yukijoou/kwin
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix DrmOutput sometimes being freed with a pending pageflip, often when waking from sleep.

Browse source 
It is possible for updateOutputs to be called when a pageflip is pending.
Freeing a DrmOutput with a pending pageflip is not allowed (see ~DrmOutput assert - the page flip handler will be called on the freed memory, possibly leading to use-after-free).
This works around the problem by delaying the destruction with teardown().

BUG: 422460
This commit is contained in:
Andreas Haratzis 2020-07-05 23:36:03 -07:00
parent 9e1bb1f130
commit 6c9026628c
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
plugins/platforms/drm/drm_backend.cpp
View file

@ -519,7 +519,11 @@ bool DrmBackend::updateOutputs()
emit screensQueried(); emit screensQueried();
} }
qDeleteAll(removedOutputs); for(DrmOutput* removedOutput : removedOutputs) {
removedOutput->teardown();
removedOutput->m_crtc = nullptr;
removedOutput->m_conn = nullptr;
}
qDeleteAll(oldConnectors); qDeleteAll(oldConnectors);
qDeleteAll(oldCrtcs); qDeleteAll(oldCrtcs);
return true; return true;