More accurate refresh rates (mHz) #4

ascent12 · 2017-05-13T10:29:14Z

No description provided.

ddevault · 2017-05-13T13:02:59Z

include/wlr/wayland.h

-	int32_t width, height;
-	int32_t refresh; // mHz
+	uint32_t width, height;
+	uint32_t refresh; // mHz


This is actually taken straight from the wayland protocol, which uses signed integers. Why? I have no clue.

Yeah, it makes absolutely no sense for them to be negative, so I changed them. They can be changed back to signed though; it wouldn't hurt anything.

Please do. Also address the merge conflicts that were introduced by merging your other PR.

ddevault · 2017-05-13T13:40:15Z

Thanks!

When e.g. running rootston under X11 it would otherwise crash when closing rootston like: #0 0x00007f0197da7327 in wl_list_remove () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0 swaywm#1 0x000056306fcee7fb in handle_destroy (listener=0x5630723a2948, data=0x5630723a5d20) at ../rootston/layer_shell.c:273 swaywm#2 0x00007f019800a552 in wlr_signal_emit_safe (signal=0x5630723a5e30, data=0x5630723a5d20) at ../util/signal.c:29 swaywm#3 0x00007f0197fef808 in layer_surface_destroy (surface=0x5630723a5d20) at ../types/wlr_layer_shell.c:169 swaywm#4 0x00007f0197ff0001 in client_handle_destroy (resource=0x56307229c4c0) at ../types/wlr_layer_shell.c:371 swaywm#5 0x00007f0197da2f30 in () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0 swaywm#6 0x00007f0197da77f9 in () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0 swaywm#7 0x00007f0197da301d in wl_client_destroy () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0 swaywm#8 0x00007f0197da30d8 in () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0 swaywm#9 0x00007f0197da4c12 in wl_event_loop_dispatch () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0 swaywm#10 0x00007f0197da344a in wl_display_run () at /usr/lib/x86_64-linux-gnu/libwayland-server.so.0 swaywm#11 0x000056306fcef069 in main (argc=3, argv=0x7ffd22032528) at ../rootston/main.c:83 since the output_destroy got already removed in handle_output_destroy.

