This repository has been archived by the owner on Nov 1, 2021. It is now read-only.
wl_pointer is sketched in, requires wl_surface to implement #1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Please revert your changes to the readme. Your functions should have a more fleshed out signature and you can implement them at least somewhat. Also, we don't need to pass the client around. |
emersion
pushed a commit
that referenced
this pull request
Feb 16, 2018
Wrap wl_resource_get_user_data into safer helper functions (for xdg-shell stable too)
acrisci
pushed a commit
that referenced
this pull request
Mar 22, 2018
==12021==ERROR: AddressSanitizer: heap-use-after-free on address 0x617000015698 at pc 0x7f1a9abe1c09 bp 0x7ffe9068f6b0 sp 0x7ffe9068f6a0
WRITE of size 4 at 0x617000015698 thread T0
#0 0x7f1a9abe1c08 in pointer_handle_leave ../backend/wayland/wl_seat.c:40
#1 0x7f1a96ae7d1d in ffi_call_unix64 (/lib64/libffi.so.6+0x5d1d)
#2 0x7f1a96ae768e in ffi_call (/lib64/libffi.so.6+0x568e)
#3 0x7f1a988e0d8a (/lib64/libwayland-client.so.0+0x8d8a)
#4 0x7f1a988dd927 (/lib64/libwayland-client.so.0+0x5927)
#5 0x7f1a988debe3 in wl_display_dispatch_queue_pending (/lib64/libwayland-client.so.0+0x6be3)
#6 0x7f1a9abdd6d6 in dispatch_events ../backend/wayland/backend.c:28
#7 0x7f1a9a968c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11)
#8 0x7f1a9a967449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449)
#9 0x418dff in main ../rootston/main.c:81
#10 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
#11 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)
0x617000015698 is located 664 bytes inside of 696-byte region [0x617000015400,0x6170000156b8)
freed by thread T0 here:
#0 0x7f1a9af754b8 in __interceptor_free (/lib64/libasan.so.4+0xde4b8)
#1 0x7f1a9abe01ee in wlr_wl_output_destroy ../backend/wayland/output.c:194
#2 0x7f1a9ac12918 in wlr_output_destroy ../types/wlr_output.c:299
#3 0x7f1a9abe061b in xdg_toplevel_handle_close ../backend/wayland/output.c:255
#4 0x7f1a96ae7d1d in ffi_call_unix64 (/lib64/libffi.so.6+0x5d1d)
#5 0x7f1a96ae768e in ffi_call (/lib64/libffi.so.6+0x568e)
#6 0x7f1a988e0d8a (/lib64/libwayland-client.so.0+0x8d8a)
#7 0x7f1a988dd927 (/lib64/libwayland-client.so.0+0x5927)
#8 0x7f1a988debe3 in wl_display_dispatch_queue_pending (/lib64/libwayland-client.so.0+0x6be3)
#9 0x7f1a9abdd6d6 in dispatch_events ../backend/wayland/backend.c:28
#10 0x7f1a9a968c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11)
#11 0x7f1a9a967449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449)
#12 0x418dff in main ../rootston/main.c:81
#13 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
#14 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)
previously allocated by thread T0 here:
#0 0x7f1a9af75a38 in __interceptor_calloc (/lib64/libasan.so.4+0xdea38)
#1 0x7f1a9abe0703 in wlr_wl_output_create ../backend/wayland/output.c:272
#2 0x7f1a9abdd8eb in wlr_wl_backend_start ../backend/wayland/backend.c:55
#3 0x7f1a9abbeb49 in wlr_backend_start ../backend/backend.c:28
#4 0x7f1a9abd8ce1 in multi_backend_start ../backend/multi/backend.c:24
#5 0x7f1a9abbeb49 in wlr_backend_start ../backend/backend.c:28
#6 0x418c32 in main ../rootston/main.c:58
#7 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
#8 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)
ddevault
pushed a commit
that referenced
this pull request
Mar 27, 2018
==32557==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000425f96 bp 0x7fff8ac19de0 sp 0x7fff8ac19d20 T0)
==32557==The signal is caused by a READ memory access.
==32557==Hint: address points to the zero page.
#0 0x425f95 in roots_seat_set_focus ../rootston/seat.c:737
#1 0x40bcd6 in roots_cursor_press_button ../rootston/cursor.c:272
#2 0x40c1f7 in roots_cursor_handle_button ../rootston/cursor.c:298
#3 0x42179b in handle_cursor_button ../rootston/seat.c:58
#4 0x7f1651062367 in wlr_signal_emit_safe ../util/signal.c:29
#5 0x7f165101b532 in handle_pointer_button ../types/wlr_cursor.c:344
#6 0x7f1651062367 in wlr_signal_emit_safe ../util/signal.c:29
#7 0x7f1650ff633b in handle_pointer_button ../backend/libinput/pointer.c:85
#8 0x7f1650ff5291 in wlr_libinput_event ../backend/libinput/events.c:215
#9 0x7f1650ff3990 in wlr_libinput_readable ../backend/libinput/backend.c:35
#10 0x7f1650d88c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11)
#11 0x7f1650d87449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449)
#12 0x418e90 in main ../rootston/main.c:81
#13 0x7f164ff7ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
#14 0x405829 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x405829)
introduced by #680
agx
added a commit
to agx/wlroots
that referenced
this pull request
Apr 16, 2018
When e.g. running rootston under X11 it would otherwise crash when
closing rootston like:
#0 0x00007f0197da7327 in wl_list_remove () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
swaywm#1 0x000056306fcee7fb in handle_destroy (listener=0x5630723a2948, data=0x5630723a5d20) at ../rootston/layer_shell.c:273
swaywm#2 0x00007f019800a552 in wlr_signal_emit_safe (signal=0x5630723a5e30, data=0x5630723a5d20) at ../util/signal.c:29
swaywm#3 0x00007f0197fef808 in layer_surface_destroy (surface=0x5630723a5d20) at ../types/wlr_layer_shell.c:169
swaywm#4 0x00007f0197ff0001 in client_handle_destroy (resource=0x56307229c4c0) at ../types/wlr_layer_shell.c:371
swaywm#5 0x00007f0197da2f30 in () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
swaywm#6 0x00007f0197da77f9 in () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
swaywm#7 0x00007f0197da301d in wl_client_destroy () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
swaywm#8 0x00007f0197da30d8 in () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
swaywm#9 0x00007f0197da4c12 in wl_event_loop_dispatch () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
swaywm#10 0x00007f0197da344a in wl_display_run () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0
swaywm#11 0x000056306fcef069 in main (argc=3, argv=0x7ffd22032528) at ../rootston/main.c:83
since the output_destroy got already removed in handle_output_destroy.
