Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

split overlay layer and add all input device #1

Closed
wants to merge 1 commit into from

Conversation

Ongy
Copy link

@Ongy Ongy commented Jan 26, 2018

I split the overlay layer into an explicit locking layer and an
explicit input area layer.
This avoids ambiguous z-order for applications that should have a well
defined order.
I also added intended usecases to the documentation. Those are mainly
to set up for discussion.
It would be beneficial if everyone has a simliar model of how this
protocol should be used, so these should be informational.

I also added an "all" flag to input devices. This is intended for
session locking tools, to be able to lock all input, without having to
be updated for the mos current protocol spec with newer input devices.

I split the overlay layer into an explicit locking layer and an
explicit input area layer.
This avoids ambiguous z-order for applications that should have a well
defined order.
I also added intended usecases to the documentation. Those are mainly
to set up for discussion.
It would be beneficial if everyone has a simliar model of how this
protocol should be used, so these should be informational.

I also added an "all" flag to input devices. This is intended for
session locking tools, to be able to lock all input, without having to
be updated for the mos current protocol spec with newer input devices.
@emersion
Copy link
Owner

ping @SirCmpwn

</description>

<entry name="background" value="0"/>
<entry name="bottom" value="1"/>
<entry name="top" value="2"/>
<entry name="overlay" value="3"/>
<entry name="locking" value="3"/>

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

locking isn't necessarily the only purpose of overlay

The input layer is intended for on-screen keyboards. On touch-only
devices those may have to be displayed above the locker to provide
password based authentication.
This is also explicitly above fullscrened applications.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure about this but I'm leaning towards being on board with it

@ddevault
Copy link

I think you should find ways to describe each layer's purpose without resorting to specific examples. I can come up with many examples for software in each layer that doesn't match the examples you've given.

@emersion
Copy link
Owner

I agree. I'm still not sure how to solve z-index conflicts though. Maybe keep overlay and add a new layer?

@ddevault
Copy link

Let me stew on it for a bit.

@Ongy
Copy link
Author

Ongy commented Jan 26, 2018

Thinking about this a bit more, what do you think about removing screenlockers from the suggested users of surface layers?

We can specify that they should be between top and overlay (or overlay and input/accessability) to make sure it's positioned correctly (in terms of z-order) with applications for surface-layers.

This would also solve an issue I currently have with exclusive input in surface layers.
Should they get priority over the compositor consuming events?
I for example would prefer screenlockers to be able to block tty-switching, but I wouldn't expect normal applications to be able to do that.

@ddevault
Copy link

Screen lockers should not be able to block tty switching. Still stewing on the approach.

@Ongy
Copy link
Author

Ongy commented Jan 26, 2018

Screen lockers should not be able to block tty switching.

I disagree. That makes the difference between a session and a system locker.
And I would very much like to have system locking support. Lack of that has been one of my annoyances in the X environment.
I do see a security/permission situation here and would probably only allow it, if a root owned config file permits it.

But the point about compositor event consumption still stands.
The same general problem exists for workspace switching, or if someone implements something like "hot corners" where some action is triggered by moving the pointer into a specific area.
But this may not be locking specific, so it may make sense to just add a priority kind of thing in surface layers.

@ddevault
Copy link

Well, the protocol specifies such interactions to be compositor defined and I think wlroots would be flexible enough. You're welcome to make waymonad behave that way.

The same general problem exists for workspace switching, or if someone implements something like "hot corners" where some action is triggered by moving the pointer into a specific area.

What's the problem?

@Ongy
Copy link
Author

Ongy commented Jan 26, 2018

Mainly that I'd have to guess whether an applicatoin is supposed to have priority over the compositor consuming events or not. But then again, I'm not sure there is an actual use case where an application would request exclusive input without expecting to block things.

@ddevault
Copy link

ddevault commented Feb 3, 2018

Here's how I want to resolve z-ordering:

  • Keep the original layers defined as they were
  • Add a namespace string which clients can use to categorize themselves, e.g. "tray" or "lock-screen"
  • Let users configure z-ordering based on namespace, and add sensible defaults as we see what kinds of namespaces shake out in practice
  • Always render popups at z = max(parent surface's layer + 1, shell surfaces layer + 1)

emersion pushed a commit that referenced this pull request Feb 16, 2018
Wrap wl_resource_get_user_data into safer helper functions (for xdg-shell stable too)
@emersion emersion closed this Feb 21, 2018
emersion pushed a commit that referenced this pull request Mar 22, 2018
==12021==ERROR: AddressSanitizer: heap-use-after-free on address 0x617000015698 at pc 0x7f1a9abe1c09 bp 0x7ffe9068f6b0 sp 0x7ffe9068f6a0
WRITE of size 4 at 0x617000015698 thread T0
    #0 0x7f1a9abe1c08 in pointer_handle_leave ../backend/wayland/wl_seat.c:40
    #1 0x7f1a96ae7d1d in ffi_call_unix64 (/lib64/libffi.so.6+0x5d1d)
    #2 0x7f1a96ae768e in ffi_call (/lib64/libffi.so.6+0x568e)
    swaywm#3 0x7f1a988e0d8a  (/lib64/libwayland-client.so.0+0x8d8a)
    swaywm#4 0x7f1a988dd927  (/lib64/libwayland-client.so.0+0x5927)
    swaywm#5 0x7f1a988debe3 in wl_display_dispatch_queue_pending (/lib64/libwayland-client.so.0+0x6be3)
    swaywm#6 0x7f1a9abdd6d6 in dispatch_events ../backend/wayland/backend.c:28
    swaywm#7 0x7f1a9a968c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11)
    swaywm#8 0x7f1a9a967449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449)
    swaywm#9 0x418dff in main ../rootston/main.c:81
    swaywm#10 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
    swaywm#11 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)

0x617000015698 is located 664 bytes inside of 696-byte region [0x617000015400,0x6170000156b8)
freed by thread T0 here:
    #0 0x7f1a9af754b8 in __interceptor_free (/lib64/libasan.so.4+0xde4b8)
    #1 0x7f1a9abe01ee in wlr_wl_output_destroy ../backend/wayland/output.c:194
    #2 0x7f1a9ac12918 in wlr_output_destroy ../types/wlr_output.c:299
    swaywm#3 0x7f1a9abe061b in xdg_toplevel_handle_close ../backend/wayland/output.c:255
    swaywm#4 0x7f1a96ae7d1d in ffi_call_unix64 (/lib64/libffi.so.6+0x5d1d)
    swaywm#5 0x7f1a96ae768e in ffi_call (/lib64/libffi.so.6+0x568e)
    swaywm#6 0x7f1a988e0d8a  (/lib64/libwayland-client.so.0+0x8d8a)
    swaywm#7 0x7f1a988dd927  (/lib64/libwayland-client.so.0+0x5927)
    swaywm#8 0x7f1a988debe3 in wl_display_dispatch_queue_pending (/lib64/libwayland-client.so.0+0x6be3)
    swaywm#9 0x7f1a9abdd6d6 in dispatch_events ../backend/wayland/backend.c:28
    swaywm#10 0x7f1a9a968c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11)
    swaywm#11 0x7f1a9a967449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449)
    swaywm#12 0x418dff in main ../rootston/main.c:81
    swaywm#13 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
    swaywm#14 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)