==12021==ERROR: AddressSanitizer: heap-use-after-free on address 0x617000015698 at pc 0x7f1a9abe1c09 bp 0x7ffe9068f6b0 sp 0x7ffe9068f6a0 WRITE of size 4 at 0x617000015698 thread T0 #0 0x7f1a9abe1c08 in pointer_handle_leave ../backend/wayland/wl_seat.c:40 swaywm#1 0x7f1a96ae7d1d in ffi_call_unix64 (/lib64/libffi.so.6+0x5d1d) swaywm#2 0x7f1a96ae768e in ffi_call (/lib64/libffi.so.6+0x568e) swaywm#3 0x7f1a988e0d8a (/lib64/libwayland-client.so.0+0x8d8a) swaywm#4 0x7f1a988dd927 (/lib64/libwayland-client.so.0+0x5927) swaywm#5 0x7f1a988debe3 in wl_display_dispatch_queue_pending (/lib64/libwayland-client.so.0+0x6be3) swaywm#6 0x7f1a9abdd6d6 in dispatch_events ../backend/wayland/backend.c:28 swaywm#7 0x7f1a9a968c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11) swaywm#8 0x7f1a9a967449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449) swaywm#9 0x418dff in main ../rootston/main.c:81 swaywm#10 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29) swaywm#11 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9) 0x617000015698 is located 664 bytes inside of 696-byte region [0x617000015400,0x6170000156b8) freed by thread T0 here: #0 0x7f1a9af754b8 in __interceptor_free (/lib64/libasan.so.4+0xde4b8) swaywm#1 0x7f1a9abe01ee in wlr_wl_output_destroy ../backend/wayland/output.c:194 swaywm#2 0x7f1a9ac12918 in wlr_output_destroy ../types/wlr_output.c:299 swaywm#3 0x7f1a9abe061b in xdg_toplevel_handle_close ../backend/wayland/output.c:255 swaywm#4 0x7f1a96ae7d1d in ffi_call_unix64 (/lib64/libffi.so.6+0x5d1d) swaywm#5 0x7f1a96ae768e in ffi_call (/lib64/libffi.so.6+0x568e) swaywm#6 0x7f1a988e0d8a (/lib64/libwayland-client.so.0+0x8d8a) swaywm#7 0x7f1a988dd927 (/lib64/libwayland-client.so.0+0x5927) swaywm#8 0x7f1a988debe3 in wl_display_dispatch_queue_pending (/lib64/libwayland-client.so.0+0x6be3) swaywm#9 0x7f1a9abdd6d6 in dispatch_events ../backend/wayland/backend.c:28 swaywm#10 0x7f1a9a968c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11) swaywm#11 0x7f1a9a967449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449) swaywm#12 0x418dff in main ../rootston/main.c:81 swaywm#13 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29) swaywm#14 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9) previously allocated by thread T0 here: #0 0x7f1a9af75a38 in __interceptor_calloc (/lib64/libasan.so.4+0xdea38) swaywm#1 0x7f1a9abe0703 in wlr_wl_output_create ../backend/wayland/output.c:272 swaywm#2 0x7f1a9abdd8eb in wlr_wl_backend_start ../backend/wayland/backend.c:55 swaywm#3 0x7f1a9abbeb49 in wlr_backend_start ../backend/backend.c:28 swaywm#4 0x7f1a9abd8ce1 in multi_backend_start ../backend/multi/backend.c:24 swaywm#5 0x7f1a9abbeb49 in wlr_backend_start ../backend/backend.c:28 swaywm#6 0x418c32 in main ../rootston/main.c:58 swaywm#7 0x7f1a99b5ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29) swaywm#8 0x4057c9 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x4057c9)

==32557==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000425f96 bp 0x7fff8ac19de0 sp 0x7fff8ac19d20 T0) ==32557==The signal is caused by a READ memory access. ==32557==Hint: address points to the zero page. #0 0x425f95 in roots_seat_set_focus ../rootston/seat.c:737 swaywm#1 0x40bcd6 in roots_cursor_press_button ../rootston/cursor.c:272 swaywm#2 0x40c1f7 in roots_cursor_handle_button ../rootston/cursor.c:298 swaywm#3 0x42179b in handle_cursor_button ../rootston/seat.c:58 swaywm#4 0x7f1651062367 in wlr_signal_emit_safe ../util/signal.c:29 swaywm#5 0x7f165101b532 in handle_pointer_button ../types/wlr_cursor.c:344 swaywm#6 0x7f1651062367 in wlr_signal_emit_safe ../util/signal.c:29 swaywm#7 0x7f1650ff633b in handle_pointer_button ../backend/libinput/pointer.c:85 swaywm#8 0x7f1650ff5291 in wlr_libinput_event ../backend/libinput/events.c:215 swaywm#9 0x7f1650ff3990 in wlr_libinput_readable ../backend/libinput/backend.c:35 swaywm#10 0x7f1650d88c11 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9c11) swaywm#11 0x7f1650d87449 in wl_display_run (/lib64/libwayland-server.so.0+0x8449) swaywm#12 0x418e90 in main ../rootston/main.c:81 swaywm#13 0x7f164ff7ef29 in __libc_start_main (/lib64/libc.so.6+0x20f29) swaywm#14 0x405829 in _start (/home/shared/wayland/wlroots/build/rootston/rootston+0x405829) introduced by swaywm#680