agx
added a commit
to agx/wlroots
that referenced
this pull request
Apr 30, 2018
This fixes surface positioning after rotation, closes swaywm#1
Ongy
pushed a commit
to Ongy/wlroots
that referenced
this pull request
May 4, 2018
==12021==ERROR: AddressSanitizer: heap-use-after-free on address 0x617000015698 at pc 0x7f1a9abe1c09 bp 0x7ffe9068f6b0 sp 0x7ffe9068f6a0
WRITE of size 4 at 0x617000015698 thread T0
#0 0x7f1a9abe1c08 in pointer_handle_leave ../backend/wayland/wl_seat.c:40
swaywm#1 0x7f1a96ae7d1d in ffi_call_unix64 (/lib64/libffi.so.6+0x5d1d)
swaywm#2 0x7f1a96ae768e in ffi_call (/lib64/libffi.so.6+0x568e)
swaywm#3 0x7f1a988e0d8a (/lib64/libwayland-client.so.0+0x8d8a)
swaywm#4 0x7f1a988dd927 (/lib64/libwayland-client.so.0+0x5927)
swaywm#5 0x7f1a988debe3 in wl_display_dispatch_queue_pending (/lib64/libwayland-client.so.0+0x6be3)
swaywm#6 0x7f1a9abdd6d6 in dispatch_events ../backend/wayland/backend.c:28
swaywm#7 0x7f1a9a968c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11)
swaywm#8 0x7f1a9a967449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449)
swaywm#9 0x418dff in main ../rootston/main.c:81
swaywm#10 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
swaywm#11 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)
0x617000015698 is located 664 bytes inside of 696-byte region [0x617000015400,0x6170000156b8)
freed by thread T0 here:
#0 0x7f1a9af754b8 in __interceptor_free (/lib64/libasan.so.4+0xde4b8)
swaywm#1 0x7f1a9abe01ee in wlr_wl_output_destroy ../backend/wayland/output.c:194
swaywm#2 0x7f1a9ac12918 in wlr_output_destroy ../types/wlr_output.c:299
swaywm#3 0x7f1a9abe061b in xdg_toplevel_handle_close ../backend/wayland/output.c:255
swaywm#4 0x7f1a96ae7d1d in ffi_call_unix64 (/lib64/libffi.so.6+0x5d1d)
swaywm#5 0x7f1a96ae768e in ffi_call (/lib64/libffi.so.6+0x568e)
swaywm#6 0x7f1a988e0d8a (/lib64/libwayland-client.so.0+0x8d8a)
swaywm#7 0x7f1a988dd927 (/lib64/libwayland-client.so.0+0x5927)
swaywm#8 0x7f1a988debe3 in wl_display_dispatch_queue_pending (/lib64/libwayland-client.so.0+0x6be3)
swaywm#9 0x7f1a9abdd6d6 in dispatch_events ../backend/wayland/backend.c:28
swaywm#10 0x7f1a9a968c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11)
swaywm#11 0x7f1a9a967449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449)
swaywm#12 0x418dff in main ../rootston/main.c:81
swaywm#13 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
swaywm#14 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)
previously allocated by thread T0 here:
#0 0x7f1a9af75a38 in __interceptor_calloc (/lib64/libasan.so.4+0xdea38)
swaywm#1 0x7f1a9abe0703 in wlr_wl_output_create ../backend/wayland/output.c:272
swaywm#2 0x7f1a9abdd8eb in wlr_wl_backend_start ../backend/wayland/backend.c:55
swaywm#3 0x7f1a9abbeb49 in wlr_backend_start ../backend/backend.c:28
swaywm#4 0x7f1a9abd8ce1 in multi_backend_start ../backend/multi/backend.c:24
swaywm#5 0x7f1a9abbeb49 in wlr_backend_start ../backend/backend.c:28
swaywm#6 0x418c32 in main ../rootston/main.c:58
swaywm#7 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
swaywm#8 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)
Ongy
pushed a commit
to Ongy/wlroots
that referenced
this pull request
May 4, 2018
==32557==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000425f96 bp 0x7fff8ac19de0 sp 0x7fff8ac19d20 T0)
==32557==The signal is caused by a READ memory access.
==32557==Hint: address points to the zero page.
#0 0x425f95 in roots_seat_set_focus ../rootston/seat.c:737
swaywm#1 0x40bcd6 in roots_cursor_press_button ../rootston/cursor.c:272
swaywm#2 0x40c1f7 in roots_cursor_handle_button ../rootston/cursor.c:298
swaywm#3 0x42179b in handle_cursor_button ../rootston/seat.c:58
swaywm#4 0x7f1651062367 in wlr_signal_emit_safe ../util/signal.c:29
swaywm#5 0x7f165101b532 in handle_pointer_button ../types/wlr_cursor.c:344
swaywm#6 0x7f1651062367 in wlr_signal_emit_safe ../util/signal.c:29
swaywm#7 0x7f1650ff633b in handle_pointer_button ../backend/libinput/pointer.c:85
swaywm#8 0x7f1650ff5291 in wlr_libinput_event ../backend/libinput/events.c:215
swaywm#9 0x7f1650ff3990 in wlr_libinput_readable ../backend/libinput/backend.c:35
swaywm#10 0x7f1650d88c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11)
swaywm#11 0x7f1650d87449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449)
swaywm#12 0x418e90 in main ../rootston/main.c:81
swaywm#13 0x7f164ff7ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
swaywm#14 0x405829 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x405829)
introduced by swaywm#680
acrisci
pushed a commit
that referenced
this pull request
Jun 25, 2018
seat->primary_election_source_destroy points to the source that just got
freed by the cancel.
==7843==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b0004269b0 at pc 0x7fb95bf4ccd0 bp 0x7ffd75013940 s
p 0x7ffd75013930
WRITE of size 8 at 0x60b0004269b0 thread T0
#0 0x7fb95bf4cccf in wl_list_remove ../util/signal.c:55
#1 0x7fb95bf3f4c6 in wlr_seat_set_primary_selection ../types/wlr_primary_selection.c:238
#2 0x7fb95becb1a7 in xwm_handle_selection_event ../xwayland/selection/selection.c:124
#3 0x7fb95bed2e5d in x11_event_handler ../xwayland/xwm.c:1139
#4 0x7fb95c1bdf01 in wl_event_loop_dispatch src/event-loop.c:641
#5 0x7fb95c1bc601 in wl_display_run src/wayland-server.c:1260
#6 0x40a2f4 in main ../sway/main.c:433
#7 0x7fb95b69718a in __libc_start_main (/lib64/libc.so.6+0x2318a)
#8 0x40b749 in _start (/opt/wayland/bin/sway+0x40b749)
0x60b0004269b0 is located 64 bytes inside of 112-byte region [0x60b000426970,0x60b0004269e0)
freed by thread T0 here:
#0 0x7fb95e0ad880 in __interceptor_free (/lib64/libasan.so.5+0xee880)
#1 0x7fb95bf3f49e in wlr_seat_set_primary_selection ../types/wlr_primary_selection.c:236
#2 0x7fb95becb1a7 in xwm_handle_selection_event ../xwayland/selection/selection.c:124
#3 0x7fb95bed2e5d in x11_event_handler ../xwayland/xwm.c:1139
#4 0x7fb95c1bdf01 in wl_event_loop_dispatch src/event-loop.c:641
previously allocated by thread T0 here:
#0 0x7fb95e0ade50 in calloc (/lib64/libasan.so.5+0xeee50)
#1 0x7fb95bec7ad6 in xwm_selection_get_targets ../xwayland/selection/incoming.c:355
#2 0x7fb95bec7ad6 in xwm_handle_selection_notify ../xwayland/selection/incoming.c:402
#3 0x7fb95becb1a7 in xwm_handle_selection_event ../xwayland/selection/selection.c:124
#4 0x7fb95bed2e5d in x11_event_handler ../xwayland/xwm.c:1139
#5 0x7fb95c1bdf01 in wl_event_loop_dispatch src/event-loop.c:641
SUMMARY: AddressSanitizer: heap-use-after-free ../util/signal.c:55 in wl_list_remove
Shadow bytes around the buggy address:
0x0c168007cce0: fd fd fd fa fa fa fa fa fa fa fa fa fd fd fd fd
0x0c168007ccf0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x0c168007cd00: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fa
0x0c168007cd10: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c168007cd20: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fd fd
=>0x0c168007cd30: fd fd fd fd fd fd[fd]fd fd fd fd fd fa fa fa fa
0x0c168007cd40: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x0c168007cd50: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
0x0c168007cd60: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
0x0c168007cd70: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
0x0c168007cd80: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
acrisci
pushed a commit
that referenced
this pull request
Jun 25, 2018
Happens when e.g. closing gimp.
