If the destroyed xwayland view is in transaction, it won't
be destroyed immediately. wlr_xwayland_surface then becomes
dangling pointer.
Closes#6605Closes#5884
Commit 152a559e replaced the view pointer in the inhibitor struct with a
pointer to the wlr_inhibitor for application inhibitors. But this was not
changed in the sway_idle_inhibit_v1_application_inhibitor_for_view function.
This caused a bug in the sway tree view where the application inhibitor is
always "none".
This commit makes sure the extents are kept up-to-date, fixes not
damaging the surface if its layer shell-specific state didn't change,
and adds a check if the layer shell-specific state didn't change but the
surface got mapped/unmapped, which could affect keyboard focus.
This prevents sway from extending the desktop to i.e. VR headsets, and makes
them available for DRM leasing.
Non-desktop wlr_outputs will be offered through the wlr_drm_lease_v1_manager
interface for client to lease.
Use fixed titlebar heights. The default height is calculated based on
font metrics for the configured font and current locale.
Some testing with titles with emoji and CJK characters (which are
substantially higher in my setup) shows that the titlebars retain their
initial value, text does shift up or down, and all titlebars always
remain aligned.
Also drop some also now-unecessary title_height calculations.
Makes also needed to be updated, since they should be positioned with
the same rules.
When a layer surface shrinks we need to damage the area it previously
occupied, but we don't know the location of all its subsurfaces in the
previous state, so instead damage a rectangle that encloses the entire
previous extent.
The xdg-decoration protocol allows clients to request whether they want
to use server side decorations or client side decorations. Currently,
sway ignores this and always enforces whatever the server is currently
set to. Although tiled clients cannot be allowed to set borders, there
is no harm in listening requests from floating clients. Sidenote: also
fix an unrelated style error.
There was some unused code-paths for rendering surfaces with an
arbitrary rotation applied. This was imported from rootston.
Since we don't have plans to make use of this, remove it.
render_surface_iterator previously deduced the clip box from an optional
container passed with render data. This causes problems when offsets in
view geometry need to be compensated for in the clip dimensions.
Instead, prepare the clip box in render_view_toplevels where the offsets
are being applied, and compensate for them immediately.
A similar compensation is applied to render_saved_view.
Closes: https://github.com/swaywm/sway/issues/6223
These coordinates contain the all-time accumulated buffer attach point,
which is a way to perform incremental client-side initiated movement of
windows, intended as a way to maintain logical window positioning while
compensating for layout changes such as folding in a left side panel.
This value is not useful for implementing this feature, and break things
if they ever become non-zero. Their inclusion in calculations also tend
to cause confusion.
Remove usage of these coordinates, removing the ability for clients to
move themselves. This may again be supported if a better API is made
available from wlroots.
When an application inhibited idle, a view pointer was stored and a
destroy listener was registered to the wlr inhibitor. As the wlr
inhibitor lives longer than the view, this lead to a dangling view
pointer between view unmap and inhibitor destroy.
Store a pointer to the wlr inhibitor instead of to the view, and look up
the view when needed, which may at any point be NULL. This also allows
for an inhibitor to remain functional if a surface is re-mapped.
If a surface is associated with a sway container, we limit the
destination box to the container dimensions.
Floating views and popups are exempt from this clipping.
In e0a94bee8d, it was believed that if the
container is being rendered, it must have an output.
This turned out not to be the case. When rendering a container, all its
children are rendered, even if the children is positioned off screen and
thus not having any output. This is the cause of the crash in #6061.
This commit introduces a null-check, which fixes#6061.
On server request, we need to send configure events to inform the client
of the new intended size. If the client changes size itself, sending a
configure event will only cause problems.
Use transaction_commit_dirty_client to distinguish between the two
transaction causes.
Currently, various floating-point expressions involving
the coordinates of borders, titlebars and content surfaces
are directly assigned to integers, and so they are rounded
towards zero.
This results in off-by-one distances between these elements
when the signs of their coordinates differ.
Fixed by wrapping these expressions with a call to
floor before the assignment.
When a container straddles multiple outputs, the title bar is only rendered
at the scale of the "effective" output. If the title bar straddles onto
another output with a different scale factor, it was drawn at the wrong size.
In this commit, we take into consideration the scale the title was rendered
at and scale it accordingly so that it appears at the right size on the other
outputs.
This fixes#6054.
