blob: 1fdf08dc7487e74ae38f1170e9ecef246db14e02 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
https://bugs.gentoo.org/910315
https://invent.kde.org/qt/qt/qtwayland/-/merge_requests/73
Reported downstream in Gentoo at https://bugs.gentoo.org/910315.
`kde/5.15` has b981fc82eb37700353949c72d3fd6d0887c8c107 ('[PATCH 27/51] Reduce memory leakage')
backported but this introduces a use-after-free because `wl_event_queue_destroy` must be called
before `wl_display_disconnect`. So, just backport the upstream fix which sorts out the order.
Upstream review: https://codereview.qt-project.org/c/qt/qtwayland/+/471416
Upstream review (6.x): https://codereview.qt-project.org/c/qt/qtwayland/+/471528
From 3a8613b91d2239aebc73b43562f929aa71af0de5 Mon Sep 17 00:00:00 2001
From: David Redondo <qt@david-redondo.de>
Date: Tue, 11 Apr 2023 14:27:27 +0200
Subject: [PATCH] Destroy frame queue before display
wl_event_queue_destroy accesses the display.
Found by running a test under valgrind.
Pick-to: 6.5
Change-Id: Ic89cbd3b6e98b4fc9561b0e63b5fab4886a1ec50
Reviewed-by: David Edmundson <davidedmundson@kde.org>
(cherry picked from commit a76bf824fcd1cc3789f0d3454a0423c0241d9718)
--- a/src/client/qwaylanddisplay.cpp
+++ b/src/client/qwaylanddisplay.cpp
@@ -379,11 +379,12 @@ QWaylandDisplay::~QWaylandDisplay(void)
#if QT_CONFIG(cursor)
qDeleteAll(mCursorThemes);
#endif
- if (mDisplay)
- wl_display_disconnect(mDisplay);
if (m_frameEventQueue)
wl_event_queue_destroy(m_frameEventQueue);
+
+ if (mDisplay)
+ wl_display_disconnect(mDisplay);
}
// Steps which is called just after constructor. This separates registry_global() out of the constructor
--
2.41.0
|