==24039==ERROR: AddressSanitizer: heap-use-after-free on address 0x6150001a7a78 at pc 0x7f09b09f1bb2 bp 0x7ffcf0237bf0 sp 0x7ffcf0237be0
WRITE of size 8 at 0x6150001a7a78 thread T0
#0 0x7f09b09f1bb1 in wl_list_remove ../util/signal.c:55
#1 0x7f09b094cf03 in xwayland_surface_destroy ../xwayland/xwm.c:295
#2 0x7f09b0950245 in xwm_handle_destroy_notify ../xwayland/xwm.c:717
#3 0x7f09b095304a in x11_event_handler ../xwayland/xwm.c:1149
#4 0x7f09b0c68f01 in wl_event_loop_dispatch src/event-loop.c:641
#5 0x7f09b0c67601 in wl_display_run src/wayland-server.c:1260
#6 0x40a2f4 in main ../sway/main.c:433
#7 0x7f09b011018a in __libc_start_main (/lib64/libc.so.6+0x2318a)
#8 0x40b749 in _start (/opt/wayland/bin/sway+0x40b749)
0x6150001a7a78 is located 120 bytes inside of 496-byte region [0x6150001a7a00,0x6150001a7bf0)
freed by thread T0 here:
#0 0x7f09b2b58880 in __interceptor_free (/lib64/libasan.so.5+0xee880)
#1 0x7f09b094d1a1 in xwayland_surface_destroy ../xwayland/xwm.c:315
#2 0x7f09b0950245 in xwm_handle_destroy_notify ../xwayland/xwm.c:717
#3 0x7f09b095304a in x11_event_handler ../xwayland/xwm.c:1149
#4 0x7f09b0c68f01 in wl_event_loop_dispatch src/event-loop.c:641
#5 0x7f09b0c67601 in wl_display_run src/wayland-server.c:1260
#6 0x40a2f4 in main ../sway/main.c:433
#7 0x7f09b011018a in __libc_start_main (/lib64/libc.so.6+0x2318a)
#8 0x40b749 in _start (/opt/wayland/bin/sway+0x40b749)
previously allocated by thread T0 here:
#0 0x7f09b2b58e50 in calloc (/lib64/libasan.so.5+0xeee50)
#1 0x7f09b094b585 in xwayland_surface_create ../xwayland/xwm.c:119
#2 0x7f09b0950151 in xwm_handle_create_notify ../xwayland/xwm.c:706
#3 0x7f09b0953032 in x11_event_handler ../xwayland/xwm.c:1146
#4 0x7f09b0c68f01 in wl_event_loop_dispatch src/event-loop.c:641
#5 0x7f09b0c67601 in wl_display_run src/wayland-server.c:1260
#6 0x40a2f4 in main ../sway/main.c:433
#7 0x7f09b011018a in __libc_start_main (/lib64/libc.so.6+0x2318a)
#8 0x40b749 in _start (/opt/wayland/bin/sway+0x40b749)
acrisci
pushed a commit
that referenced
this pull request
Jun 25, 2018
popups have a link in parent's surface->popups list and needs
to be freed before:
==6902==ERROR: AddressSanitizer: heap-use-after-free on address 0x6120001a0300 at pc 0x7fc1447acb50 bp 0x7fffd396e680 sp 0x7fffd396e670
WRITE of size 8 at 0x6120001a0300 thread T0
#0 0x7fc1447acb4f in wl_list_remove ../util/signal.c:55
#1 0x7fc14477d206 in destroy_xdg_popup_v6 ../types/xdg_shell_v6/wlr_xdg_popup_v6.c:162
#2 0x7fc1447816e0 in destroy_xdg_surface_v6 ../types/xdg_shell_v6/wlr_xdg_surface_v6.c:108
#3 0x7fc144a1c025 in destroy_resource src/wayland-server.c:688
#4 0x7fc144a1c091 in wl_resource_destroy src/wayland-server.c:705
#5 0x7fc14477fd6f in xdg_client_v6_handle_resource_destroy ../types/xdg_shell_v6/wlr_xdg_shell_v6.c:72
#6 0x7fc144a1c025 in destroy_resource src/wayland-server.c:688
#7 0x7fc144a20851 (/lib64/libwayland-server.so.0+0xc851)
#8 0x7fc144a20d92 (/lib64/libwayland-server.so.0+0xcd92)
#9 0x7fc144a1c140 in wl_client_destroy src/wayland-server.c:847
#10 0x7fc144a1c21c in destroy_client_with_error src/wayland-server.c:307
#11 0x7fc144a1c21c in wl_client_connection_data src/wayland-server.c:330
#12 0x7fc144a1df01 in wl_event_loop_dispatch src/event-loop.c:641
#13 0x7fc144a1c601 in wl_display_run src/wayland-server.c:1260
#14 0x40a2f4 in main ../sway/main.c:433
#15 0x7fc143ef718a in __libc_start_main ../csu/libc-start.c:308
#16 0x40b749 in _start (/opt/wayland/bin/sway+0x40b749)
0x6120001a0300 is located 64 bytes inside of 264-byte region [0x6120001a02c0,0x6120001a03c8)
freed by thread T0 here:
#0 0x7fc14690d880 in __interceptor_free (/lib64/libasan.so.5+0xee880)
#1 0x7fc1447acce8 in wlr_signal_emit_safe ../util/signal.c:29
#2 0x7fc1447a3cac in surface_handle_resource_destroy ../types/wlr_surface.c:576
#3 0x7fc144a1c025 in destroy_resource src/wayland-server.c:688
previously allocated by thread T0 here:
#0 0x7fc14690de50 in calloc (/lib64/libasan.so.5+0xeee50)
#1 0x7fc144781d38 in create_xdg_surface_v6 ../types/xdg_shell_v6/wlr_xdg_surface_v6.c:415
#2 0x7fc14147503d in ffi_call_unix64 (/lib64/libffi.so.6+0x603d)
Alternative would be to have popups listen to the parent's surface
destroy event and remove themselves from the list at this point OR on
their own destroy, whichever happens first, but that seems more
complicated for little benefit.
ddevault
pushed a commit
that referenced
this pull request
Jul 4, 2018
wl_resource_for_each_safe isn't safe to use here because it accesses
the list's head memory one last time at the end of the loop. Work
around this by breaking out early.