If an output is destroyed while an idle_done event is scheduled, it results in the following Address Sanitizer Output: ==1469==ERROR: AddressSanitizer: heap-use-after-free on address 0x6170000bb668 at pc 0x7f49aaa0c348 bp 0x7ffed5da35b0 sp 0x7ffed5da35a0 WRITE of size 8 at 0x6170000bb668 thread T0 #0 0x7f49aaa0c347 in schedule_done_handle_idle_timer ../subprojects/wlroots/types/wlr_output.c:265 swaywm#1 0x7f49aa2f875b in wl_event_loop_dispatch_idle (/usr/lib/libwayland-server.so.0+0xa75b) swaywm#2 0x7f49aa2f8815 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa815) swaywm#3 0x7f49aa2f739b in wl_display_run (/usr/lib/libwayland-server.so.0+0x939b) swaywm#4 0x556622dadd51 in server_run ../sway/server.c:216 swaywm#5 0x556622dac25d in main ../sway/main.c:397 swaywm#6 0x7f49aa0d0ce2 in __libc_start_main (/usr/lib/libc.so.6+0x23ce2) swaywm#7 0x556622d8d09d in _start (/usr/local/bin/sway+0x3909d) 0x6170000bb668 is located 488 bytes inside of 672-byte region [0x6170000bb480,0x6170000bb720) freed by thread T0 here: #0 0x7f49aabc8f89 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:66 swaywm#1 0x7f49aa968fc2 in drm_connector_destroy ../subprojects/wlroots/backend/drm/drm.c:829 swaywm#2 0x7f49aaa0cc52 in wlr_output_destroy ../subprojects/wlroots/types/wlr_output.c:357 swaywm#3 0x7f49aa96d2e9 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1265 swaywm#4 0x7f49aa961a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135 swaywm#5 0x7f49aaa2e1e9 in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29 swaywm#6 0x7f49aa98319f in udev_event ../subprojects/wlroots/backend/session/session.c:52 swaywm#7 0x7f49aa2f87f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1) previously allocated by thread T0 here: #0 0x7f49aabc95a1 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:95 swaywm#1 0x7f49aa96b7a2 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1114 swaywm#2 0x7f49aa961a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135 swaywm#3 0x7f49aaa2e1e9 in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29 swaywm#4 0x7f49aa98319f in udev_event ../subprojects/wlroots/backend/session/session.c:52 swaywm#5 0x7f49aa2f87f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1) SUMMARY: AddressSanitizer: heap-use-after-free ../subprojects/wlroots/types/wlr_output.c:265 in schedule_done_handle_idle_timer Shadow bytes around the buggy address: 0x0c2e8000f670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2e8000f680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2e8000f690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2e8000f6a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2e8000f6b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c2e8000f6c0: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd 0x0c2e8000f6d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2e8000f6e0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2e8000f6f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2e8000f700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2e8000f710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Remove the idle_done idle timer when the output is destroyed

If an output is destroyed while an idle_done event is scheduled, it results in the following Address Sanitizer Output: ==1469==ERROR: AddressSanitizer: heap-use-after-free on address 0x6170000bb668 at pc 0x7f49aaa0c348 bp 0x7ffed5da35b0 sp 0x7ffed5da35a0 WRITE of size 8 at 0x6170000bb668 thread T0 #0 0x7f49aaa0c347 in schedule_done_handle_idle_timer ../subprojects/wlroots/types/wlr_output.c:265 #1 0x7f49aa2f875b in wl_event_loop_dispatch_idle (/usr/lib/libwayland-server.so.0+0xa75b) #2 0x7f49aa2f8815 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa815) #3 0x7f49aa2f739b in wl_display_run (/usr/lib/libwayland-server.so.0+0x939b) #4 0x556622dadd51 in server_run ../sway/server.c:216 #5 0x556622dac25d in main ../sway/main.c:397 #6 0x7f49aa0d0ce2 in __libc_start_main (/usr/lib/libc.so.6+0x23ce2) #7 0x556622d8d09d in _start (/usr/local/bin/sway+0x3909d) 0x6170000bb668 is located 488 bytes inside of 672-byte region [0x6170000bb480,0x6170000bb720) freed by thread T0 here: #0 0x7f49aabc8f89 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:66 #1 0x7f49aa968fc2 in drm_connector_destroy ../subprojects/wlroots/backend/drm/drm.c:829 #2 0x7f49aaa0cc52 in wlr_output_destroy ../subprojects/wlroots/types/wlr_output.c:357 #3 0x7f49aa96d2e9 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1265 #4 0x7f49aa961a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135 #5 0x7f49aaa2e1e9 in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29 #6 0x7f49aa98319f in udev_event ../subprojects/wlroots/backend/session/session.c:52 #7 0x7f49aa2f87f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1) previously allocated by thread T0 here: #0 0x7f49aabc95a1 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:95 #1 0x7f49aa96b7a2 in scan_drm_connectors ../subprojects/wlroots/backend/drm/drm.c:1114 #2 0x7f49aa961a59 in drm_invalidated ../subprojects/wlroots/backend/drm/backend.c:135 #3 0x7f49aaa2e1e9 in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29 #4 0x7f49aa98319f in udev_event ../subprojects/wlroots/backend/session/session.c:52 #5 0x7f49aa2f87f1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa7f1) SUMMARY: AddressSanitizer: heap-use-after-free ../subprojects/wlroots/types/wlr_output.c:265 in schedule_done_handle_idle_timer Shadow bytes around the buggy address: 0x0c2e8000f670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2e8000f680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2e8000f690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2e8000f6a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2e8000f6b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c2e8000f6c0: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd 0x0c2e8000f6d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2e8000f6e0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2e8000f6f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2e8000f700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2e8000f710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Remove the idle_done idle timer when the output is destroyed

This fixes a heap-use-after-free when the session is destroyed before the backend during wl_display_destroy: ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80 READ of size 8 at 0x614000000180 thread T0 #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192 #1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204 #2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24 swaywm#3 0x7f88e21af274 (/lib64/libinput.so.10+0x28274) swaywm#4 0x7f88e21aff1d (/lib64/libinput.so.10+0x28f1d) swaywm#5 0x7f88e219ddac (/lib64/libinput.so.10+0x16dac) swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d) swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130 swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50 swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54 swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107 swaywm#11 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde) swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466) swaywm#13 0x559fefb52385 in main ../main.c:67 swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152) swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d) 0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0) freed by thread T0 here: #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122 #1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270 #2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156 swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65 swaywm#4 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde) previously allocated by thread T0 here: #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153 #1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746 #2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91 swaywm#3 0x559fefb51ea6 in main ../main.c:20 swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)

This fixes a heap-use-after-free when the session is destroyed before the backend during wl_display_destroy: ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80 READ of size 8 at 0x614000000180 thread T0 #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192 #1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204 #2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24 #3 0x7f88e21af274 (/lib64/libinput.so.10+0x28274) #4 0x7f88e21aff1d (/lib64/libinput.so.10+0x28f1d) #5 0x7f88e219ddac (/lib64/libinput.so.10+0x16dac) #6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d) #7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130 #8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50 #9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54 #10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107 #11 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde) #12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466) #13 0x559fefb52385 in main ../main.c:67 #14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152) #15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d) 0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0) freed by thread T0 here: #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122 #1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270 #2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156 #3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65 #4 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde) previously allocated by thread T0 here: #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153 #1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746 #2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91 #3 0x559fefb51ea6 in main ../main.c:20 #4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)

This fixes a heap-use-after-free when the session is destroyed before the backend during wl_display_destroy: ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80 READ of size 8 at 0x614000000180 thread T0 #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192 swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204 swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24 swaywm#3 0x7f88e21af274 (/lib64/libinput.so.10+0x28274) swaywm#4 0x7f88e21aff1d (/lib64/libinput.so.10+0x28f1d) swaywm#5 0x7f88e219ddac (/lib64/libinput.so.10+0x16dac) swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d) swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130 swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50 swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54 swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107 swaywm#11 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde) swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466) swaywm#13 0x559fefb52385 in main ../main.c:67 swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152) swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d) 0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0) freed by thread T0 here: #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122 swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270 swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156 swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65 swaywm#4 0x7f88e314acde (/lib64/libwayland-server.so.0+0x8cde) previously allocated by thread T0 here: #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153 swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746 swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91 swaywm#3 0x559fefb51ea6 in main ../main.c:20 swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)

Fixes swaywm#2425. wlroots can only handle one outgoing transfer at a time, so it keeps a list of pending selections. The head of the list is the currently-active selection, and when that transfer completes and is destroyed, the next one is started. The trouble is when you have a transfer to some app that is misbehaving. fcitx is one such application. With really large transfers, fcitx will hang and never wake up again. So, you can end up with a transfer list that looks like this: | swaywm#1: started | swaywm#2: pending | swaywm#3: pending | swaywm#4: pending | The file descriptor for transfer swaywm#1 is registered in libwayland's epoll loop. The rest are waiting in wlroots' list. As a user, you want your clipboard back, so you `pkill fcitx`. Now Xwayland sends `XCB_DESTROY_NOTIFY` to let us know to give up. We clean up swaywm#4 first. Due to a bug in wlroots code, we register the (fd, transfer data pointer) pair for swaywm#1 with libwayland *again*, despite it already being registered. We do this 2 more times as we remove swaywm#3 and swaywm#2. Finally, we remove swaywm#1 and `free` all the memory associated with it, before `close`-ing its transfer file descriptor. However, we still have 3 copies of swaywm#1's file descriptor left in the epoll loop, since we erroneously added them as part of removing swaywm#2/3/4. When we `close` the file descriptor as part of swaywm#1's teardown, we actually cause the epoll loop to wake up the next time around, saying "this file descriptor has activity!" (it was closed, so `read`-ing would normally return 0 to let us know of EOF). But instead of returning 0, it returns -1 with `EBADF`, because the file descriptor has already been closed. And finally, as part of error-handling this, we access the transfer pointer, which was `free`'d. And we crash.

The GBM device needs to be destroyed after the EGL display. ==50931==ERROR: AddressSanitizer: SEGV on unknown address 0x7fe40a000049 (pc 0x7fe446121d30 bp 0x60400001bbd0 sp 0x7ffc99c774d0 T0) ==50931==The signal is caused by a READ memory access. #0 0x7fe446121d30 (/usr/lib/dri/radeonsi_dri.so+0x5f0d30) #1 0x7fe4474717bd (/usr/lib/../lib/libEGL_mesa.so.0+0x177bd) #2 0x7fe4474677d9 (/usr/lib/../lib/libEGL_mesa.so.0+0xd7d9) #3 0x7fe44cca7b6f in wlr_egl_destroy ../subprojects/wlroots/render/egl.c:379 #4 0x7fe44ccc2626 in gles2_destroy ../subprojects/wlroots/render/gles2/renderer.c:705 #5 0x7fe44ccb5041 in wlr_renderer_destroy ../subprojects/wlroots/render/wlr_renderer.c:37 #6 0x7fe44cd17850 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:296 #7 0x7fe44ccca4de in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:48 #8 0x7fe44cd11b21 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:58 #9 0x7fe44cd125b0 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:125 #10 0x7fe44c315e0e (/usr/lib/libwayland-server.so.0+0x8e0e) #11 0x7fe44c3165a6 in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x95a6) #12 0x55a2c8870683 in server_fini ../sway/server.c:203 #13 0x55a2c886cbf2 in main ../sway/main.c:436 #14 0x7fe44b77c151 in __libc_start_main (/usr/lib/libc.so.6+0x28151) #15 0x55a2c883172d in _start (/home/simon/src/sway/build/sway/sway+0x33472d)

The original motivation is the following crash: #0 0x00007f0ddeddeef5 in raise () at /usr/lib/libc.so.6 #1 0x00007f0ddedc8862 in abort () at /usr/lib/libc.so.6 #2 0x00007f0ddedc8747 in _nl_load_domain.cold () at /usr/lib/libc.so.6 swaywm#3 0x00007f0ddedd7646 in () at /usr/lib/libc.so.6 swaywm#4 0x00007f0de033f8de in gles2_get_renderer_in_context (wlr_renderer=0x612000003640) at ../subprojects/wlroots/render/gles2/renderer.c:38 swaywm#5 0x00007f0de0341675 in gles2_begin (wlr_renderer=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/gles2/renderer.c:186 swaywm#6 0x00007f0de033b100 in wlr_renderer_begin (r=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/wlr_renderer.c:56 swaywm#7 0x00007f0de03466ed in gles2_blit_dmabuf (wlr_renderer=0x612000003640, dst_attr=0x60b000150148, src_attr=0x7fff9f9bfde0) at ../subprojects/wlroots/render/gles2/renderer.c:591 swaywm#8 0x00007f0de033d717 in wlr_renderer_blit_dmabuf (r=0x612000003640, dst=0x60b000150148, src=0x7fff9f9bfde0) at ../subprojects/wlroots/render/wlr_renderer.c:210 swaywm#9 0x00007f0de04cbc3b in frame_handle_output_commit (listener=0x611000220bc8, data=0x7fff9f9c0050) at ../subprojects/wlroots/types/wlr_screencopy_v1.c:303 The GLES2 renderer assumes it'll have a wlr_buffer to render to. Instead of accomodating for the edge-case of rendering without a wlr_buffer, drop wlr_renderer_blit_dmabuf calls and instead use wlr_renderer_bind_buffer just like the rest of the wlr_renderer users. wlr_renderer_blit_dmabuf is now unused in wlroots. The upside is that the new blit_dmabuf function in screencopy is renderer-agnostic.

The original motivation is the following crash: #0 0x00007f0ddeddeef5 in raise () at /usr/lib/libc.so.6 #1 0x00007f0ddedc8862 in abort () at /usr/lib/libc.so.6 #2 0x00007f0ddedc8747 in _nl_load_domain.cold () at /usr/lib/libc.so.6 #3 0x00007f0ddedd7646 in () at /usr/lib/libc.so.6 #4 0x00007f0de033f8de in gles2_get_renderer_in_context (wlr_renderer=0x612000003640) at ../subprojects/wlroots/render/gles2/renderer.c:38 #5 0x00007f0de0341675 in gles2_begin (wlr_renderer=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/gles2/renderer.c:186 #6 0x00007f0de033b100 in wlr_renderer_begin (r=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/wlr_renderer.c:56 #7 0x00007f0de03466ed in gles2_blit_dmabuf (wlr_renderer=0x612000003640, dst_attr=0x60b000150148, src_attr=0x7fff9f9bfde0) at ../subprojects/wlroots/render/gles2/renderer.c:591 #8 0x00007f0de033d717 in wlr_renderer_blit_dmabuf (r=0x612000003640, dst=0x60b000150148, src=0x7fff9f9bfde0) at ../subprojects/wlroots/render/wlr_renderer.c:210 #9 0x00007f0de04cbc3b in frame_handle_output_commit (listener=0x611000220bc8, data=0x7fff9f9c0050) at ../subprojects/wlroots/types/wlr_screencopy_v1.c:303 The GLES2 renderer assumes it'll have a wlr_buffer to render to. Instead of accomodating for the edge-case of rendering without a wlr_buffer, drop wlr_renderer_blit_dmabuf calls and instead use wlr_renderer_bind_buffer just like the rest of the wlr_renderer users. wlr_renderer_blit_dmabuf is now unused in wlroots. The upside is that the new blit_dmabuf function in screencopy is renderer-agnostic.

[1] and [2] have introduced new wl_array usage in wlroots, but contains a mistake: wl_array_for_each iterates over pointers to the wl_array entries, not over entries themselves. Fix all wl_array_for_each call sites. Name the variables "ptr" to avoid confusion. Found via ASan: ==148752==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x602000214111 in thread T0 #0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127 #1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24 #2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51 swaywm#3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306 swaywm#4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57 swaywm#5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57 swaywm#6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124 swaywm#7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e) swaywm#8 0x55cd1a77c9e5 in server_fini ../sway/server.c:218 swaywm#9 0x55cd1a77893f in main ../sway/main.c:400 swaywm#10 0x7f6ff04bdb24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24) swaywm#11 0x55cd1a73a7ad in _start (/home/simon/src/sway/build/sway/sway+0x33a7ad) 0x602000214111 is located 1 bytes inside of 16-byte region [0x602000214110,0x602000214120) freed by thread T0 here: #0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127 #1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24 #2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51 swaywm#3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306 swaywm#4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57 swaywm#5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57 swaywm#6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124 swaywm#7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e) previously allocated by thread T0 here: #0 0x7f6ff2236279 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145 #1 0x7f6ff1066d03 in wl_array_add (/usr/lib/libwayland-server.so.0+0xdd03) [1]: swaywm#3002 [2]: swaywm#3004

[1] and [2] have introduced new wl_array usage in wlroots, but contains a mistake: wl_array_for_each iterates over pointers to the wl_array entries, not over entries themselves. Fix all wl_array_for_each call sites. Name the variables "ptr" to avoid confusion. Found via ASan: ==148752==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x602000214111 in thread T0 #0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127 #1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24 #2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51 #3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306 #4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57 #5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57 #6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124 #7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e) #8 0x55cd1a77c9e5 in server_fini ../sway/server.c:218 #9 0x55cd1a77893f in main ../sway/main.c:400 #10 0x7f6ff04bdb24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24) #11 0x55cd1a73a7ad in _start (/home/simon/src/sway/build/sway/sway+0x33a7ad) 0x602000214111 is located 1 bytes inside of 16-byte region [0x602000214110,0x602000214120) freed by thread T0 here: #0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127 #1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24 #2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51 #3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306 #4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57 #5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57 #6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124 #7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e) previously allocated by thread T0 here: #0 0x7f6ff2236279 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145 #1 0x7f6ff1066d03 in wl_array_add (/usr/lib/libwayland-server.so.0+0xdd03) [1]: #3002 [2]: #3004

This should fix the following backtrace, seen on my desktop with one output disabled: #0 atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178 drm = 0x1ae9c10 output = 0x270f5c0 crtc = 0x0 modeset = false active = false mode_id = 43989232 gamma_lut = 0 prev_vrr_enabled = <optimized out> vrr_enabled = <optimized out> atom = {req = 0x270f5c0, failed = 48} ok = <optimized out> swaywm#1 0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339 __PRETTY_FUNCTION__ = "drm_crtc_commit" drm = <optimized out> crtc = 0x0 ok = <optimized out> swaywm#2 0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488 conn = 0x270f5c0 unsupported = <optimized out> swaywm#3 0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578 conn = 0x270f5c0 swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837 now = {tv_sec = 7732, tv_nsec = 623813006} pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570} back_buffer = 0x0 scale_updated = <optimized out> geometry_updated = <optimized out> committed = <optimized out> event = {output = 0x0, committed = 4401048, when = 0x29f38f0} swaywm#5 0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431 wlr_output = 0x270f5c0 output_box = <optimized out> swaywm#6 0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649 current = 0x29f38f0 name = <optimized out> wildcard = true id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000" sway_output = 0x2710720 tmp = 0x2242030 seat = <optimized out> swaywm#7 0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108 error = <optimized out> output = <optimized out> background = false swaywm#8 0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291 res = <optimized out> argc = 4 argv = 0x2a03370 handler = 0x479230 <handlers+560> cmd = <optimized out> matched_delim = 0 '\000' containers = 0x0 using_criteria = false __PRETTY_FUNCTION__ = "execute_command" exec = 0x28f63c0 "output * dpms off" head = 0x0 res_list = 0x2a2e9d0 swaywm#9 0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645 line = <optimized out> res_list = <optimized out> json = <optimized out> length = <optimized out> __PRETTY_FUNCTION__ = "ipc_client_handle_command" buf = 0x2975d20 "output * dpms off" swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267 pending_length = <optimized out> pending_type = <optimized out> client = 0x2a6ac80 read_available = 31 buf = "i3-ipc\021\000\000\000\000\000\000" received = 14 swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0 No symbol table info available. swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0 No symbol table info available. swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261 No locals. swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395 verbose = 0 debug = 0 validate = 0 allow_unsupported_gpu = 0 long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, { name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath", has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} config_path = 0x0 usage = 0x45b830 "Usage: sway [options] [command]\n\n -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n -c, --config <config> Specify a config file.\n -C, --validate Check the validity of the config file, th"... c = <optimized out> where the second output is not enabled: (gdb) frame 4 swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837 837 in ../types/wlr_output.c (gdb) p output->enabled $3 = false (gdb) The culprit being that since 604674d we always try to perform a commit, even on a disabled output. Signed-off-by: Rouven Czerwinski <rouven@czerwinskis.de>