previously allocated by thread T0 here:
    #0 0x7f1a9af75a38 in __interceptor_calloc (/lib64/libasan.so.4+0xdea38)
    #1 0x7f1a9abe0703 in wlr_wl_output_create ../backend/wayland/output.c:272
    #2 0x7f1a9abdd8eb in wlr_wl_backend_start ../backend/wayland/backend.c:55
    swaywm#3 0x7f1a9abbeb49 in wlr_backend_start ../backend/backend.c:28
    swaywm#4 0x7f1a9abd8ce1 in multi_backend_start ../backend/multi/backend.c:24
    swaywm#5 0x7f1a9abbeb49 in wlr_backend_start ../backend/backend.c:28
    swaywm#6 0x418c32 in main ../rootston/main.c:58
    swaywm#7 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
    swaywm#8 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)
emersion pushed a commit that referenced this pull request Mar 27, 2018
==32557==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000425f96 bp 0x7fff8ac19de0 sp 0x7fff8ac19d20 T0)
==32557==The signal is caused by a READ memory access.
==32557==Hint: address points to the zero page.
    #0 0x425f95 in roots_seat_set_focus ../rootston/seat.c:737
    #1 0x40bcd6 in roots_cursor_press_button ../rootston/cursor.c:272
    #2 0x40c1f7 in roots_cursor_handle_button ../rootston/cursor.c:298
    swaywm#3 0x42179b in handle_cursor_button ../rootston/seat.c:58
    swaywm#4 0x7f1651062367 in wlr_signal_emit_safe ../util/signal.c:29
    swaywm#5 0x7f165101b532 in handle_pointer_button ../types/wlr_cursor.c:344
    swaywm#6 0x7f1651062367 in wlr_signal_emit_safe ../util/signal.c:29
    swaywm#7 0x7f1650ff633b in handle_pointer_button ../backend/libinput/pointer.c:85
    swaywm#8 0x7f1650ff5291 in wlr_libinput_event ../backend/libinput/events.c:215
    swaywm#9 0x7f1650ff3990 in wlr_libinput_readable ../backend/libinput/backend.c:35
    swaywm#10 0x7f1650d88c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11)
    swaywm#11 0x7f1650d87449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449)
    swaywm#12 0x418e90 in main ../rootston/main.c:81
    swaywm#13 0x7f164ff7ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
    swaywm#14 0x405829 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x405829)

introduced by swaywm#680
emersion pushed a commit that referenced this pull request Apr 20, 2018
When e.g. running rootston under X11 it would otherwise crash when
closing rootston like:

    #0  0x00007f0197da7327 in wl_list_remove () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
    #1  0x000056306fcee7fb in handle_destroy (listener=0x5630723a2948, data=0x5630723a5d20) at ../rootston/layer_shell.c:273
    #2  0x00007f019800a552 in wlr_signal_emit_safe (signal=0x5630723a5e30, data=0x5630723a5d20) at ../util/signal.c:29
    swaywm#3  0x00007f0197fef808 in layer_surface_destroy (surface=0x5630723a5d20) at ../types/wlr_layer_shell.c:169
    swaywm#4  0x00007f0197ff0001 in client_handle_destroy (resource=0x56307229c4c0) at ../types/wlr_layer_shell.c:371
    swaywm#5  0x00007f0197da2f30 in  () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
    swaywm#6  0x00007f0197da77f9 in  () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
    swaywm#7  0x00007f0197da301d in wl_client_destroy () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
    swaywm#8  0x00007f0197da30d8 in  () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
    swaywm#9  0x00007f0197da4c12 in wl_event_loop_dispatch () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
    swaywm#10 0x00007f0197da344a in wl_display_run () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
    swaywm#11 0x000056306fcef069 in main (argc=3, argv=0x7ffd22032528) at ../rootston/main.c:83

since the output_destroy got already removed in handle_output_destroy.
@Ongy Ongy deleted the surface_layers branch May 7, 2018 10:37
emersion pushed a commit that referenced this pull request Jun 25, 2018
seat->primary_election_source_destroy points to the source that just got
freed by the cancel.

==7843==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b0004269b0 at pc 0x7fb95bf4ccd0 bp 0x7ffd75013940 s
p 0x7ffd75013930
WRITE of size 8 at 0x60b0004269b0 thread T0
    #0 0x7fb95bf4cccf in wl_list_remove ../util/signal.c:55
    #1 0x7fb95bf3f4c6 in wlr_seat_set_primary_selection ../types/wlr_primary_selection.c:238
    #2 0x7fb95becb1a7 in xwm_handle_selection_event ../xwayland/selection/selection.c:124
    swaywm#3 0x7fb95bed2e5d in x11_event_handler ../xwayland/xwm.c:1139
    swaywm#4 0x7fb95c1bdf01 in wl_event_loop_dispatch src/event-loop.c:641
    swaywm#5 0x7fb95c1bc601 in wl_display_run src/wayland-server.c:1260
    swaywm#6 0x40a2f4 in main ../sway/main.c:433
    swaywm#7 0x7fb95b69718a in __libc_start_main (/lib64/libc.so.6+0x2318a)
    swaywm#8 0x40b749 in _start (/opt/wayland/bin/sway+0x40b749)

0x60b0004269b0 is located 64 bytes inside of 112-byte region [0x60b000426970,0x60b0004269e0)
freed by thread T0 here:
    #0 0x7fb95e0ad880 in __interceptor_free (/lib64/libasan.so.5+0xee880)
    #1 0x7fb95bf3f49e in wlr_seat_set_primary_selection ../types/wlr_primary_selection.c:236
    #2 0x7fb95becb1a7 in xwm_handle_selection_event ../xwayland/selection/selection.c:124
    swaywm#3 0x7fb95bed2e5d in x11_event_handler ../xwayland/xwm.c:1139
    swaywm#4 0x7fb95c1bdf01 in wl_event_loop_dispatch src/event-loop.c:641

previously allocated by thread T0 here:
    #0 0x7fb95e0ade50 in calloc (/lib64/libasan.so.5+0xeee50)
    #1 0x7fb95bec7ad6 in xwm_selection_get_targets ../xwayland/selection/incoming.c:355
    #2 0x7fb95bec7ad6 in xwm_handle_selection_notify ../xwayland/selection/incoming.c:402
    swaywm#3 0x7fb95becb1a7 in xwm_handle_selection_event ../xwayland/selection/selection.c:124
    swaywm#4 0x7fb95bed2e5d in x11_event_handler ../xwayland/xwm.c:1139
    swaywm#5 0x7fb95c1bdf01 in wl_event_loop_dispatch src/event-loop.c:641

SUMMARY: AddressSanitizer: heap-use-after-free ../util/signal.c:55 in wl_list_remove
Shadow bytes around the buggy address:
  0x0c168007cce0: fd fd fd fa fa fa fa fa fa fa fa fa fd fd fd fd
  0x0c168007ccf0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c168007cd00: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c168007cd10: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c168007cd20: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fd fd
=>0x0c168007cd30: fd fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa
  0x0c168007cd40: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c168007cd50: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
  0x0c168007cd60: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
  0x0c168007cd70: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x0c168007cd80: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
emersion pushed a commit that referenced this pull request Jun 25, 2018
Happens when e.g. closing gimp.