==19880==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d0000e6368 at pc 0x7fab68619de2 bp 0x7ffd5c91cee0 sp 0x7ffd5c91ced0
READ of size 8 at 0x60d0000e6368 thread T0
#0 0x7fab68619de1 in wlr_seat_destroy ../types/seat/wlr_seat.c:179
#1 0x7fab68619fb9 in handle_display_destroy ../types/seat/wlr_seat.c:196
#2 0x7fab688e4f8f in wl_priv_signal_emit src/wayland-server.c:2024
#3 0x7fab688e56ca in wl_display_destroy src/wayland-server.c:1092
#4 0x40c11e in server_fini ../sway/server.c:138
#5 0x40b1a8 in main ../sway/main.c:438
#6 0x7fab67b5e18a in __libc_start_main ../csu/libc-start.c:308
#7 0x409359 in _start (/opt/wayland/bin/sway+0x409359)
0x60d0000e6368 is located 24 bytes inside of 144-byte region [0x60d0000e6350,0x60d0000e63e0)
freed by thread T0 here:
#0 0x7fab6a7d6880 in __interceptor_free (/lib64/libasan.so.5+0xee880)
#1 0x7fab68619805 in seat_client_handle_resource_destroy ../types/seat/wlr_seat.c:97
#2 0x7fab688e5025 in destroy_resource src/wayland-server.c:688
previously allocated by thread T0 here:
#0 0x7fab6a7d6e50 in calloc (/lib64/libasan.so.5+0xeee50)
#1 0x7fab686198df in seat_handle_bind ../types/seat/wlr_seat.c:127
#2 0x7fab6530503d in ffi_call_unix64 (/lib64/libffi.so.6+0x603d)
dcz-purism
pushed a commit
to dcz-purism/wlroots
that referenced
this pull request
Aug 29, 2018
This fixes surface positioning after rotation, closes swaywm#1
Emantor
added a commit
to Emantor/wlroots
that referenced
this pull request
May 30, 2019
If an output is destroyed while an idle_done event is scheduled, it
results in the following Address Sanitizer Output:
==1469==ERROR: AddressSanitizer: heap-use-after-free on address 0x6170000bb668 at pc 0x7f49aaa0c348 bp 0x7ffed5da35b0 sp 0x7ffed5da35a0
WRITE of size 8 at 0x6170000bb668 thread T0
#0 0x7f49aaa0c347 in schedule_done_handle_idle_timer ../subprojects/wlroots/types/wlr_output.c:265
swaywm#1 0x7f49aa2f875b in wl_event_loop_dispatch_idle (/usr/lib/libwayland-server.so.0+0xa75b)
swaywm#2 0x7f49aa2f8815 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa815)
swaywm#3 0x7f49aa2f739b in wl_display_run (/usr/lib/libwayland-server.so.0+0x939b)
swaywm#4 0x556622dadd51 in server_run ../sway/server.c:216
swaywm#5 0x556622dac25d in main ../sway/main.c:397
swaywm#6 0x7f49aa0d0ce2 in __libc_start_main (/usr/lib/libc.so.6+0x23ce2)
swaywm#7 0x556622d8d09d in _start (/usr/local/bin/sway+0x3909d)
0x6170000bb668 is located 488 bytes inside of 672-byte region [0x6170000bb480,0x6170000bb720)
freed by thread T0 here:
#0 0x7f49aabc8f89 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:66
swaywm#1 0x7f49aa968fc2 in drm_connector_destroy ../subprojects/wlroots/backend/drm/drm.c:829
swaywm#2 0x7f49aaa0cc52 in wlr_output_destroy ../subprojects/wlroots/types/wlr_output.c:357
swaywm#3 0x7f49aa96d2e9 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1265
swaywm#4 0x7f49aa961a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135
swaywm#5 0x7f49aaa2e1e9 in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
swaywm#6 0x7f49aa98319f in udev_event ../subprojects/wlroots/backend/session/session.c:52
swaywm#7 0x7f49aa2f87f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1)
previously allocated by thread T0 here:
#0 0x7f49aabc95a1 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:95
swaywm#1 0x7f49aa96b7a2 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1114
swaywm#2 0x7f49aa961a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135
swaywm#3 0x7f49aaa2e1e9 in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
swaywm#4 0x7f49aa98319f in udev_event ../subprojects/wlroots/backend/session/session.c:52
swaywm#5 0x7f49aa2f87f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1)
SUMMARY: AddressSanitizer: heap-use-after-free ../subprojects/wlroots/types/wlr_output.c:265 in schedule_done_handle_idle_timer
Shadow bytes around the buggy address:
0x0c2e8000f670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2e8000f680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2e8000f690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2e8000f6a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2e8000f6b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c2e8000f6c0: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
0x0c2e8000f6d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2e8000f6e0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2e8000f6f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2e8000f700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2e8000f710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Remove the idle_done idle timer when the output is destroyed
emersion
pushed a commit
that referenced
this pull request
May 30, 2019
If an output is destroyed while an idle_done event is scheduled, it
results in the following Address Sanitizer Output:
==1469==ERROR: AddressSanitizer: heap-use-after-free on address 0x6170000bb668 at pc 0x7f49aaa0c348 bp 0x7ffed5da35b0 sp 0x7ffed5da35a0
WRITE of size 8 at 0x6170000bb668 thread T0
#0 0x7f49aaa0c347 in schedule_done_handle_idle_timer ../subprojects/wlroots/types/wlr_output.c:265
#1 0x7f49aa2f875b in wl_event_loop_dispatch_idle (/usr/lib/libwayland-server.so.0+0xa75b)
#2 0x7f49aa2f8815 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa815)
#3 0x7f49aa2f739b in wl_display_run (/usr/lib/libwayland-server.so.0+0x939b)
#4 0x556622dadd51 in server_run ../sway/server.c:216
#5 0x556622dac25d in main ../sway/main.c:397
#6 0x7f49aa0d0ce2 in __libc_start_main (/usr/lib/libc.so.6+0x23ce2)
#7 0x556622d8d09d in _start (/usr/local/bin/sway+0x3909d)
0x6170000bb668 is located 488 bytes inside of 672-byte region [0x6170000bb480,0x6170000bb720)
freed by thread T0 here:
#0 0x7f49aabc8f89 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:66
#1 0x7f49aa968fc2 in drm_connector_destroy ../subprojects/wlroots/backend/drm/drm.c:829
#2 0x7f49aaa0cc52 in wlr_output_destroy ../subprojects/wlroots/types/wlr_output.c:357
#3 0x7f49aa96d2e9 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1265
#4 0x7f49aa961a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135
#5 0x7f49aaa2e1e9 in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
#6 0x7f49aa98319f in udev_event ../subprojects/wlroots/backend/session/session.c:52
#7 0x7f49aa2f87f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1)
previously allocated by thread T0 here:
#0 0x7f49aabc95a1 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:95
#1 0x7f49aa96b7a2 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1114
#2 0x7f49aa961a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135
#3 0x7f49aaa2e1e9 in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
#4 0x7f49aa98319f in udev_event ../subprojects/wlroots/backend/session/session.c:52
#5 0x7f49aa2f87f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1)
SUMMARY: AddressSanitizer: heap-use-after-free ../subprojects/wlroots/types/wlr_output.c:265 in schedule_done_handle_idle_timer
Shadow bytes around the buggy address:
0x0c2e8000f670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2e8000f680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2e8000f690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2e8000f6a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2e8000f6b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c2e8000f6c0: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
0x0c2e8000f6d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2e8000f6e0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2e8000f6f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2e8000f700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2e8000f710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Remove the idle_done idle timer when the output is destroyed
ddevault
pushed a commit
that referenced
this pull request
Dec 1, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:
==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
READ of size 8 at 0x614000000180 thread T0
#0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
#3 0x7f88e21af274 (/lib64/libinput.so.10+0x28274)
#4 0x7f88e21aff1d (/lib64/libinput.so.10+0x28f1d)
#5 0x7f88e219ddac (/lib64/libinput.so.10+0x16dac)
#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
#11 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
#13 0x559fefb52385 in main ../main.c:67
#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)
0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
freed by thread T0 here:
#0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
#4 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
previously allocated by thread T0 here:
#0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
#3 0x559fefb51ea6 in main ../main.c:20
#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