To reproduce:
- Open a floating window and a popup that hangs over the bottom or right
- Move the window in the direction of the popup overhang
- The previous position of the popup is damaged, not the new one
Pending state is currently inlined directly in the container struct,
while the current state is in a state struct. A side-effect of this is
that it is not immediately obvious that pending double-buffered state is
accessed, nor is it obvious what state is double-buffered.
Instead, use the state struct for both current and pending.
The transaction system contains a necessary optimization where a popped
transaction is combined with later, similar transactions. This breaks
the chronological order of states, and can lead to desynchronized
geometries.
To fix this, we replace the queue with only 2 transactions: current and
pending. If a pending transaction exists, it is updated with new state
instead of creating additional transactions.
As we never have more than a single waiting transaction, we no longer
need the queue optimization that is causing problems.
Closes: https://github.com/swaywm/sway/issues/6012
Transactions currently wait for all configures to be acked, regardless
fo what they were sent to. This includes views that are hidden in tabbed
or stacked containers. If these views do not ack the configure in
response to a single frame callback, they can cause transaction
timeouts.
Check if a container is hidden before registering the configure serial
and saving any view buffers.
Closes: https://github.com/swaywm/sway/issues/6023
xdg_shell and xwayland handled geometry changes differently despite
needing mostly identical behavior. The xwayland implementation has been
changed to match that of xdg_shell.
The size of a tiled container cannot change in response to new buffer
sizes, so there is no need to commit a new transaction. Instead, simply
recenter the view with the new geometry, leaving the full transaction
flow for floating containers.
We need to use surface_x and surface_y when rendering and damaging saved
buffers as these compensate for views that have been centered due to
being smaller than their container.
Add them to the surface positions on the saved buffer so we have the
values from the time the buffer was saved.
wlr_output_configuration_head_v1_create normally fills out the head
"enabled" field to match the wlr_output state. We overwrite this to also
set the head as enabled if it is only turned off with DPMS.
However, in some cases we may not have a mode for this display, in which
case setting it as enabled will lead to a segfault later on. Therefore,
enabled conditional on the presence of a mode.
Instead of calling wlr_xdg_surface_for_each_popup and then
wlr_surface_for_each_surface, use the new for_each_popup_surface helper
introduced in [1] that does it in one go.
[1]: https://github.com/swaywm/wlroots/pull/2609
In i3, the workspace_layout command does not affect the
workspace layout. Instead, new workspace level containers
are wrapped in the desired layout and the workspace layout
always defaults to the output orientation.
Currently, when sway sends a configure with some geometry and the
client responds with a different geometry in a commit that acks that
configure, sway ignores the new size. Sway applies the surface
geometry it had requested to the container, not what was actually
committed, in the following transaction.
This change allows any client commit to change its surface geometry,
even if it is a response to a configure event.
Sway maintains a list of pending transactions, and tries to merge
consecutive transactions applying to the same views into one. Given
a pending transactions list on views {A, B, C} of:
A -> A' -> A'' -> B -> B' -> B''
Sway will collapse the transactions into just A'' -> B''. This works
fine when doing things like resizing views by their border. However,
when interactively resizing layouts like H[V[A B] C], we end up with
pending transaction lists like:
A -> B -> C -> A' -> B' -> C' -> A'' -> B'' -> C''
Previously, Sway would not be able to simplify this transaction list,
and execute many more transactions than would be necessary (the final
state is determined by {A'', B'', C''}).
After this commit, the transaction list gets simplified to A'' -> B'' ->
C'', resolving performance problems (that were particularly noticeable
with high-refresh-rate mice).
Fixes#5736.
Xwayland views are aware of their coordinates, so validating transaction
completions should take into account the reported coordinates of the
view. Prior to this commit they didn't, and matching dimensions would
suffice to validate the transaction.
Also introduced `transaction_notify_view_ready_immediately` to support
the fix from d0f7e0f without jumping through hoops to figure out the
geometry of an `xdg_shell` view.
Sway logical coordinates are doubles, but they get truncated to integers
when sent to Xwayland through `xcb_configure_window`. X11 apps will not
respond to duplicate configure requests (from their truncated point of
view) and cause transactions to time out.
Fixes#5035.
i3 shows indicators for the workspace-level pseudo-split, but Sway does
not, as of b977c02. This commit replaces the floating container check
with a call to `container_is_floating`, which has some more robust
checks in place.
Fixes#5699.