==24039==ERROR: AddressSanitizer: heap-use-after-free on address 0x6150001a7a78 at pc 0x7f09b09f1bb2 bp 0x7ffcf0237bf0 sp 0x7ffcf0237be0
WRITE of size 8 at 0x6150001a7a78 thread T0
    #0 0x7f09b09f1bb1 in wl_list_remove ../util/signal.c:55
    #1 0x7f09b094cf03 in xwayland_surface_destroy ../xwayland/xwm.c:295
    #2 0x7f09b0950245 in xwm_handle_destroy_notify ../xwayland/xwm.c:717
    swaywm#3 0x7f09b095304a in x11_event_handler ../xwayland/xwm.c:1149
    swaywm#4 0x7f09b0c68f01 in wl_event_loop_dispatch src/event-loop.c:641
    swaywm#5 0x7f09b0c67601 in wl_display_run src/wayland-server.c:1260
    swaywm#6 0x40a2f4 in main ../sway/main.c:433
    swaywm#7 0x7f09b011018a in __libc_start_main (/lib64/libc.so.6+0x2318a)
    swaywm#8 0x40b749 in _start (/opt/wayland/bin/sway+0x40b749)

0x6150001a7a78 is located 120 bytes inside of 496-byte region [0x6150001a7a00,0x6150001a7bf0)
freed by thread T0 here:
    #0 0x7f09b2b58880 in __interceptor_free (/lib64/libasan.so.5+0xee880)
    #1 0x7f09b094d1a1 in xwayland_surface_destroy ../xwayland/xwm.c:315
    #2 0x7f09b0950245 in xwm_handle_destroy_notify ../xwayland/xwm.c:717
    swaywm#3 0x7f09b095304a in x11_event_handler ../xwayland/xwm.c:1149
    swaywm#4 0x7f09b0c68f01 in wl_event_loop_dispatch src/event-loop.c:641
    swaywm#5 0x7f09b0c67601 in wl_display_run src/wayland-server.c:1260
    swaywm#6 0x40a2f4 in main ../sway/main.c:433
    swaywm#7 0x7f09b011018a in __libc_start_main (/lib64/libc.so.6+0x2318a)
    swaywm#8 0x40b749 in _start (/opt/wayland/bin/sway+0x40b749)

previously allocated by thread T0 here:
    #0 0x7f09b2b58e50 in calloc (/lib64/libasan.so.5+0xeee50)
    #1 0x7f09b094b585 in xwayland_surface_create ../xwayland/xwm.c:119
    #2 0x7f09b0950151 in xwm_handle_create_notify ../xwayland/xwm.c:706
    swaywm#3 0x7f09b0953032 in x11_event_handler ../xwayland/xwm.c:1146
    swaywm#4 0x7f09b0c68f01 in wl_event_loop_dispatch src/event-loop.c:641
    swaywm#5 0x7f09b0c67601 in wl_display_run src/wayland-server.c:1260
    swaywm#6 0x40a2f4 in main ../sway/main.c:433
    swaywm#7 0x7f09b011018a in __libc_start_main (/lib64/libc.so.6+0x2318a)
    swaywm#8 0x40b749 in _start (/opt/wayland/bin/sway+0x40b749)
emersion pushed a commit that referenced this pull request Jun 25, 2018
popups have a link in parent's surface->popups list and needs
to be freed before:

==6902==ERROR: AddressSanitizer: heap-use-after-free on address 0x6120001a0300 at pc 0x7fc1447acb50 bp 0x7fffd396e680 sp 0x7fffd396e670
WRITE of size 8 at 0x6120001a0300 thread T0
    #0 0x7fc1447acb4f in wl_list_remove ../util/signal.c:55
    #1 0x7fc14477d206 in destroy_xdg_popup_v6 ../types/xdg_shell_v6/wlr_xdg_popup_v6.c:162
    #2 0x7fc1447816e0 in destroy_xdg_surface_v6 ../types/xdg_shell_v6/wlr_xdg_surface_v6.c:108
    swaywm#3 0x7fc144a1c025 in destroy_resource src/wayland-server.c:688
    swaywm#4 0x7fc144a1c091 in wl_resource_destroy src/wayland-server.c:705
    swaywm#5 0x7fc14477fd6f in xdg_client_v6_handle_resource_destroy ../types/xdg_shell_v6/wlr_xdg_shell_v6.c:72
    swaywm#6 0x7fc144a1c025 in destroy_resource src/wayland-server.c:688
    swaywm#7 0x7fc144a20851  (/lib64/libwayland-server.so.0+0xc851)
    swaywm#8 0x7fc144a20d92  (/lib64/libwayland-server.so.0+0xcd92)
    swaywm#9 0x7fc144a1c140 in wl_client_destroy src/wayland-server.c:847
    swaywm#10 0x7fc144a1c21c in destroy_client_with_error src/wayland-server.c:307
    swaywm#11 0x7fc144a1c21c in wl_client_connection_data src/wayland-server.c:330
    swaywm#12 0x7fc144a1df01 in wl_event_loop_dispatch src/event-loop.c:641
    swaywm#13 0x7fc144a1c601 in wl_display_run src/wayland-server.c:1260
    swaywm#14 0x40a2f4 in main ../sway/main.c:433
    swaywm#15 0x7fc143ef718a in __libc_start_main ../csu/libc-start.c:308
    swaywm#16 0x40b749 in _start (/opt/wayland/bin/sway+0x40b749)

0x6120001a0300 is located 64 bytes inside of 264-byte region [0x6120001a02c0,0x6120001a03c8)
freed by thread T0 here:
    #0 0x7fc14690d880 in __interceptor_free (/lib64/libasan.so.5+0xee880)
    #1 0x7fc1447acce8 in wlr_signal_emit_safe ../util/signal.c:29
    #2 0x7fc1447a3cac in surface_handle_resource_destroy ../types/wlr_surface.c:576
    swaywm#3 0x7fc144a1c025 in destroy_resource src/wayland-server.c:688

previously allocated by thread T0 here:
    #0 0x7fc14690de50 in calloc (/lib64/libasan.so.5+0xeee50)
    #1 0x7fc144781d38 in create_xdg_surface_v6 ../types/xdg_shell_v6/wlr_xdg_surface_v6.c:415
    #2 0x7fc14147503d in ffi_call_unix64 (/lib64/libffi.so.6+0x603d)

Alternative would be to have popups listen to the parent's surface
destroy event and remove themselves from the list at this point OR on
their own destroy, whichever happens first, but that seems more
complicated for little benefit.
emersion pushed a commit that referenced this pull request Jul 4, 2018
wl_resource_for_each_safe isn't safe to use here because it accesses
the list's head memory one last time at the end of the loop. Work
around this by breaking out early.