aiqs4
pushed a commit
to aiqs4/wlroots
that referenced
this pull request
Dec 19, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:
==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
READ of size 8 at 0x614000000180 thread T0
#0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
swaywm#3 0x7f88e21af274 (/lib64/libinput.so.10+0x28274)
swaywm#4 0x7f88e21aff1d (/lib64/libinput.so.10+0x28f1d)
swaywm#5 0x7f88e219ddac (/lib64/libinput.so.10+0x16dac)
swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
swaywm#11 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
swaywm#13 0x559fefb52385 in main ../main.c:67
swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)
0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
freed by thread T0 here:
#0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
swaywm#4 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
previously allocated by thread T0 here:
#0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
swaywm#3 0x559fefb51ea6 in main ../main.c:20
swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
aiqs4
pushed a commit
to aiqs4/wlroots
that referenced
this pull request
Dec 19, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:
==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
READ of size 8 at 0x614000000180 thread T0
#0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
swaywm#3 0x7f88e21af274 (/lib64/libinput.so.10+0x28274)
swaywm#4 0x7f88e21aff1d (/lib64/libinput.so.10+0x28f1d)
swaywm#5 0x7f88e219ddac (/lib64/libinput.so.10+0x16dac)
swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
swaywm#11 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
swaywm#13 0x559fefb52385 in main ../main.c:67
swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)
0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
freed by thread T0 here:
#0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
swaywm#4 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
previously allocated by thread T0 here:
#0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
swaywm#3 0x559fefb51ea6 in main ../main.c:20
swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
aiqs4
pushed a commit
to aiqs4/wlroots
that referenced
this pull request
Dec 19, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:
==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
READ of size 8 at 0x614000000180 thread T0
#0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
swaywm#3 0x7f88e21af274 (/lib64/libinput.so.10+0x28274)
swaywm#4 0x7f88e21aff1d (/lib64/libinput.so.10+0x28f1d)
swaywm#5 0x7f88e219ddac (/lib64/libinput.so.10+0x16dac)
swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
swaywm#11 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
swaywm#13 0x559fefb52385 in main ../main.c:67
swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)
0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
freed by thread T0 here:
#0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
swaywm#4 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
previously allocated by thread T0 here:
#0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
swaywm#3 0x559fefb51ea6 in main ../main.c:20
swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
aiqs4
pushed a commit
to aiqs4/wlroots
that referenced
this pull request
Dec 19, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:
==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
READ of size 8 at 0x614000000180 thread T0
#0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
swaywm#3 0x7f88e21af274 (/lib64/libinput.so.10+0x28274)
swaywm#4 0x7f88e21aff1d (/lib64/libinput.so.10+0x28f1d)
swaywm#5 0x7f88e219ddac (/lib64/libinput.so.10+0x16dac)
swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
swaywm#11 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
swaywm#13 0x559fefb52385 in main ../main.c:67
swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)
0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
freed by thread T0 here:
#0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
swaywm#4 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
previously allocated by thread T0 here:
#0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
swaywm#3 0x559fefb51ea6 in main ../main.c:20
swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
aiqs4
pushed a commit
to aiqs4/wlroots
that referenced
this pull request
Dec 19, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:
==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
READ of size 8 at 0x614000000180 thread T0
#0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
swaywm#3 0x7f88e21af274 (/lib64/libinput.so.10+0x28274)
swaywm#4 0x7f88e21aff1d (/lib64/libinput.so.10+0x28f1d)
swaywm#5 0x7f88e219ddac (/lib64/libinput.so.10+0x16dac)
swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
swaywm#11 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
swaywm#13 0x559fefb52385 in main ../main.c:67
swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)
0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
freed by thread T0 here:
#0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
swaywm#4 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
previously allocated by thread T0 here:
#0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
swaywm#3 0x559fefb51ea6 in main ../main.c:20
swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
filips
pushed a commit
to filips/wlroots
that referenced
this pull request
Mar 15, 2020
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:
==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
READ of size 8 at 0x614000000180 thread T0
#0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
swaywm#3 0x7f88e21af274 (/lib64/libinput.so.10+0x28274)
swaywm#4 0x7f88e21aff1d (/lib64/libinput.so.10+0x28f1d)
swaywm#5 0x7f88e219ddac (/lib64/libinput.so.10+0x16dac)
swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
swaywm#11 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
swaywm#13 0x559fefb52385 in main ../main.c:67
swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)
0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
freed by thread T0 here:
#0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
swaywm#4 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde)
previously allocated by thread T0 here:
#0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
swaywm#3 0x559fefb51ea6 in main ../main.c:20
swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
Xyene
added a commit
to Xyene/wlroots
that referenced
this pull request
Oct 11, 2020
Fixes swaywm#2425. wlroots can only handle one outgoing transfer at a time, so it keeps a list of pending selections. The head of the list is the currently-active selection, and when that transfer completes and is destroyed, the next one is started. The trouble is when you have a transfer to some app that is misbehaving. fcitx is one such application. With really large transfers, fcitx will hang and never wake up again. So, you can end up with a transfer list that looks like this: | swaywm#1: started | swaywm#2: pending | swaywm#3: pending | swaywm#4: pending | The file descriptor for transfer swaywm#1 is registered in libwayland's epoll loop. The rest are waiting in wlroots' list. As a user, you want your clipboard back, so you `pkill fcitx`. Now Xwayland sends `XCB_DESTROY_NOTIFY` to let us know to give up. We clean up swaywm#4 first. Due to a bug in wlroots code, we register the (fd, transfer data pointer) pair for swaywm#1 with libwayland *again*, despite it already being registered. We do this 2 more times as we remove swaywm#3 and swaywm#2. Finally, we remove swaywm#1 and `free` all the memory associated with it, before `close`-ing its transfer file descriptor. However, we still have 3 copies of swaywm#1's file descriptor left in the epoll loop, since we erroneously added them as part of removing swaywm#2/3/4. When we `close` the file descriptor as part of swaywm#1's teardown, we actually cause the epoll loop to wake up the next time around, saying "this file descriptor has activity!" (it was closed, so `read`-ing would normally return 0 to let us know of EOF). But instead of returning 0, it returns -1 with `EBADF`, because the file descriptor has already been closed. And finally, as part of error-handling this, we access the transfer pointer, which was `free`'d. And we crash.
emersion
added a commit
that referenced
this pull request
Jan 16, 2021
The GBM device needs to be destroyed after the EGL display.
==50931==ERROR: AddressSanitizer: SEGV on unknown address 0x7fe40a000049 (pc 0x7fe446121d30 bp 0x60400001bbd0 sp 0x7ffc99c774d0 T0)
==50931==The signal is caused by a READ memory access.
#0 0x7fe446121d30 (/usr/lib/dri/radeonsi_dri.so+0x5f0d30)
#1 0x7fe4474717bd (/usr/lib/../lib/libEGL_mesa.so.0+0x177bd)
#2 0x7fe4474677d9 (/usr/lib/../lib/libEGL_mesa.so.0+0xd7d9)
#3 0x7fe44cca7b6f in wlr_egl_destroy ../subprojects/wlroots/render/egl.c:379
#4 0x7fe44ccc2626 in gles2_destroy ../subprojects/wlroots/render/gles2/renderer.c:705
#5 0x7fe44ccb5041 in wlr_renderer_destroy ../subprojects/wlroots/render/wlr_renderer.c:37
#6 0x7fe44cd17850 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:296
#7 0x7fe44ccca4de in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:48
#8 0x7fe44cd11b21 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:58
#9 0x7fe44cd125b0 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:125
#10 0x7fe44c315e0e (/usr/lib/libwayland-server.so.0+0x8e0e)
#11 0x7fe44c3165a6 in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x95a6)
#12 0x55a2c8870683 in server_fini ../sway/server.c:203
#13 0x55a2c886cbf2 in main ../sway/main.c:436
#14 0x7fe44b77c151 in __libc_start_main (/usr/lib/libc.so.6+0x28151)
#15 0x55a2c883172d in _start (/home/simon/src/sway/build/sway/sway+0x33472d)
emersion
added a commit
that referenced
this pull request
Mar 16, 2021
The original motivation is the following crash:
#0 0x00007f0ddeddeef5 in raise () at /usr/lib/libc.so.6
#1 0x00007f0ddedc8862 in abort () at /usr/lib/libc.so.6
#2 0x00007f0ddedc8747 in _nl_load_domain.cold () at /usr/lib/libc.so.6
#3 0x00007f0ddedd7646 in () at /usr/lib/libc.so.6
#4 0x00007f0de033f8de in gles2_get_renderer_in_context (wlr_renderer=0x612000003640) at ../subprojects/wlroots/render/gles2/renderer.c:38
#5 0x00007f0de0341675 in gles2_begin (wlr_renderer=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/gles2/renderer.c:186
#6 0x00007f0de033b100 in wlr_renderer_begin (r=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/wlr_renderer.c:56
#7 0x00007f0de03466ed in gles2_blit_dmabuf (wlr_renderer=0x612000003640, dst_attr=0x60b000150148, src_attr=0x7fff9f9bfde0) at ../subprojects/wlroots/render/gles2/renderer.c:591
#8 0x00007f0de033d717 in wlr_renderer_blit_dmabuf (r=0x612000003640, dst=0x60b000150148, src=0x7fff9f9bfde0) at ../subprojects/wlroots/render/wlr_renderer.c:210
#9 0x00007f0de04cbc3b in frame_handle_output_commit (listener=0x611000220bc8, data=0x7fff9f9c0050) at ../subprojects/wlroots/types/wlr_screencopy_v1.c:303
The GLES2 renderer assumes it'll have a wlr_buffer to render to.
Instead of accomodating for the edge-case of rendering without a
wlr_buffer, drop wlr_renderer_blit_dmabuf calls and instead use
wlr_renderer_bind_buffer just like the rest of the wlr_renderer users.
wlr_renderer_blit_dmabuf is now unused in wlroots.
The upside is that the new blit_dmabuf function in screencopy is
renderer-agnostic.
bl4ckb0ne
pushed a commit
that referenced
this pull request
Jul 8, 2021
[1] and [2] have introduced new wl_array usage in wlroots, but
contains a mistake: wl_array_for_each iterates over pointers to
the wl_array entries, not over entries themselves.
Fix all wl_array_for_each call sites. Name the variables "ptr"
to avoid confusion.
Found via ASan:
==148752==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x602000214111 in thread T0
#0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24
#2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51
#3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306
#4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57
#5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57
#6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124
#7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e)
#8 0x55cd1a77c9e5 in server_fini ../sway/server.c:218
#9 0x55cd1a77893f in main ../sway/main.c:400
#10 0x7f6ff04bdb24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#11 0x55cd1a73a7ad in _start (/home/simon/src/sway/build/sway/sway+0x33a7ad)
0x602000214111 is located 1 bytes inside of 16-byte region [0x602000214110,0x602000214120)
freed by thread T0 here:
#0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24
#2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51
#3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306
#4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57
#5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57
#6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124
#7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e)
previously allocated by thread T0 here:
#0 0x7f6ff2236279 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7f6ff1066d03 in wl_array_add (/usr/lib/libwayland-server.so.0+0xdd03)
[1]: #3002
[2]: #3004
Emantor
added a commit
to Emantor/wlroots
that referenced
this pull request
Aug 16, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:
#0 atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
drm = 0x1ae9c10
output = 0x270f5c0
crtc = 0x0
modeset = false
active = false
mode_id = 43989232
gamma_lut = 0
prev_vrr_enabled = <optimized out>
vrr_enabled = <optimized out>
atom = {req = 0x270f5c0, failed = 48}
ok = <optimized out>
swaywm#1 0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
__PRETTY_FUNCTION__ = "drm_crtc_commit"
drm = <optimized out>
crtc = 0x0
ok = <optimized out>
swaywm#2 0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
conn = 0x270f5c0
unsupported = <optimized out>
swaywm#3 0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
conn = 0x270f5c0
swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
now = {tv_sec = 7732, tv_nsec = 623813006}
pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
back_buffer = 0x0
scale_updated = <optimized out>
geometry_updated = <optimized out>
committed = <optimized out>
event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
swaywm#5 0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
wlr_output = 0x270f5c0
output_box = <optimized out>
swaywm#6 0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
current = 0x29f38f0
name = <optimized out>
wildcard = true
id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
sway_output = 0x2710720
tmp = 0x2242030
seat = <optimized out>
swaywm#7 0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
error = <optimized out>
output = <optimized out>
background = false
swaywm#8 0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
res = <optimized out>
argc = 4
argv = 0x2a03370
handler = 0x479230 <handlers+560>
cmd = <optimized out>
matched_delim = 0 '\000'
containers = 0x0
using_criteria = false
__PRETTY_FUNCTION__ = "execute_command"
exec = 0x28f63c0 "output * dpms off"
head = 0x0
res_list = 0x2a2e9d0
swaywm#9 0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
line = <optimized out>
res_list = <optimized out>
json = <optimized out>
length = <optimized out>
__PRETTY_FUNCTION__ = "ipc_client_handle_command"
buf = 0x2975d20 "output * dpms off"
swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
pending_length = <optimized out>
pending_type = <optimized out>
client = 0x2a6ac80
read_available = 31
buf = "i3-ipc\021\000\000\000\000\000\000"
received = 14
swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
No symbol table info available.
swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
No symbol table info available.
swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
No locals.
swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
verbose = 0
debug = 0
validate = 0
allow_unsupported_gpu = 0
long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
flag = 0x0, val = 0}}
config_path = 0x0
usage = 0x45b830 "Usage: sway [options] [command]\n\n -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n -c, --config <config> Specify a config file.\n -C, --validate Check the validity of the config file, th"...
c = <optimized out>
where the second output is not enabled:
(gdb) frame 4
swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
837 in ../types/wlr_output.c
(gdb) p output->enabled
$3 = false
(gdb)
The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.