My primary issue was IntelliJ IDEA's code suggestion pop-up not returning focus
to the active editing window.
I have spent some time looking at the changes of @Xyene (#5398) and
@RyanDwyer (#2103). I think my proposed change maintains the status
quo for the most part whilst fixing my focus issue.
I have verified that @Xyene's fix for IntelliJ sub-menus still works.
I have done basic testing which consists of:
- Chrome
- IntelliJ IDEA 2020.2.1
- VSCode
- Alacritty
It seems to hold up. I at least didn't see any obvious errors.
Relates to #3007
Instead of listening to both transform and scale events, we can listen
to the commit event and use the new wlr_output_event_commit struct to
decide what to do.
This de-duplicates some of the work we were doing twice when an output
was re-configured.
Depends on [1].
[1]: https://github.com/swaywm/wlroots/pull/2315
Usually it should be enough to simply not grant a client's
minimize request, however some applications (Steam, fullscreen
games in Wine) don't wait for the compositor and minimize anyway,
getting them stuck in an unrecoverable state.
Restoring them immediately lead to heavy flickering when unfocused
on my test application (Earth Defense Force 5 via Steam), so it's
preferable to grant their request without actually minimizing and
then restoring them once they are in focus again.
Previously, we called output_disable prior to wlr_output_commit. This
mutates Sway's output state before the output commit actually succeeds.
This results in Sway's state getting out-of-sync with wlroots'.
An alternative fix [1] was to revert the changes made by output_disable
in case of failure. This is a little complicated. Instead, this patch
makes it so Sway's internal state is never changed before a successful
wlr_output commit.
We had two output flags: enabled and configured. However enabled was set
prior to the output becoming enabled, and was used to prevent the output
event handlers (specifically, the mode handler) from calling
apply_output_config again (infinite loop).
Rename enabled to enabling and use it exclusively for this purpose.
Rename configure to enabled, because that's what it really means.
[1]: https://github.com/swaywm/sway/pull/5521
Closes: https://github.com/swaywm/sway/issues/5483
If a client commits a new size on its own, we create a transaction for
the resize like any other. However, this involves sending a configure
and waiting for the ack, and wlroots will not send configure events when
there has been no change. This leads to transactions timing out.
Instead, just mark the view ready immediately by size when the client
is already ready, so that we avoid waiting for an ack that will never
come.
Closes: https://github.com/swaywm/sway/issues/5490
The centering logic needs to take borders, titlebars and CSDs into
account. Instead of using the main surface geometry, use the container
and view geometry, which account for this.
During the execution of a resize transaction, the buffer associated
with a view's surface is saved and reused until the client acknowledges
the resulting configure event.
However, only one the main buffer of the main surface was stored and
rendered, meaning that subsurfaces disappear during resize.
Iterate over all, store and render buffers from all surfaces in the view
to ensure that correct rendering is preserved.
This is necessary because some applications (e.g. Jetbrains IDEs)
represent their multi-level menus as unmanaged surfaces, and when
closing a submenu, the main menu should get input focus.
Closes#5347.
Instead of removing the destroy listeners in the output destroy, remove