==19880==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d0000e6368 at pc 0x7fab68619de2 bp 0x7ffd5c91cee0 sp 0x7ffd5c91ced0
READ of size 8 at 0x60d0000e6368 thread T0
    #0 0x7fab68619de1 in wlr_seat_destroy ../types/seat/wlr_seat.c:179
    #1 0x7fab68619fb9 in handle_display_destroy ../types/seat/wlr_seat.c:196
    #2 0x7fab688e4f8f in wl_priv_signal_emit src/wayland-server.c:2024
    swaywm#3 0x7fab688e56ca in wl_display_destroy src/wayland-server.c:1092
    swaywm#4 0x40c11e in server_fini ../sway/server.c:138
    swaywm#5 0x40b1a8 in main ../sway/main.c:438
    swaywm#6 0x7fab67b5e18a in __libc_start_main ../csu/libc-start.c:308
    swaywm#7 0x409359 in _start (/opt/wayland/bin/sway+0x409359)

0x60d0000e6368 is located 24 bytes inside of 144-byte region [0x60d0000e6350,0x60d0000e63e0)
freed by thread T0 here:
    #0 0x7fab6a7d6880 in __interceptor_free (/lib64/libasan.so.5+0xee880)
    #1 0x7fab68619805 in seat_client_handle_resource_destroy ../types/seat/wlr_seat.c:97
    #2 0x7fab688e5025 in destroy_resource src/wayland-server.c:688

previously allocated by thread T0 here:
    #0 0x7fab6a7d6e50 in calloc (/lib64/libasan.so.5+0xeee50)
    #1 0x7fab686198df in seat_handle_bind ../types/seat/wlr_seat.c:127
    #2 0x7fab6530503d in ffi_call_unix64 (/lib64/libffi.so.6+0x603d)
emersion pushed a commit that referenced this pull request Jun 16, 2019
If an output is destroyed while an idle_done event is scheduled, it
results in the following Address Sanitizer Output:

==1469==ERROR: AddressSanitizer: heap-use-after-free on address 0x6170000bb668 at pc 0x7f49aaa0c348 bp 0x7ffed5da35b0 sp 0x7ffed5da35a0
WRITE of size 8 at 0x6170000bb668 thread T0
    #0 0x7f49aaa0c347 in schedule_done_handle_idle_timer ../subprojects/wlroots/types/wlr_output.c:265
    #1 0x7f49aa2f875b in wl_event_loop_dispatch_idle (/usr/lib/libwayland-server.so.0+0xa75b)
    #2 0x7f49aa2f8815 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa815)
    swaywm#3 0x7f49aa2f739b in wl_display_run (/usr/lib/libwayland-server.so.0+0x939b)
    swaywm#4 0x556622dadd51 in server_run ../sway/server.c:216
    swaywm#5 0x556622dac25d in main ../sway/main.c:397
    swaywm#6 0x7f49aa0d0ce2 in __libc_start_main (/usr/lib/libc.so.6+0x23ce2)
    swaywm#7 0x556622d8d09d in _start (/usr/local/bin/sway+0x3909d)

0x6170000bb668 is located 488 bytes inside of 672-byte region [0x6170000bb480,0x6170000bb720)
freed by thread T0 here:
    #0 0x7f49aabc8f89 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:66
    #1 0x7f49aa968fc2 in drm_connector_destroy ../subprojects/wlroots/backend/drm/drm.c:829
    #2 0x7f49aaa0cc52 in wlr_output_destroy ../subprojects/wlroots/types/wlr_output.c:357
    swaywm#3 0x7f49aa96d2e9 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1265
    swaywm#4 0x7f49aa961a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135
    swaywm#5 0x7f49aaa2e1e9 in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
    swaywm#6 0x7f49aa98319f in udev_event ../subprojects/wlroots/backend/session/session.c:52
    swaywm#7 0x7f49aa2f87f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1)

previously allocated by thread T0 here:
    #0 0x7f49aabc95a1 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:95
    #1 0x7f49aa96b7a2 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1114
    #2 0x7f49aa961a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135
    swaywm#3 0x7f49aaa2e1e9 in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
    swaywm#4 0x7f49aa98319f in udev_event ../subprojects/wlroots/backend/session/session.c:52
    swaywm#5 0x7f49aa2f87f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1)

SUMMARY: AddressSanitizer: heap-use-after-free ../subprojects/wlroots/types/wlr_output.c:265 in schedule_done_handle_idle_timer
Shadow bytes around the buggy address:
  0x0c2e8000f670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e8000f680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e8000f690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e8000f6a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e8000f6b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c2e8000f6c0: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
  0x0c2e8000f6d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e8000f6e0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e8000f6f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e8000f700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e8000f710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Remove the idle_done idle timer when the output is destroyed
emersion added a commit that referenced this pull request Nov 30, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:

    ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
    READ of size 8 at 0x614000000180 thread T0
        #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
        #1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
        #2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
        swaywm#3 0x7f88e21af274  (/lib64/libinput.so.10+0x28274)
        swaywm#4 0x7f88e21aff1d  (/lib64/libinput.so.10+0x28f1d)
        swaywm#5 0x7f88e219ddac  (/lib64/libinput.so.10+0x16dac)
        swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
        swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
        swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
        swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
        swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
        swaywm#11 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)
        swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
        swaywm#13 0x559fefb52385 in main ../main.c:67
        swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
        swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)

    0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
    freed by thread T0 here:
        #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
        #1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
        #2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
        swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
        swaywm#4 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)

    previously allocated by thread T0 here:
        #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
        #1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
        #2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
        swaywm#3 0x559fefb51ea6 in main ../main.c:20
        swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
emersion added a commit that referenced this pull request Dec 5, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:

    ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
    READ of size 8 at 0x614000000180 thread T0
        #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
        #1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
        #2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
        swaywm#3 0x7f88e21af274  (/lib64/libinput.so.10+0x28274)
        swaywm#4 0x7f88e21aff1d  (/lib64/libinput.so.10+0x28f1d)
        swaywm#5 0x7f88e219ddac  (/lib64/libinput.so.10+0x16dac)
        swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
        swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
        swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
        swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
        swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
        swaywm#11 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)
        swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
        swaywm#13 0x559fefb52385 in main ../main.c:67
        swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
        swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)

    0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
    freed by thread T0 here:
        #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
        #1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
        #2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
        swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
        swaywm#4 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)

    previously allocated by thread T0 here:
        #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
        #1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
        #2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
        swaywm#3 0x559fefb51ea6 in main ../main.c:20
        swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
emersion added a commit that referenced this pull request Jan 16, 2021
The GBM device needs to be destroyed after the EGL display.

    ==50931==ERROR: AddressSanitizer: SEGV on unknown address 0x7fe40a000049 (pc 0x7fe446121d30 bp 0x60400001bbd0 sp 0x7ffc99c774d0 T0)
    ==50931==The signal is caused by a READ memory access.
        #0 0x7fe446121d30  (/usr/lib/dri/radeonsi_dri.so+0x5f0d30)
        #1 0x7fe4474717bd  (/usr/lib/../lib/libEGL_mesa.so.0+0x177bd)
        #2 0x7fe4474677d9  (/usr/lib/../lib/libEGL_mesa.so.0+0xd7d9)
        swaywm#3 0x7fe44cca7b6f in wlr_egl_destroy ../subprojects/wlroots/render/egl.c:379
        swaywm#4 0x7fe44ccc2626 in gles2_destroy ../subprojects/wlroots/render/gles2/renderer.c:705
        swaywm#5 0x7fe44ccb5041 in wlr_renderer_destroy ../subprojects/wlroots/render/wlr_renderer.c:37
        swaywm#6 0x7fe44cd17850 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:296
        swaywm#7 0x7fe44ccca4de in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:48
        swaywm#8 0x7fe44cd11b21 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:58
        swaywm#9 0x7fe44cd125b0 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:125
        swaywm#10 0x7fe44c315e0e  (/usr/lib/libwayland-server.so.0+0x8e0e)
        swaywm#11 0x7fe44c3165a6 in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x95a6)
        swaywm#12 0x55a2c8870683 in server_fini ../sway/server.c:203
        swaywm#13 0x55a2c886cbf2 in main ../sway/main.c:436
        swaywm#14 0x7fe44b77c151 in __libc_start_main (/usr/lib/libc.so.6+0x28151)
        swaywm#15 0x55a2c883172d in _start (/home/simon/src/sway/build/sway/sway+0x33472d)
emersion added a commit that referenced this pull request Mar 16, 2021
The original motivation is the following crash:

    #0  0x00007f0ddeddeef5 in raise () at /usr/lib/libc.so.6
    #1  0x00007f0ddedc8862 in abort () at /usr/lib/libc.so.6
    #2  0x00007f0ddedc8747 in _nl_load_domain.cold () at /usr/lib/libc.so.6
    swaywm#3  0x00007f0ddedd7646 in  () at /usr/lib/libc.so.6
    swaywm#4  0x00007f0de033f8de in gles2_get_renderer_in_context (wlr_renderer=0x612000003640) at ../subprojects/wlroots/render/gles2/renderer.c:38
    swaywm#5  0x00007f0de0341675 in gles2_begin (wlr_renderer=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/gles2/renderer.c:186
    swaywm#6  0x00007f0de033b100 in wlr_renderer_begin (r=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/wlr_renderer.c:56
    swaywm#7  0x00007f0de03466ed in gles2_blit_dmabuf (wlr_renderer=0x612000003640, dst_attr=0x60b000150148, src_attr=0x7fff9f9bfde0) at ../subprojects/wlroots/render/gles2/renderer.c:591
    swaywm#8  0x00007f0de033d717 in wlr_renderer_blit_dmabuf (r=0x612000003640, dst=0x60b000150148, src=0x7fff9f9bfde0) at ../subprojects/wlroots/render/wlr_renderer.c:210
    swaywm#9  0x00007f0de04cbc3b in frame_handle_output_commit (listener=0x611000220bc8, data=0x7fff9f9c0050) at ../subprojects/wlroots/types/wlr_screencopy_v1.c:303

The GLES2 renderer assumes it'll have a wlr_buffer to render to.

Instead of accomodating for the edge-case of rendering without a
wlr_buffer, drop wlr_renderer_blit_dmabuf calls and instead use
wlr_renderer_bind_buffer just like the rest of the wlr_renderer users.
wlr_renderer_blit_dmabuf is now unused in wlroots.

The upside is that the new blit_dmabuf function in screencopy is
renderer-agnostic.
emersion added a commit that referenced this pull request Mar 16, 2021
The original motivation is the following crash:

    #0  0x00007f0ddeddeef5 in raise () at /usr/lib/libc.so.6
    #1  0x00007f0ddedc8862 in abort () at /usr/lib/libc.so.6
    #2  0x00007f0ddedc8747 in _nl_load_domain.cold () at /usr/lib/libc.so.6
    swaywm#3  0x00007f0ddedd7646 in  () at /usr/lib/libc.so.6
    swaywm#4  0x00007f0de033f8de in gles2_get_renderer_in_context (wlr_renderer=0x612000003640) at ../subprojects/wlroots/render/gles2/renderer.c:38
    swaywm#5  0x00007f0de0341675 in gles2_begin (wlr_renderer=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/gles2/renderer.c:186
    swaywm#6  0x00007f0de033b100 in wlr_renderer_begin (r=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/wlr_renderer.c:56
    swaywm#7  0x00007f0de03466ed in gles2_blit_dmabuf (wlr_renderer=0x612000003640, dst_attr=0x60b000150148, src_attr=0x7fff9f9bfde0) at ../subprojects/wlroots/render/gles2/renderer.c:591
    swaywm#8  0x00007f0de033d717 in wlr_renderer_blit_dmabuf (r=0x612000003640, dst=0x60b000150148, src=0x7fff9f9bfde0) at ../subprojects/wlroots/render/wlr_renderer.c:210
    swaywm#9  0x00007f0de04cbc3b in frame_handle_output_commit (listener=0x611000220bc8, data=0x7fff9f9c0050) at ../subprojects/wlroots/types/wlr_screencopy_v1.c:303

The GLES2 renderer assumes it'll have a wlr_buffer to render to.

Instead of accomodating for the edge-case of rendering without a
wlr_buffer, drop wlr_renderer_blit_dmabuf calls and instead use
wlr_renderer_bind_buffer just like the rest of the wlr_renderer users.
wlr_renderer_blit_dmabuf is now unused in wlroots.

The upside is that the new blit_dmabuf function in screencopy is
renderer-agnostic.
emersion added a commit that referenced this pull request Jul 8, 2021
[1] and [2] have introduced new wl_array usage in wlroots, but
contains a mistake: wl_array_for_each iterates over pointers to
the wl_array entries, not over entries themselves.

Fix all wl_array_for_each call sites. Name the variables "ptr"
to avoid confusion.

Found via ASan:

    ==148752==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x602000214111 in thread T0
        #0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
        #1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24
        #2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51
        swaywm#3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306
        swaywm#4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57
        swaywm#5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57
        swaywm#6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124
        swaywm#7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e)
        swaywm#8 0x55cd1a77c9e5 in server_fini ../sway/server.c:218
        swaywm#9 0x55cd1a77893f in main ../sway/main.c:400
        swaywm#10 0x7f6ff04bdb24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
        swaywm#11 0x55cd1a73a7ad in _start (/home/simon/src/sway/build/sway/sway+0x33a7ad)

    0x602000214111 is located 1 bytes inside of 16-byte region [0x602000214110,0x602000214120)
    freed by thread T0 here:
        #0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
        #1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24
        #2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51
        swaywm#3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306
        swaywm#4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57
        swaywm#5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57
        swaywm#6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124
        swaywm#7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e)

    previously allocated by thread T0 here:
        #0 0x7f6ff2236279 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
        #1 0x7f6ff1066d03 in wl_array_add (/usr/lib/libwayland-server.so.0+0xdd03)

[1]: swaywm#3002
[2]: swaywm#3004
emersion added a commit that referenced this pull request Jul 9, 2021
[1] and [2] have introduced new wl_array usage in wlroots, but
contains a mistake: wl_array_for_each iterates over pointers to
the wl_array entries, not over entries themselves.

Fix all wl_array_for_each call sites. Name the variables "ptr"
to avoid confusion.

Found via ASan:

    ==148752==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x602000214111 in thread T0
        #0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
        #1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24
        #2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51
        swaywm#3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306
        swaywm#4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57
        swaywm#5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57
        swaywm#6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124
        swaywm#7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e)
        swaywm#8 0x55cd1a77c9e5 in server_fini ../sway/server.c:218
        swaywm#9 0x55cd1a77893f in main ../sway/main.c:400
        swaywm#10 0x7f6ff04bdb24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
        swaywm#11 0x55cd1a73a7ad in _start (/home/simon/src/sway/build/sway/sway+0x33a7ad)

    0x602000214111 is located 1 bytes inside of 16-byte region [0x602000214110,0x602000214120)
    freed by thread T0 here:
        #0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
        #1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24
        #2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51
        swaywm#3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306
        swaywm#4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57
        swaywm#5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57
        swaywm#6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124
        swaywm#7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e)

    previously allocated by thread T0 here:
        #0 0x7f6ff2236279 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
        #1 0x7f6ff1066d03 in wl_array_add (/usr/lib/libwayland-server.so.0+0xdd03)

[1]: swaywm#3002
[2]: swaywm#3004
emersion pushed a commit that referenced this pull request Aug 18, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:

  #0  atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
          drm = 0x1ae9c10
          output = 0x270f5c0
          crtc = 0x0
          modeset = false
          active = false
          mode_id = 43989232
          gamma_lut = 0
          prev_vrr_enabled = <optimized out>
          vrr_enabled = <optimized out>
          atom = {req = 0x270f5c0, failed = 48}
          ok = <optimized out>
  #1  0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
          __PRETTY_FUNCTION__ = "drm_crtc_commit"
          drm = <optimized out>
          crtc = 0x0
          ok = <optimized out>
  #2  0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
          conn = 0x270f5c0
          unsupported = <optimized out>
  swaywm#3  0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
          conn = 0x270f5c0
  swaywm#4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
          now = {tv_sec = 7732, tv_nsec = 623813006}
          pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
          back_buffer = 0x0
          scale_updated = <optimized out>
          geometry_updated = <optimized out>
          committed = <optimized out>
          event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
  swaywm#5  0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
          wlr_output = 0x270f5c0
          output_box = <optimized out>
  swaywm#6  0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
          current = 0x29f38f0
          name = <optimized out>
          wildcard = true
          id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
          sway_output = 0x2710720
          tmp = 0x2242030
          seat = <optimized out>
  swaywm#7  0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
          error = <optimized out>
          output = <optimized out>
          background = false
  swaywm#8  0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
          res = <optimized out>
          argc = 4
          argv = 0x2a03370
          handler = 0x479230 <handlers+560>
          cmd = <optimized out>
          matched_delim = 0 '\000'
          containers = 0x0
          using_criteria = false
          __PRETTY_FUNCTION__ = "execute_command"
          exec = 0x28f63c0 "output * dpms off"
          head = 0x0
          res_list = 0x2a2e9d0
  swaywm#9  0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
          line = <optimized out>
          res_list = <optimized out>
          json = <optimized out>
          length = <optimized out>
          __PRETTY_FUNCTION__ = "ipc_client_handle_command"
          buf = 0x2975d20 "output * dpms off"
  swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
          pending_length = <optimized out>
          pending_type = <optimized out>
          client = 0x2a6ac80
          read_available = 31
          buf = "i3-ipc\021\000\000\000\000\000\000"
          received = 14
  swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
  No locals.
  swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
          verbose = 0
          debug = 0
          validate = 0
          allow_unsupported_gpu = 0
          long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
              name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
              has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
              flag = 0x0, val = 0}}
          config_path = 0x0
          usage = 0x45b830 "Usage: sway [options] [command]\n\n  -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n  -c, --config <config>  Specify a config file.\n  -C, --validate         Check the validity of the config file, th"...
          c = <optimized out>

where the second output is not enabled:

  (gdb) frame 4
  swaywm#4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
  837	in ../types/wlr_output.c
  (gdb) p output->enabled
  $3 = false
  (gdb)

The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.
emersion added a commit that referenced this pull request Oct 29, 2021
Variables on the stack are released when the parent block is closed.
Here, `now` is used outside of the `if` block, causing the following
crash when starting Sway with the headless backend:

    ==49606==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fff94645f90 at pc 0x5558aeae9e29 bp 0x7fff94645df0 sp 0x7fff94645de0
    READ of size 16 at 0x7fff94645f90 thread T0
        #0 0x5558aeae9e28 in handle_present ../sway/desktop/output.c:834
        #1 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
        #2 0x7fdc8d54f77f in wlr_output_send_present ../subprojects/wlroots/types/output/output.c:766
        swaywm#3 0x7fdc8d524a28 in output_commit ../subprojects/wlroots/backend/headless/output.c:71
        swaywm#4 0x7fdc8d54d2db in wlr_output_commit ../subprojects/wlroots/types/output/output.c:629
        swaywm#5 0x5558aeb013cb in output_render ../sway/desktop/render.c:1157
        swaywm#6 0x5558aeae549e in output_repaint_timer_handler ../sway/desktop/output.c:544
        swaywm#7 0x5558aeae5f8a in damage_handle_frame ../sway/desktop/output.c:606
        swaywm#8 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
        swaywm#9 0x7fdc8d6007d5 in output_handle_frame ../subprojects/wlroots/types/wlr_output_damage.c:44
        swaywm#10 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
        swaywm#11 0x7fdc8d54ee84 in wlr_output_send_frame ../subprojects/wlroots/types/output/output.c:720
        swaywm#12 0x7fdc8d54efc3 in schedule_frame_handle_idle_timer ../subprojects/wlroots/types/output/output.c:728
        swaywm#13 0x7fdc8c9dcf5a in wl_event_loop_dispatch_idle (/usr/lib/libwayland-server.so.0+0xaf5a)
        swaywm#14 0x7fdc8c9dcfb4 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xafb4)
        swaywm#15 0x7fdc8c9dabc6 in wl_display_run (/usr/lib/libwayland-server.so.0+0x8bc6)
        swaywm#16 0x5558aeac8e30 in server_run ../sway/server.c:285
        swaywm#17 0x5558aeac3c7d in main ../sway/main.c:396
        swaywm#18 0x7fdc8be35b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
        swaywm#19 0x5558aea8686d in _start (/home/simon/src/sway/build/sway/sway+0x33f86d)
amshafer pushed a commit to amshafer/wlroots that referenced this pull request Nov 19, 2021
Variables on the stack are released when the parent block is closed.
Here, `now` is used outside of the `if` block, causing the following
crash when starting Sway with the headless backend:

    ==49606==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fff94645f90 at pc 0x5558aeae9e29 bp 0x7fff94645df0 sp 0x7fff94645de0
    READ of size 16 at 0x7fff94645f90 thread T0
        #0 0x5558aeae9e28 in handle_present ../sway/desktop/output.c:834
        emersion#1 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
        emersion#2 0x7fdc8d54f77f in wlr_output_send_present ../subprojects/wlroots/types/output/output.c:766
        swaywm#3 0x7fdc8d524a28 in output_commit ../subprojects/wlroots/backend/headless/output.c:71
        swaywm#4 0x7fdc8d54d2db in wlr_output_commit ../subprojects/wlroots/types/output/output.c:629
        swaywm#5 0x5558aeb013cb in output_render ../sway/desktop/render.c:1157
        swaywm#6 0x5558aeae549e in output_repaint_timer_handler ../sway/desktop/output.c:544
        swaywm#7 0x5558aeae5f8a in damage_handle_frame ../sway/desktop/output.c:606
        swaywm#8 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
        swaywm#9 0x7fdc8d6007d5 in output_handle_frame ../subprojects/wlroots/types/wlr_output_damage.c:44
        swaywm#10 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
        swaywm#11 0x7fdc8d54ee84 in wlr_output_send_frame ../subprojects/wlroots/types/output/output.c:720
        swaywm#12 0x7fdc8d54efc3 in schedule_frame_handle_idle_timer ../subprojects/wlroots/types/output/output.c:728
        swaywm#13 0x7fdc8c9dcf5a in wl_event_loop_dispatch_idle (/usr/lib/libwayland-server.so.0+0xaf5a)
        swaywm#14 0x7fdc8c9dcfb4 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xafb4)
        swaywm#15 0x7fdc8c9dabc6 in wl_display_run (/usr/lib/libwayland-server.so.0+0x8bc6)
        swaywm#16 0x5558aeac8e30 in server_run ../sway/server.c:285
        swaywm#17 0x5558aeac3c7d in main ../sway/main.c:396
        swaywm#18 0x7fdc8be35b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
        swaywm#19 0x5558aea8686d in _start (/home/simon/src/sway/build/sway/sway+0x33f86d)
amshafer pushed a commit to amshafer/wlroots that referenced this pull request Jul 28, 2022
I am running a custom compiled version of chromium with a patch to get
it up and running on sway git at the moment, and in that development
build I compiled there is a bug where the browser will crash if you
try to open a file select dialog. When this crash happens, chromium will
not close, but instead will remain open and impossible to close unless
you send a SIGKILL signal to the process. However, sway will crash to
tty when you send the SIGKILL.