Signed-off-by: Rouven Czerwinski <rouven@czerwinskis.de>
Emantor
added a commit
to Emantor/wlroots
that referenced
this pull request
Aug 16, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:
#0 atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
drm = 0x1ae9c10
output = 0x270f5c0
crtc = 0x0
modeset = false
active = false
mode_id = 43989232
gamma_lut = 0
prev_vrr_enabled = <optimized out>
vrr_enabled = <optimized out>
atom = {req = 0x270f5c0, failed = 48}
ok = <optimized out>
swaywm#1 0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
__PRETTY_FUNCTION__ = "drm_crtc_commit"
drm = <optimized out>
crtc = 0x0
ok = <optimized out>
swaywm#2 0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
conn = 0x270f5c0
unsupported = <optimized out>
swaywm#3 0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
conn = 0x270f5c0
swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
now = {tv_sec = 7732, tv_nsec = 623813006}
pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
back_buffer = 0x0
scale_updated = <optimized out>
geometry_updated = <optimized out>
committed = <optimized out>
event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
swaywm#5 0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
wlr_output = 0x270f5c0
output_box = <optimized out>
swaywm#6 0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
current = 0x29f38f0
name = <optimized out>
wildcard = true
id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
sway_output = 0x2710720
tmp = 0x2242030
seat = <optimized out>
swaywm#7 0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
error = <optimized out>
output = <optimized out>
background = false
swaywm#8 0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
res = <optimized out>
argc = 4
argv = 0x2a03370
handler = 0x479230 <handlers+560>
cmd = <optimized out>
matched_delim = 0 '\000'
containers = 0x0
using_criteria = false
__PRETTY_FUNCTION__ = "execute_command"
exec = 0x28f63c0 "output * dpms off"
head = 0x0
res_list = 0x2a2e9d0
swaywm#9 0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
line = <optimized out>
res_list = <optimized out>
json = <optimized out>
length = <optimized out>
__PRETTY_FUNCTION__ = "ipc_client_handle_command"
buf = 0x2975d20 "output * dpms off"
swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
pending_length = <optimized out>
pending_type = <optimized out>
client = 0x2a6ac80
read_available = 31
buf = "i3-ipc\021\000\000\000\000\000\000"
received = 14
swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
No symbol table info available.
swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
No symbol table info available.
swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
No locals.
swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
verbose = 0
debug = 0
validate = 0
allow_unsupported_gpu = 0
long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
flag = 0x0, val = 0}}
config_path = 0x0
usage = 0x45b830 "Usage: sway [options] [command]\n\n -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n -c, --config <config> Specify a config file.\n -C, --validate Check the validity of the config file, th"...
c = <optimized out>
where the second output is not enabled:
(gdb) frame 4
swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
837 in ../types/wlr_output.c
(gdb) p output->enabled
$3 = false
(gdb)
The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.
Emantor
added a commit
to Emantor/wlroots
that referenced
this pull request
Aug 16, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:
#0 atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
drm = 0x1ae9c10
output = 0x270f5c0
crtc = 0x0
modeset = false
active = false
mode_id = 43989232
gamma_lut = 0
prev_vrr_enabled = <optimized out>
vrr_enabled = <optimized out>
atom = {req = 0x270f5c0, failed = 48}
ok = <optimized out>
swaywm#1 0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
__PRETTY_FUNCTION__ = "drm_crtc_commit"
drm = <optimized out>
crtc = 0x0
ok = <optimized out>
swaywm#2 0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
conn = 0x270f5c0
unsupported = <optimized out>
swaywm#3 0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
conn = 0x270f5c0
swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
now = {tv_sec = 7732, tv_nsec = 623813006}
pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
back_buffer = 0x0
scale_updated = <optimized out>
geometry_updated = <optimized out>
committed = <optimized out>
event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
swaywm#5 0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
wlr_output = 0x270f5c0
output_box = <optimized out>
swaywm#6 0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
current = 0x29f38f0
name = <optimized out>
wildcard = true
id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
sway_output = 0x2710720
tmp = 0x2242030
seat = <optimized out>
swaywm#7 0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
error = <optimized out>
output = <optimized out>
background = false
swaywm#8 0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
res = <optimized out>
argc = 4
argv = 0x2a03370
handler = 0x479230 <handlers+560>
cmd = <optimized out>
matched_delim = 0 '\000'
containers = 0x0
using_criteria = false
__PRETTY_FUNCTION__ = "execute_command"
exec = 0x28f63c0 "output * dpms off"
head = 0x0
res_list = 0x2a2e9d0
swaywm#9 0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
line = <optimized out>
res_list = <optimized out>
json = <optimized out>
length = <optimized out>
__PRETTY_FUNCTION__ = "ipc_client_handle_command"
buf = 0x2975d20 "output * dpms off"
swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
pending_length = <optimized out>
pending_type = <optimized out>
client = 0x2a6ac80
read_available = 31
buf = "i3-ipc\021\000\000\000\000\000\000"
received = 14
swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
No symbol table info available.
swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
No symbol table info available.
swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
No locals.
swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
verbose = 0
debug = 0
validate = 0
allow_unsupported_gpu = 0
long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
flag = 0x0, val = 0}}
config_path = 0x0
usage = 0x45b830 "Usage: sway [options] [command]\n\n -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n -c, --config <config> Specify a config file.\n -C, --validate Check the validity of the config file, th"...
c = <optimized out>
where the second output is not enabled:
(gdb) frame 4
swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
837 in ../types/wlr_output.c
(gdb) p output->enabled
$3 = false
(gdb)
The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.
Emantor
added a commit
to Emantor/wlroots
that referenced
this pull request
Aug 16, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:
#0 atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
drm = 0x1ae9c10
output = 0x270f5c0
crtc = 0x0
modeset = false
active = false
mode_id = 43989232
gamma_lut = 0
prev_vrr_enabled = <optimized out>
vrr_enabled = <optimized out>
atom = {req = 0x270f5c0, failed = 48}
ok = <optimized out>
swaywm#1 0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
__PRETTY_FUNCTION__ = "drm_crtc_commit"
drm = <optimized out>
crtc = 0x0
ok = <optimized out>
swaywm#2 0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
conn = 0x270f5c0
unsupported = <optimized out>
swaywm#3 0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
conn = 0x270f5c0
swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
now = {tv_sec = 7732, tv_nsec = 623813006}
pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
back_buffer = 0x0
scale_updated = <optimized out>
geometry_updated = <optimized out>
committed = <optimized out>
event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
swaywm#5 0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
wlr_output = 0x270f5c0
output_box = <optimized out>
swaywm#6 0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
current = 0x29f38f0
name = <optimized out>
wildcard = true
id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
sway_output = 0x2710720
tmp = 0x2242030
seat = <optimized out>
swaywm#7 0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
error = <optimized out>
output = <optimized out>
background = false
swaywm#8 0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
res = <optimized out>
argc = 4
argv = 0x2a03370
handler = 0x479230 <handlers+560>
cmd = <optimized out>
matched_delim = 0 '\000'
containers = 0x0
using_criteria = false
__PRETTY_FUNCTION__ = "execute_command"
exec = 0x28f63c0 "output * dpms off"
head = 0x0
res_list = 0x2a2e9d0
swaywm#9 0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
line = <optimized out>
res_list = <optimized out>
json = <optimized out>
length = <optimized out>
__PRETTY_FUNCTION__ = "ipc_client_handle_command"
buf = 0x2975d20 "output * dpms off"
swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
pending_length = <optimized out>
pending_type = <optimized out>
client = 0x2a6ac80
read_available = 31
buf = "i3-ipc\021\000\000\000\000\000\000"
received = 14
swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
No symbol table info available.
swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
No symbol table info available.
swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
No locals.
swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
verbose = 0
debug = 0
validate = 0
allow_unsupported_gpu = 0
long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
flag = 0x0, val = 0}}
config_path = 0x0
usage = 0x45b830 "Usage: sway [options] [command]\n\n -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n -c, --config <config> Specify a config file.\n -C, --validate Check the validity of the config file, th"...
c = <optimized out>
where the second output is not enabled:
(gdb) frame 4
swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
837 in ../types/wlr_output.c
(gdb) p output->enabled
$3 = false
(gdb)
The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.
Emantor
added a commit
to Emantor/wlroots
that referenced
this pull request
Aug 17, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:
#0 atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
drm = 0x1ae9c10
output = 0x270f5c0
crtc = 0x0
modeset = false
active = false
mode_id = 43989232
gamma_lut = 0
prev_vrr_enabled = <optimized out>
vrr_enabled = <optimized out>
atom = {req = 0x270f5c0, failed = 48}
ok = <optimized out>
swaywm#1 0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
__PRETTY_FUNCTION__ = "drm_crtc_commit"
drm = <optimized out>
crtc = 0x0
ok = <optimized out>
swaywm#2 0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
conn = 0x270f5c0
unsupported = <optimized out>
swaywm#3 0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
conn = 0x270f5c0
swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
now = {tv_sec = 7732, tv_nsec = 623813006}
pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
back_buffer = 0x0
scale_updated = <optimized out>
geometry_updated = <optimized out>
committed = <optimized out>
event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
swaywm#5 0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
wlr_output = 0x270f5c0
output_box = <optimized out>
swaywm#6 0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
current = 0x29f38f0
name = <optimized out>
wildcard = true
id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
sway_output = 0x2710720
tmp = 0x2242030
seat = <optimized out>
swaywm#7 0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
error = <optimized out>
output = <optimized out>
background = false
swaywm#8 0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
res = <optimized out>
argc = 4
argv = 0x2a03370
handler = 0x479230 <handlers+560>
cmd = <optimized out>
matched_delim = 0 '\000'
containers = 0x0
using_criteria = false
__PRETTY_FUNCTION__ = "execute_command"
exec = 0x28f63c0 "output * dpms off"
head = 0x0
res_list = 0x2a2e9d0
swaywm#9 0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
line = <optimized out>
res_list = <optimized out>
json = <optimized out>
length = <optimized out>
__PRETTY_FUNCTION__ = "ipc_client_handle_command"
buf = 0x2975d20 "output * dpms off"
swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
pending_length = <optimized out>
pending_type = <optimized out>
client = 0x2a6ac80
read_available = 31
buf = "i3-ipc\021\000\000\000\000\000\000"
received = 14
swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
No symbol table info available.
swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
No symbol table info available.
swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
No locals.
swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
verbose = 0
debug = 0
validate = 0
allow_unsupported_gpu = 0
long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
flag = 0x0, val = 0}}
config_path = 0x0
usage = 0x45b830 "Usage: sway [options] [command]\n\n -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n -c, --config <config> Specify a config file.\n -C, --validate Check the validity of the config file, th"...
c = <optimized out>
where the second output is not enabled:
(gdb) frame 4
swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
837 in ../types/wlr_output.c
(gdb) p output->enabled
$3 = false
(gdb)
The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.
emersion
pushed a commit
that referenced
this pull request
Aug 17, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:
#0 atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
drm = 0x1ae9c10
output = 0x270f5c0
crtc = 0x0
modeset = false
active = false
mode_id = 43989232
gamma_lut = 0
prev_vrr_enabled = <optimized out>
vrr_enabled = <optimized out>
atom = {req = 0x270f5c0, failed = 48}
ok = <optimized out>
#1 0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
__PRETTY_FUNCTION__ = "drm_crtc_commit"
drm = <optimized out>
crtc = 0x0
ok = <optimized out>
#2 0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
conn = 0x270f5c0
unsupported = <optimized out>
#3 0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
conn = 0x270f5c0
#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
now = {tv_sec = 7732, tv_nsec = 623813006}
pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
back_buffer = 0x0
scale_updated = <optimized out>
geometry_updated = <optimized out>
committed = <optimized out>
event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
#5 0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
wlr_output = 0x270f5c0
output_box = <optimized out>
#6 0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
current = 0x29f38f0
name = <optimized out>
wildcard = true
id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
sway_output = 0x2710720
tmp = 0x2242030
seat = <optimized out>
#7 0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
error = <optimized out>
output = <optimized out>
background = false
#8 0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
res = <optimized out>
argc = 4
argv = 0x2a03370
handler = 0x479230 <handlers+560>
cmd = <optimized out>
matched_delim = 0 '\000'
containers = 0x0
using_criteria = false
__PRETTY_FUNCTION__ = "execute_command"
exec = 0x28f63c0 "output * dpms off"
head = 0x0
res_list = 0x2a2e9d0
#9 0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
line = <optimized out>
res_list = <optimized out>
json = <optimized out>
length = <optimized out>
__PRETTY_FUNCTION__ = "ipc_client_handle_command"
buf = 0x2975d20 "output * dpms off"
#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
pending_length = <optimized out>
pending_type = <optimized out>
client = 0x2a6ac80
read_available = 31
buf = "i3-ipc\021\000\000\000\000\000\000"
received = 14
#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
No symbol table info available.
#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
No symbol table info available.
#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
No locals.
#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
verbose = 0
debug = 0
validate = 0
allow_unsupported_gpu = 0
long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
flag = 0x0, val = 0}}
config_path = 0x0
usage = 0x45b830 "Usage: sway [options] [command]\n\n -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n -c, --config <config> Specify a config file.\n -C, --validate Check the validity of the config file, th"...
c = <optimized out>
where the second output is not enabled:
(gdb) frame 4
#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
837 in ../types/wlr_output.c
(gdb) p output->enabled
$3 = false
(gdb)
The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.
vyivel
pushed a commit
that referenced
this pull request
Oct 29, 2021
Variables on the stack are released when the parent block is closed.
Here, `now` is used outside of the `if` block, causing the following
crash when starting Sway with the headless backend:
==49606==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fff94645f90 at pc 0x5558aeae9e29 bp 0x7fff94645df0 sp 0x7fff94645de0
READ of size 16 at 0x7fff94645f90 thread T0
#0 0x5558aeae9e28 in handle_present ../sway/desktop/output.c:834
#1 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
#2 0x7fdc8d54f77f in wlr_output_send_present ../subprojects/wlroots/types/output/output.c:766
#3 0x7fdc8d524a28 in output_commit ../subprojects/wlroots/backend/headless/output.c:71
#4 0x7fdc8d54d2db in wlr_output_commit ../subprojects/wlroots/types/output/output.c:629
#5 0x5558aeb013cb in output_render ../sway/desktop/render.c:1157
#6 0x5558aeae549e in output_repaint_timer_handler ../sway/desktop/output.c:544
#7 0x5558aeae5f8a in damage_handle_frame ../sway/desktop/output.c:606
#8 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
#9 0x7fdc8d6007d5 in output_handle_frame ../subprojects/wlroots/types/wlr_output_damage.c:44
#10 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
#11 0x7fdc8d54ee84 in wlr_output_send_frame ../subprojects/wlroots/types/output/output.c:720
#12 0x7fdc8d54efc3 in schedule_frame_handle_idle_timer ../subprojects/wlroots/types/output/output.c:728
#13 0x7fdc8c9dcf5a in wl_event_loop_dispatch_idle (/usr/lib/libwayland-server.so.0+0xaf5a)
#14 0x7fdc8c9dcfb4 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xafb4)
#15 0x7fdc8c9dabc6 in wl_display_run (/usr/lib/libwayland-server.so.0+0x8bc6)
#16 0x5558aeac8e30 in server_run ../sway/server.c:285
#17 0x5558aeac3c7d in main ../sway/main.c:396
#18 0x7fdc8be35b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#19 0x5558aea8686d in _start (/home/simon/src/sway/build/sway/sway+0x33f86d)
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Code compiles, wl_pointer is sketched in. Methods require wl_surface to continue.