them in the damage destroy handler. Fixes the following use after free:
==646625==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200017cab8 at pc 0x0000004f8f29 bp 0x7ffdf465ad30 sp 0x7ffdf465ad20
WRITE of size 8 at 0x61200017cab8 thread T0
#0 0x4f8f28 in wl_list_remove ../common/list.c:181
#1 0x43dd24 in handle_destroy ../sway/desktop/output.c:790
(`wl_list_remove(&output->damage_destroy.link);` here, 214e3030e1dce master branch)
#2 0x7f0e573a1c93 in wlr_signal_emit_safe ../util/signal.c:29
#3 0x7f0e57390954 in wlr_output_destroy ../types/wlr_output.c:365
#4 0x7f0e5735e37f in backend_destroy ../backend/x11/backend.c:128
#5 0x7f0e57348147 in wlr_backend_destroy ../backend/backend.c:47
#6 0x7f0e57356f75 in multi_backend_destroy ../backend/multi/backend.c:54
#7 0x7f0e5735710e in handle_display_destroy ../backend/multi/backend.c:107
#8 0x7f0e573f23e4 in wl_display_destroy (/lib64/libwayland-server.so.0+0x93e4)
#9 0x42f0b2 in server_fini ../sway/server.c:177
#10 0x42dd01 in main ../sway/main.c:414
#11 0x7f0e570f7041 in __libc_start_main (/lib64/libc.so.6+0x27041)
#12 0x40e3bd in _start (/opt/wayland/bin/sway+0x40e3bd)
0x61200017cab8 is located 120 bytes inside of 320-byte region [0x61200017ca40,0x61200017cb80)
freed by thread T0 here:
#0 0x7f0e57aa9357 in __interceptor_free (/lib64/libasan.so.6+0xb0357)
#1 0x7f0e5738b877 in wlr_output_damage_destroy ../types/wlr_output_damage.c:143
#2 0x7f0e5738b2b9 in output_handle_destroy ../types/wlr_output_damage.c:13
#3 0x7f0e573a1c93 in wlr_signal_emit_safe ../util/signal.c:29
#4 0x7f0e57390954 in wlr_output_destroy ../types/wlr_output.c:365
#5 0x7f0e5735e37f in backend_destroy ../backend/x11/backend.c:128
#6 0x7f0e57348147 in wlr_backend_destroy ../backend/backend.c:47
#7 0x7f0e57356f75 in multi_backend_destroy ../backend/multi/backend.c:54
#8 0x7f0e5735710e in handle_display_destroy ../backend/multi/backend.c:107
#9 0x7f0e573f23e4 in wl_display_destroy (/lib64/libwayland-server.so.0+0x93e4)
previously allocated by thread T0 here:
#0 0x7f0e57aa9887 in __interceptor_calloc (/lib64/libasan.so.6+0xb0887)
#1 0x7f0e5738b532 in wlr_output_damage_create ../types/wlr_output_damage.c:91
#2 0x43e4a7 in handle_new_output ../sway/desktop/output.c:875
#3 0x7f0e573a1c93 in wlr_signal_emit_safe ../util/signal.c:29
#4 0x7f0e57357261 in new_output_reemit ../backend/multi/backend.c:143
#5 0x7f0e573a1c93 in wlr_signal_emit_safe ../util/signal.c:29
#6 0x7f0e5736030a in wlr_x11_output_create ../backend/x11/output.c:253
#7 0x7f0e5735e309 in backend_start ../backend/x11/backend.c:113
#8 0x7f0e573480fb in wlr_backend_start ../backend/backend.c:36
#9 0x7f0e57356e61 in multi_backend_start ../backend/multi/backend.c:31
#10 0x7f0e573480fb in wlr_backend_start ../backend/backend.c:36
#11 0x42f4ba in server_start ../sway/server.c:205
#12 0x42dbd7 in main ../sway/main.c:394
#13 0x7f0e570f7041 in __libc_start_main (/lib64/libc.so.6+0x27041)
Fixes#5158
With these changes, sway will respect positive exclusive zones of layer
surfaces anchored to one or three sides.
This matches the protocol, which states that a positive exclusive zone
should be respected, "if the surface is anchored to one edge or an
edge and both perpendicular edges". If the surfaces is "anchored to
only two perpendicular edges (a corner), anchored to only two
parallel edges or anchored to all edges a positive value will be
treated the same as zero".
apply_output_config will call output_enable if necessary.
This fixes a lone wlr_output_enable call (without a matching
wlr_output_commit call) which was a no-op.
