From fffa1908af47d7cb1691425a0b6d9dccb01f1365 Mon Sep 17 00:00:00 2001 From: Simon Ser Date: Tue, 20 Jun 2023 23:05:25 +0200 Subject: [PATCH] backend/drm: fix libliftoff_plane double-free Destroying the liftoff_device invalidates all of the liftoff_planes. Destroy the liftoff_planes before the liftoff_device to fix this. --- backend/drm/drm.c | 3 --- backend/drm/libliftoff.c | 5 +++++ 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/backend/drm/drm.c b/backend/drm/drm.c index 13bcb9d8..22bc6681 100644 --- a/backend/drm/drm.c +++ b/backend/drm/drm.c @@ -323,9 +323,6 @@ void finish_drm_resources(struct wlr_drm_backend *drm) { for (size_t i = 0; i < drm->num_planes; ++i) { struct wlr_drm_plane *plane = &drm->planes[i]; wlr_drm_format_set_finish(&plane->formats); -#if HAVE_LIBLIFTOFF - liftoff_plane_destroy(plane->liftoff); -#endif } free(drm->planes); diff --git a/backend/drm/libliftoff.c b/backend/drm/libliftoff.c index 80410f43..7b2983bc 100644 --- a/backend/drm/libliftoff.c +++ b/backend/drm/libliftoff.c @@ -109,6 +109,11 @@ static void finish(struct wlr_drm_backend *drm) { liftoff_output_destroy(crtc->liftoff); } + for (size_t i = 0; i < drm->num_planes; i++) { + struct wlr_drm_plane *plane = &drm->planes[i]; + liftoff_plane_destroy(plane->liftoff); + } + liftoff_device_destroy(drm->liftoff); }