1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
|
From 760828c01641d6900e2a63125a558df3b54b01b4 Mon Sep 17 00:00:00 2001
From: "Miguel A. Vico" <mvicomoya@nvidia.com>
Date: Wed, 25 Sep 2019 11:28:13 -0700
Subject: [PATCH 8/8] compositor: Do not trigger invalid destructors when
hotunplugging
X-NVConfidentiality: public
When hotunplugging a display, the compositor will tear the top-level
wet_output object down, freeing its memory.
However, destruction of the backend output might be delayed in certain
situations (e.g. destroying DRM output while in the middle of a page
flip).
When the backend output is finally destroyed, it will trigger a
destruction callback previously added by the compositor, which point to
data belonging to the top-level wet_output object.
In order to avoid access to invalid data when the backend output is
destroyed after the top-level wet_output object, remove the destruction
callback from the corresponding list before freeing the object.
Signed-off-by: Miguel A Vico Moya <mvicomoya@nvidia.com>
---
compositor/main.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/compositor/main.c b/compositor/main.c
index bb6bd84b..2f253f40 100644
--- a/compositor/main.c
+++ b/compositor/main.c
@@ -1860,8 +1860,16 @@ wet_output_from_weston_output(struct weston_output *base)
static void
wet_output_destroy(struct wet_output *output)
{
- if (output->output)
- weston_output_destroy(output->output);
+ if (output->output) {
+ /* output->output destruction may be deferred in some cases (see
+ * drm_output_destroy()), so we need to forcibly trigger the
+ * destruction callback now, or otherwise would later access
+ * data that we are about to free
+ */
+ struct weston_output *save = output->output;
+ wet_output_handle_destroy(&output->output_destroy_listener, save);
+ weston_output_destroy(save);
+ }
wl_list_remove(&output->link);
free(output);
--
2.21.0
|