This fixes the following crash:
#0 0x00007f7daac3af25 in raise () at /usr/lib/libc.so.6
#1 0x00007f7daac24897 in abort () at /usr/lib/libc.so.6
#2 0x00007f7daac24767 in _nl_load_domain.cold () at /usr/lib/libc.so.6
#3 0x00007f7daac33526 in () at /usr/lib/libc.so.6
#4 0x0000555bfbc35029 in seat_set_focus_layer (seat=0x555bfd76d860, layer=0x555bfdda2ff0)
at ../sway/input/seat.c:1164
__PRETTY_FUNCTION__ = "seat_set_focus_layer"
__PRETTY_FUNCTION__ = "seat_set_focus_layer"
#5 0x0000555bfbc35029 in seat_set_focus_layer (seat=seat@entry=0x555bfd76d860, layer=0x555bfdda2ff0)
at ../sway/input/seat.c:1164
__PRETTY_FUNCTION__ = "seat_set_focus_layer"
#6 0x0000555bfbc25899 in handle_output_destroy (listener=0x555bfdb90688, data=<optimized out>)
at ../sway/desktop/layer_shell.c:263
layer = 0x555bfdd6b040
sway_layer = 0x555bfdb90610
seat = 0x555bfd76d860
client = 0x555bfdb76d70
set_focus = <optimized out>
#7 0x0000555bfbc5b669 in wl_signal_emit (data=0x555bfd795930, signal=0x555bfd795ae0)
at /usr/include/wayland-server-core.h:472
l = <optimized out>
next = 0x555bfdb6a3e8
__PRETTY_FUNCTION__ = "output_disable"
index = <optimized out>
#8 0x0000555bfbc5b669 in output_disable (output=output@entry=0x555bfd795930)
at ../sway/tree/output.c:263
__PRETTY_FUNCTION__ = "output_disable"
index = <optimized out>
#9 0x0000555bfbc3b890 in apply_output_config (oc=0x555bfd7d73d0, output=output@entry=0x555bfd795930)
at ../sway/config/output.c:321
wlr_output = 0x555bfd7afaf0
scale = <optimized out>
output_box = <optimized out>
#10 0x0000555bfbc28309 in handle_output_manager_apply
(listener=0x555bfbc7f148 <server+488>, data=0x555bfdca6eb0) at ../sway/desktop/output.c:936
wlr_output = <optimized out>
output = 0x555bfd795930
oc = <optimized out>
server = 0x555bfbc7ef60 <server>
config = 0x555bfdca6eb0
config_head = 0x555bfdb79350
ok = true
#11 0x00007f7dab4fbf7c in wlr_signal_emit_safe (signal=<optimized out>, data=0x555bfdca6eb0)
at ../subprojects/wlroots/util/signal.c:29
pos = 0x555bfbc7f148 <server+488>
l = 0x555bfbc7f148 <server+488>
cursor =
{link = {prev = 0x555bfbc7f148 <server+488>, next = 0x7fff238a8390}, notify = 0x7f7dab4fbef0 <handle_noop>}
end =
{link = {prev = 0x7fff238a8370, next = 0x555bfd7419f8}, notify = 0x7f7dab4fbef0 <handle_noop>}
#12 0x00007f7daa45469a in ffi_call_unix64 () at /usr/lib/libffi.so.6
#13 0x00007f7daa453fb6 in ffi_call () at /usr/lib/libffi.so.6
#14 0x00007f7daae6f82f in () at /usr/lib/libwayland-server.so.0
#15 0x00007f7daae6c193 in () at /usr/lib/libwayland-server.so.0
#16 0x00007f7daae6d7f2 in wl_event_loop_dispatch () at /usr/lib/libwayland-server.so.0
#17 0x00007f7daae6c39c in wl_display_run () at /usr/lib/libwayland-server.so.0
This crash happens because focus can only be set on mapped surfaces.
This fixes a memory leak of oc (the output config) in handle_new_output.
Output configs returned from find_output_config are not stored and need
to be freed after use.
Two changes were made:
- Bind the texture before glTexParameteri
- Set the scaling filter before each wlr_render_texture_with_matrix call
Logging in wlroots allows to check that the scaling filter is properly
set prior to rendering.
Fixes: 6968fb3123 ("add scale_filter output config option")
Closes: https://github.com/swaywm/sway/issues/4798
This adds a check to make it so the indicator is only rendered on views
with a parent, which floating views do not. Since floating views do not
have a parent, the workspace layout was being incorrectly used to
determine whether to show the split indicator previously. This has no
impact on floating containers and a view within a floating container
will still have indicators rendered appropriately.
In case xcb-iccm is not installed on the system, size_hints will be
null. Handle this as if the get_constraints functions was not
implemented and return the defaults.
Fixes#4870
When arranging layer-shell layers, verify that the currently focused
layer, if any, for each seat is still keyboard interactive. If the layer
is no longer keyboard interactive and there is not a keyboard
interactive overlay or top layer to change the focus to, refocus the
focus inactive node for the seat.
When many surfaces are created, sway can run out of file descriptors,
making wl_event_loop_add_timer (which creates a timerfd) fail and
return NULL. This patch posts a "no memory" error when that is the case,
and only removes the timer if it was created.
(Why "no memory"? It is not easy to distinguish between failures due to
running out of memory and failures due to running out of file
descriptors. Also, using the newer `wl_client_post_implementation_error`
function would lead to an increased version requirement for the
libwayland-server dependency.)
If a layer is focused by any seat, it needs to be unfocused on unmap. If
the unmap was due to an output being disabled, there would not be a
sway_output and unmap would do an early return. This results in a
use-after-free if the layer was focused by any seat prior to being
unmapped. This change just moves the refocusing code above the early
returns.
Repaint scheduling delays output render and frame done events from
output frame events, and block idle frame events from being scheduled in
between output frame done and output render in this period of time.
If a surface is committed after its frame done event, but before output
render, idle frame requests will be blocked, and the surface relies on
the upcoming render to schedule a frame.
If when the repaint timer expires, output render is deemed unnecessary,
no frame will be scheduled. This can lead to surfaces never having their
frame callbacks fire.
To fix this, we store that a surface has requested a frame in
surface_needs_frame. When the repaint expires, if no render is deemed
necessary, we check this flag and schedule an idle frame.
Fixes#4768
max_render_time can be set on output, view, or both. However, if only
applied to the output, send_frame_done_iterator would erroneously send
frame_done immediately, ignoring the output max_render_time. As
damage_handle_frame processed max_render_time correctly, idle frames
would be blocked in anticipation of the delay that was meant to happen.
Without the delay, frame events would be dispatched during the idle
frame block, and some clients would never receive the frame done events
they had requested, at least not until something else actively drove
another render.
Respecting both view and output max_render_time in
send_frame_done_iterator ensures that the frame events are always
correctly delayed.
Fixes#4756
It's possible for the output to be disconnected in just the right moment
for wlr_output to be NULL in the repaint handler, causing a crash. This
check fixes that crash.
Previously, Xwayland windows did not have size_constraints implemented,
resulting in the window being resizable. This implements the constraints
through the X11 size hints supplied by the window itself.
Calling wlr_output_manager_v1_set_configuration with an enabled output
and a NULL mode is incorrect if the output doesn't support modes.
When DPMS'ing an output, wlr_output_enable(output, false) is called.
This de-allocates the CRTC and sets wlr_output.current_mode to NULL.
Because we mark DPMS'ed outputs as enabled, we also need to provide a
correct output mode. Add a field to sway_output to hold the current
mode.
Closes: https://github.com/swaywm/wlroots/issues/1867
When applying config, value mode->refresh is mHz; convert it to Hz before
assigning it to the temporary output config. oc->refresh_rate will
be converted back to mHz in set_mode function.
Fix debug log printing GHz instead of Hz.
When changing a surface from managed to unmanaged in handle_map(), the
call to handle_destroy(.., view) causes the sway_xwayland_view pointed
to by the untyped wlr_xwayland_surface.data field to become invalid
garbage, yet the untyped wlr_xwayland_surface.data continues to point
at it. In particular: view_get_*(view_from_wlr_surface(..)), even
with appropriate NULL checking, will crash sway when this codepath is
exercised (reliable test case: drop-down menus in Google Earth).
Popups are positioned relative to local surface coordinates of the
parent surface. There's no need to consider values set with
xdg_surface.set_window_geometry for parent surfaces.
Sometimes when using direct scan-out, some flickering between the
fullscreen app and the regular desktop could be seen.
This happened because we called wlr_output_attach_render and then
wlr_output_attach_buffer for direct scan-out. wlr_output_attach_render
makes the OpenGL context current but also attaches the OpenGL buffer to
the primary plane apparently (all of this happens inside
eglMakeCurrent).
This patch moves the scan-out logic outside of output_render, before
wlr_output_attach_render. This lines it up with rootston's
implementation. This also makes more sense since no rendering is
involved when using direct scan-out.
Sorry about that, I should've tested this with more clients. The new
code has been tested with mpv and a GLFW demo.
Focused layers are not cleared when destroyed, they are cleared on unmap.
Giving focus to an unmapped layer surface is (1) incorrect and (2) triggers a
use-after-free.
Closes: https://github.com/swaywm/sway/issues/4517
The documentation for wayland-server.h says:
> Use of this header file is discouraged. Prefer including
> wayland-server-core.h instead, which does not include the server protocol
> header and as such only defines the library PI, excluding the deprecated API
> below.
Replacing wayland-server.h with wayland-server-core.h allows us to drop the
WL_HIDE_DEPRECATED declaration.
