diff options
Diffstat (limited to '0008-compositor-Do-not-trigger-invalid-destructors-when-h.patch')
| -rw-r--r-- | 0008-compositor-Do-not-trigger-invalid-destructors-when-h.patch | 53 |
1 files changed, 0 insertions, 53 deletions
diff --git a/0008-compositor-Do-not-trigger-invalid-destructors-when-h.patch b/0008-compositor-Do-not-trigger-invalid-destructors-when-h.patch deleted file mode 100644 index 424dab6971b7..000000000000 --- a/0008-compositor-Do-not-trigger-invalid-destructors-when-h.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 760828c01641d6900e2a63125a558df3b54b01b4 Mon Sep 17 00:00:00 2001 -From: "Miguel A. Vico" <mvicomoya@nvidia.com> -Date: Wed, 25 Sep 2019 11:28:13 -0700 -Subject: [PATCH 8/8] compositor: Do not trigger invalid destructors when - hotunplugging -X-NVConfidentiality: public - -When hotunplugging a display, the compositor will tear the top-level -wet_output object down, freeing its memory. - -However, destruction of the backend output might be delayed in certain -situations (e.g. destroying DRM output while in the middle of a page -flip). - -When the backend output is finally destroyed, it will trigger a -destruction callback previously added by the compositor, which point to -data belonging to the top-level wet_output object. - -In order to avoid access to invalid data when the backend output is -destroyed after the top-level wet_output object, remove the destruction -callback from the corresponding list before freeing the object. - -Signed-off-by: Miguel A Vico Moya <mvicomoya@nvidia.com> ---- - compositor/main.c | 12 ++++++++++-- - 1 file changed, 10 insertions(+), 2 deletions(-) - -diff --git a/compositor/main.c b/compositor/main.c -index bb6bd84b..2f253f40 100644 ---- a/compositor/main.c -+++ b/compositor/main.c -@@ -1860,8 +1860,16 @@ wet_output_from_weston_output(struct weston_output *base) - static void - wet_output_destroy(struct wet_output *output) - { -- if (output->output) -- weston_output_destroy(output->output); -+ if (output->output) { -+ /* output->output destruction may be deferred in some cases (see -+ * drm_output_destroy()), so we need to forcibly trigger the -+ * destruction callback now, or otherwise would later access -+ * data that we are about to free -+ */ -+ struct weston_output *save = output->output; -+ wet_output_handle_destroy(&output->output_destroy_listener, save); -+ weston_output_destroy(save); -+ } - - wl_list_remove(&output->link); - free(output); --- -2.21.0 - |