing
> a shell_client.
> 
> Signed-off-by: Ryo Munakata <ryomnktml@gmail.com>
> ---
>  desktop-shell/shell.c | 3 +++
>  1 file changed, 3 insertions(+)

I thought this looked familiar...

See also:
http://patchwork.freedesktop.org/patch/50713/

:)

> 
> diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c
> index 9e3701f..9caf5bc 100644
> --- a/desktop-shell/shell.c
> +++ b/desktop-shell/shell.c
> @@ -5791,6 +5791,9 @@ handle_shell_client_destroy(struct wl_listener *listener, void *data)
>  
>  	if (sc->ping_timer)
>  		wl_event_source_remove(sc->ping_timer);
> +
> +	wl_list_remove(&sc->surface_list);
> +
>  	free(sc);
>  }
>  
>
Hi Derek.

On 08/05, Derek Foreman wrote:
> On 29/07/15 01:12 PM, Ryo Munakata wrote:
> > In shell_destroy_shell_surface, we remove the link of a shell_surface.
> > There is a case which the link references shell_client::surface_list
> > which is already free'd.
> > Therefore we have to remove shell_client::surface_list when freeing
> > a shell_client.
> > 
> > Signed-off-by: Ryo Munakata <ryomnktml@gmail.com>
> > ---
> >  desktop-shell/shell.c | 3 +++
> >  1 file changed, 3 insertions(+)
> 
> I thought this looked familiar...
> 
> See also:
> http://patchwork.freedesktop.org/patch/50713/
> 
> :)
> 

Oh, I missed your patch. Sry.

I withdraw this patch.

:)

Thank you.