This commit si similar to wlroots' ca45f4490ccc ("Remove all wayland-server.h
includes").
handle_destroy would mark the output es being destroyed and commit the
transaction. Committing the transaction results in the output being
freed, the output manager can not retrieve the server reference
afterwards, resulting in the following use-after-free:
==22746==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000017088 at pc 0x560c1ac17136 bp 0x7ffeab146f20 sp 0x7ffeab146f10
READ of size 8 at 0x614000017088 thread T0
#0 0x560c1ac17135 in handle_destroy ../sway/desktop/output.c:566
#1 0x7f38af69330e in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
#2 0x7f38af5d3dfc in drm_connector_cleanup ../subprojects/wlroots/backend/drm/drm.c:1448
#3 0x7f38af5d2058 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1240
#4 0x7f38af5c6a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135
#5 0x7f38af69330e in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
#6 0x7f38af5e827a in udev_event ../subprojects/wlroots/backend/session/session.c:52
#7 0x7f38aef5d7f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1)
#8 0x7f38aef5c39b in wl_display_run (/usr/lib/libwayland-server.so.0+0x939b)
#9 0x560c1ac0afbe in server_run ../sway/server.c:225
#10 0x560c1ac09382 in main ../sway/main.c:397
#11 0x7f38aed35ce2 in __libc_start_main (/usr/lib/libc.so.6+0x23ce2)
#12 0x560c1abea10d in _start (/usr/local/bin/sway+0x3910d)
0x614000017088 is located 72 bytes inside of 432-byte region [0x614000017040,0x6140000171f0)
freed by thread T0 here:
#0 0x7f38af82df89 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:66
#1 0x560c1acbd1ed in output_destroy ../sway/tree/output.c:243
#2 0x560c1ac23ce5 in transaction_destroy ../sway/desktop/transaction.c:66
#3 0x560c1ac26b71 in transaction_progress_queue ../sway/desktop/transaction.c:348
#4 0x560c1ac284ca in transaction_commit_dirty ../sway/desktop/transaction.c:539
#5 0x560c1ac17110 in handle_destroy ../sway/desktop/output.c:564
#6 0x7f38af69330e in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
#7 0x7f38af5d3dfc in drm_connector_cleanup ../subprojects/wlroots/backend/drm/drm.c:1448
#8 0x7f38af5d2058 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1240
#9 0x7f38af5c6a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135
#10 0x7f38af69330e in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
#11 0x7f38af5e827a in udev_event ../subprojects/wlroots/backend/session/session.c:52
#12 0x7f38aef5d7f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1)
previously allocated by thread T0 here:
#0 0x7f38af82e5a1 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:95
#1 0x560c1acbc228 in output_create ../sway/tree/output.c:91
#2 0x560c1ac17ba2 in handle_new_output ../sway/desktop/output.c:656
#3 0x7f38af69330e in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
#4 0x7f38af5e4ce8 in new_output_reemit ../subprojects/wlroots/backend/multi/backend.c:143
#5 0x7f38af69330e in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
#6 0x7f38af5d26d4 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1294
#7 0x7f38af5c6a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135
#8 0x7f38af69330e in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
#9 0x7f38af5e827a in udev_event ../subprojects/wlroots/backend/session/session.c:52
#10 0x7f38aef5d7f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1)
SUMMARY: AddressSanitizer: heap-use-after-free ../sway/desktop/output.c:566 in handle_destroy
Shadow bytes around the buggy address:
0x0c287fffadc0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c287fffadd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c287fffade0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c287fffadf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c287fffae00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c287fffae10: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c287fffae20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c287fffae30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
0x0c287fffae40: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c287fffae50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c287fffae60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Retrieve the reference before the output is destroyed and update the
output_management state with the saved reference.
David Rosca
Simon Ser
Tassilo Horn
Bartel Sielski
Kirill Primak
Simon Zeni
Tudor Brindus
Hugo Osvaldo Barrera
Ronan Pigott
Dudemanguy
Tobias Langendorf
Kenny Levinsen
fwsmit
Elyes HAOUAS
Quantum
Dimitris Triantafyllidis
Tadeo Kondrak
Manuel Stoeckl
Vlad Pănăzan
John Mako
BrassyPanache
Antonin Décimo
Andri Yngvason
Isaac Freund
Kalyan Sriram
Damien Tardy-Panis
Martin Michlmayr
David96
Rouven Czerwinski
Leon Plickat
Brian Ashworth
Jason
Ivan Molodetskikh
Danilo Spinella
A. M. Joseph
Drew DeVault
Sebastian Krzyszkowiak
asdfjkluiop
Dark
Ilia Bozhinov
Josef Gajdusek
murray
Moelf