I have a hunch that when chromium is opening the file select dialog
it is creating some sort of a xdg toplevel surface. But it freezes
before it fully initializes the surface. When the SIGKILL signal is
given, sway/wlroots will try to free the xdg_toplevel surface but
because it hasn't fully initialized due to the frozen window, it
segfaults.

Don't be fooled by the assert, the assert is not firing, the surface
pointer is indeed NULL here.

* thread emersion#1, name = 'sway', stop reason = signal SIGSEGV: invalid address (fault address: 0x28)
    frame #0: 0x00007ffff78b9041 libwlroots.so.11`wlr_xdg_toplevel_set_parent(surface=0x0000000000000000, parent=0x0000000000000000) at wlr_xdg_toplevel.c:159:37
   156
   157 	void wlr_xdg_toplevel_set_parent(struct wlr_xdg_surface *surface,
   158 			struct wlr_xdg_surface *parent) {
-> 159 		assert(surface->role == WLR_XDG_SURFACE_ROLE_TOPLEVEL);
   160 		assert(!parent || parent->role == WLR_XDG_SURFACE_ROLE_TOPLEVEL);
   161
   162 		if (surface->toplevel->parent) {
(lldb) up
error: sway {0x0003442a}: DIE has DW_AT_ranges(DW_FORM_sec_offset 0x67) attribute, but range extraction failed (invalid range list offset 0x67), please file a bug and attach the file at the start of this error message
error: sway {0x0003442a}: DIE has DW_AT_ranges(DW_FORM_sec_offset 0x67) attribute, but range extraction failed (invalid range list offset 0x67), please file a bug and attach the file at the start of this error message
frame emersion#1: 0x00007ffff78e176e libwlroots.so.11`destroy_imported(imported=0x000055555626d570) at wlr_xdg_foreign_v1.c:154:3
   151 		wl_list_for_each_safe(child, child_tmp, &imported->children, link) {
   152 			struct wlr_xdg_surface *xdg_child =
   153 				wlr_xdg_surface_from_wlr_surface(child->surface);
-> 154 			wlr_xdg_toplevel_set_parent(xdg_child, NULL);
   155 		}
   156
   157 		wl_list_remove(&imported->exported_destroyed.link);
(lldb) up
frame emersion#2: 0x00007ffff78e1b9d libwlroots.so.11`xdg_imported_handle_resource_destroy(resource=0x00005555562555a0) at wlr_xdg_foreign_v1.c:280:2
   277 			struct wl_resource *resource) {
   278 		struct wlr_xdg_imported_v1 *imported = xdg_imported_from_resource(resource);
   279 		if (!imported) {
-> 280 			return;
   281 		}
   282
   283 		destroy_imported(imported);
(lldb) up
frame swaywm#3: 0x00007ffff794989a libwayland-server.so.0`___lldb_unnamed_symbol211 + 154
libwayland-server.so.0`___lldb_unnamed_symbol211:
->  0x7ffff794989a <+154>: andl   $0x1, %r13d
    0x7ffff794989e <+158>: je     0x7ffff79498b0            ; <+176>
    0x7ffff79498a0 <+160>: addq   $0x8, %rsp
    0x7ffff79498a4 <+164>: movl   $0x1, %eax
(lldb) up
frame swaywm#4: 0x00007ffff794fec0 libwayland-server.so.0`___lldb_unnamed_symbol290 + 64
libwayland-server.so.0`___lldb_unnamed_symbol290:
->  0x7ffff794fec0 <+64>: cmpl   $0x1, %eax
    0x7ffff794fec3 <+67>: jne    0x7ffff794fed3            ; <+83>
    0x7ffff794fec5 <+69>: addq   $0x8, %rbx
    0x7ffff794fec9 <+73>: cmpq   %rbx, %r13
(lldb) up
frame swaywm#5: 0x00007ffff79503e0 libwayland-server.so.0`___lldb_unnamed_symbol300 + 32
libwayland-server.so.0`___lldb_unnamed_symbol300:
->  0x7ffff79503e0 <+32>: cmpl   $0x1, %eax
    0x7ffff79503e3 <+35>: je     0x7ffff79503f0            ; <+48>
    0x7ffff79503e5 <+37>: popq   %rbx
    0x7ffff79503e6 <+38>: popq   %r12
(lldb) up
frame swaywm#6: 0x00007ffff794a30e libwayland-server.so.0`wl_client_destroy + 126
libwayland-server.so.0`wl_client_destroy:
->  0x7ffff794a30e <+126>: movq   %r12, %rdi
    0x7ffff794a311 <+129>: callq  0x7ffff7950150            ; ___lldb_unnamed_symbol293
    0x7ffff794a317 <+135>: movq   0x8(%rbp), %rdi
    0x7ffff794a31b <+139>: callq  *0xdc77(%rip)
(lldb) up
frame swaywm#7: 0x00007ffff794a3f7 libwayland-server.so.0`___lldb_unnamed_symbol214 + 119
libwayland-server.so.0`___lldb_unnamed_symbol214:
->  0x7ffff794a3f7 <+119>: movq   0x28(%rsp), %rax
    0x7ffff794a3fc <+124>: subq   %fs:0x28, %rax
    0x7ffff794a405 <+133>: jne    0x7ffff794a727            ; <+935>
    0x7ffff794a40b <+139>: addq   $0x38, %rsp
(lldb) up
frame swaywm#8: 0x00007ffff794d1ca libwayland-server.so.0`wl_event_loop_dispatch + 202
libwayland-server.so.0`wl_event_loop_dispatch:
->  0x7ffff794d1ca <+202>: addq   $0xc, %r15
    0x7ffff794d1ce <+206>: cmpq   %r15, %rbp
    0x7ffff794d1d1 <+209>: jne    0x7ffff794d1b8            ; <+184>
    0x7ffff794d1d3 <+211>: movq   0x8(%rsp), %rcx
(lldb) up
frame swaywm#9: 0x00007ffff794ad37 libwayland-server.so.0`wl_display_run + 39
libwayland-server.so.0`wl_display_run:
->  0x7ffff794ad37 <+39>: movl   0x8(%rbx), %eax
    0x7ffff794ad3a <+42>: testl  %eax, %eax
    0x7ffff794ad3c <+44>: jne    0x7ffff794ad20            ; <+16>
    0x7ffff794ad3e <+46>: popq   %rbx
(lldb) up
frame swaywm#10: 0x000055555557689a sway`server_run(server=0x00005555555f26c0) at server.c:307:2
   304 			wlr_backend_destroy(server->backend);
   305 			return false;
   306 		}
-> 307
   308 		return true;
   309 	}
   310
(lldb) up
frame swaywm#11: 0x0000555555575a93 sway`main(argc=3, argv=0x00007fffffffe978) at main.c:431:2
   428 			swaynag_show(&config->swaynag_config_errors);
   429 		}
   430
-> 431 		server_run(&server);
   432
   433 	shutdown:
   434 		sway_log(SWAY_INFO, "Shutting down sway");
amshafer pushed a commit to amshafer/wlroots that referenced this pull request Jul 28, 2022
Running with WLR_BACKENDS=headless, there is no keyboard device.
Avoid crashes like so:

    ../tinywl/tinywl.c:136:2: runtime error: member access within null pointer of type 'struct wlr_keyboard'
    ../tinywl/tinywl.c:136:2: runtime error: member access within null pointer of type 'struct wlr_keyboard'
    AddressSanitizer:DEADLYSIGNAL
    =================================================================
    ==331107==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000120 (pc 0x556ed03e4e99 bp 0x7ffce834bc10 sp 0x7ffce834bbb0 T0)
    ==331107==The signal is caused by a READ memory access.
    ==331107==Hint: address points to the zero page.
        #0 0x556ed03e4e99 in focus_view ../tinywl/tinywl.c:136
        emersion#1 0x556ed03eb3be in xdg_toplevel_map ../tinywl/tinywl.c:603
        emersion#2 0x7f75d6f768db in wlr_signal_emit_safe ../util/signal.c:29
        swaywm#3 0x7f75d6e9cac7 in xdg_surface_role_commit ../types/xdg_shell/wlr_xdg_surface.c:315
        swaywm#4 0x7f75d6eb6944 in surface_commit_state ../types/wlr_compositor.c:466
        swaywm#5 0x7f75d6eb7b02 in surface_handle_commit ../types/wlr_compositor.c:523
        swaywm#6 0x7f75d5714d49  (/usr/lib/libffi.so.8+0x6d49)
        swaywm#7 0x7f75d5714266  (/usr/lib/libffi.so.8+0x6266)
        swaywm#8 0x7f75d68cb322  (/usr/lib/libwayland-server.so.0+0xd322)
        swaywm#9 0x7f75d68c65cb  (/usr/lib/libwayland-server.so.0+0x85cb)
        swaywm#10 0x7f75d68c91c9 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xb1c9)
        swaywm#11 0x7f75d68c6d36 in wl_display_run (/usr/lib/libwayland-server.so.0+0x8d36)
        swaywm#12 0x556ed03eef55 in main ../tinywl/tinywl.c:905
        swaywm#13 0x7f75d5d2330f in __libc_start_call_main (/usr/lib/libc.so.6+0x2d30f)
        swaywm#14 0x7f75d5d233c0 in __libc_start_main@GLIBC_2.2.5 (/usr/lib/libc.so.6+0x2d3c0)
        swaywm#15 0x556ed03e46e4 in _start (/home/simon/src/wlroots/build/tinywl/tinywl+0x136e4)
amshafer pushed a commit to amshafer/wlroots that referenced this pull request Mar 9, 2023
Stack trace:

    #0  0x00007f17081f5b99 in wl_list_insert (list=list@entry=0x2d8, elm=elm@entry=0x7ffe7f7e85d0)
        at ../wayland-1.21.0/src/wayland-util.c:48
    emersion#1  0x00007f17081f5f2e in wl_signal_emit_mutable (signal=signal@entry=0x2d8, data=data@entry=0x7ffe7f7e8660)
        at ../wayland-1.21.0/src/wayland-server.c:2167
    emersion#2  0x00007f170815a971 in handle_switch_toggle (wlr_switch=0x2a0, event=0x55d5ba13dc00)
        at ../backend/libinput/switch.c:50
    swaywm#3  handle_libinput_event (event=0x55d5ba13dc00, backend=0x55d5b975d740) at ../backend/libinput/events.c:234
    swaywm#4  handle_libinput_readable (fd=<optimized out>, mask=<optimized out>, _backend=<optimized out>)
        at ../backend/libinput/backend.c:58
    swaywm#5  handle_libinput_readable (fd=fd@entry=34, mask=mask@entry=1, _backend=_backend@entry=0x55d5b975d740)
        at ../backend/libinput/backend.c:48
    swaywm#6  0x00007f170815c110 in backend_start (wlr_backend=0x55d5b975d740) at ../backend/libinput/backend.c:109
    swaywm#7  0x00007f1708160996 in multi_backend_start (wlr_backend=0x55d5b97583d0) at ../backend/multi/backend.c:32
amshafer pushed a commit to amshafer/wlroots that referenced this pull request Mar 9, 2023
In output_ensure_buffer() we create a swapchain and attach an empty
buffer to the output if necessary. We do that during the first commit.
This is fine when the first commit enables the output, however this breaks
when the first commit disables the output. A commit which disables an
output and has a buffer attached is invalid (see output_basic_test()), and
makes the DRM backend crash:

    00:00:00.780 [wlr] [backend/drm/drm.c:622] connector eDP-1: Turning off
    ../subprojects/wlroots/backend/drm/drm.c:652:44: runtime error: member access within null pointer of type 'struct wlr_drm_crtc'
    AddressSanitizer:DEADLYSIGNAL
    =================================================================
    ==2524==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f22e894afc1 bp 0x7ffe1d57c550 sp 0x7ffe1d57c420 T0)
    ==2524==The signal is caused by a READ memory access.
    ==2524==Hint: address points to the zero page.
        #0 0x7f22e894afc1 in drm_connector_commit_state ../subprojects/wlroots/backend/drm/drm.c:652
        emersion#1 0x7f22e894b1f5 in drm_connector_commit ../subprojects/wlroots/backend/drm/drm.c:674
        emersion#2 0x7f22e89e8da9 in wlr_output_commit_state ../subprojects/wlroots/types/output/output.c:756
        swaywm#3 0x555ab325624d in apply_output_config ../sway/config/output.c:517
        swaywm#4 0x555ab31a1aa1 in handle_new_output ../sway/desktop/output.c:974
        swaywm#5 0x7f22e9272f6d in wl_signal_emit_mutable (/usr/lib/libwayland-server.so.0+0x9f6d)
        swaywm#6 0x7f22e899b012 in new_output_reemit ../subprojects/wlroots/backend/multi/backend.c:161
        swaywm#7 0x7f22e9272f6d in wl_signal_emit_mutable (/usr/lib/libwayland-server.so.0+0x9f6d)
        swaywm#8 0x7f22e895a153 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1488
        swaywm#9 0x7f22e893c2e4 in backend_start ../subprojects/wlroots/backend/drm/backend.c:24
        swaywm#10 0x7f22e892ed00 in wlr_backend_start ../subprojects/wlroots/backend/backend.c:56
        swaywm#11 0x7f22e8999b83 in multi_backend_start ../subprojects/wlroots/backend/multi/backend.c:31
        swaywm#12 0x7f22e892ed00 in wlr_backend_start ../subprojects/wlroots/backend/backend.c:56
        swaywm#13 0x555ab317d5cc in server_start ../sway/server.c:316
        swaywm#14 0x555ab317748d in main ../sway/main.c:400
        swaywm#15 0x7f22e783c28f  (/usr/lib/libc.so.6+0x2328f)
        swaywm#16 0x7f22e783c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
        swaywm#17 0x555ab3134c84 in _start (/home/simon/src/sway/build/sway/sway+0x377c84)

Fixes: 3be6658 ("output: allocate swapchain on first commit")
Closes: swaywm/sway#7373
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants