diff options
| author | Kenny Levinsen <kl@kl.wtf> | 2024-11-17 21:43:31 +0100 |
|---|---|---|
| committer | Simon Ser <contact@emersion.fr> | 2024-11-28 20:40:40 +0100 |
| commit | 78750f58a38508802b7ac4781c786a0f1f424cf5 (patch) | |
| tree | ee5b1f4ee062982bef0e372818ea1464b2419e88 | |
| parent | b072958b49b3931957291819ec3c82ad6c9eb5b8 (diff) | |
desktop/output: Clear repaint timer earlier in destroy
The teardown of a sway_output is split in two: begin_destroy and
output_destroy. The former clears some state such as NULL'ing the
reference to wlr_output, while the latter frees the struct and its
remaining resources.
If an output is destroyed while a repaint timer is pending, future frame
callbacks will no longer occur as the listener is torn down in
begin_destroy, but the repaint timer is not torn down and may still
fire until output_destroy is hit. As begin_destroy cleared the reference
to wlr_output, this leads to a NULL-pointer dereference.
Tear down the repaint timer in begin_destroy as there is no need for it.
Fixes: fdc4318ac66d ("desktop/output: Clear frame_pending even output is disabled")
(cherry picked from commit 5312376077254d6431bb92ba22de3840b9933f67)
| -rw-r--r-- | sway/desktop/output.c | 3 | ||||
| -rw-r--r-- | sway/tree/output.c | 1 |
2 files changed, 3 insertions, 1 deletions
diff --git a/sway/desktop/output.c b/sway/desktop/output.c index 01d209a2..3a2ae403 100644 --- a/sway/desktop/output.c +++ b/sway/desktop/output.c @@ -459,6 +459,9 @@ static void begin_destroy(struct sway_output *output) { output->wlr_output->data = NULL; output->wlr_output = NULL; + wl_event_source_remove(output->repaint_timer); + output->repaint_timer = NULL; + request_modeset(); } diff --git a/sway/tree/output.c b/sway/tree/output.c index 44b941ca..65d9e3e7 100644 --- a/sway/tree/output.c +++ b/sway/tree/output.c @@ -273,7 +273,6 @@ void output_destroy(struct sway_output *output) { destroy_scene_layers(output); list_free(output->workspaces); list_free(output->current.workspaces); - wl_event_source_remove(output->repaint_timer); wlr_color_transform_unref(output->color_transform); free(output); } |