This should fix the following backtrace, seen on my desktop with one output disabled: #0 atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178 drm = 0x1ae9c10 output = 0x270f5c0 crtc = 0x0 modeset = false active = false mode_id = 43989232 gamma_lut = 0 prev_vrr_enabled = <optimized out> vrr_enabled = <optimized out> atom = {req = 0x270f5c0, failed = 48} ok = <optimized out> swaywm#1 0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339 __PRETTY_FUNCTION__ = "drm_crtc_commit" drm = <optimized out> crtc = 0x0 ok = <optimized out> swaywm#2 0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488 conn = 0x270f5c0 unsupported = <optimized out> swaywm#3 0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578 conn = 0x270f5c0 swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837 now = {tv_sec = 7732, tv_nsec = 623813006} pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570} back_buffer = 0x0 scale_updated = <optimized out> geometry_updated = <optimized out> committed = <optimized out> event = {output = 0x0, committed = 4401048, when = 0x29f38f0} swaywm#5 0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431 wlr_output = 0x270f5c0 output_box = <optimized out> swaywm#6 0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649 current = 0x29f38f0 name = <optimized out> wildcard = true id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000" sway_output = 0x2710720 tmp = 0x2242030 seat = <optimized out> swaywm#7 0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108 error = <optimized out> output = <optimized out> background = false swaywm#8 0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291 res = <optimized out> argc = 4 argv = 0x2a03370 handler = 0x479230 <handlers+560> cmd = <optimized out> matched_delim = 0 '\000' containers = 0x0 using_criteria = false __PRETTY_FUNCTION__ = "execute_command" exec = 0x28f63c0 "output * dpms off" head = 0x0 res_list = 0x2a2e9d0 swaywm#9 0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645 line = <optimized out> res_list = <optimized out> json = <optimized out> length = <optimized out> __PRETTY_FUNCTION__ = "ipc_client_handle_command" buf = 0x2975d20 "output * dpms off" swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267 pending_length = <optimized out> pending_type = <optimized out> client = 0x2a6ac80 read_available = 31 buf = "i3-ipc\021\000\000\000\000\000\000" received = 14 swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0 No symbol table info available. swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0 No symbol table info available. swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261 No locals. swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395 verbose = 0 debug = 0 validate = 0 allow_unsupported_gpu = 0 long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, { name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath", has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} config_path = 0x0 usage = 0x45b830 "Usage: sway [options] [command]\n\n -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n -c, --config <config> Specify a config file.\n -C, --validate Check the validity of the config file, th"... c = <optimized out> where the second output is not enabled: (gdb) frame 4 swaywm#4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837 837 in ../types/wlr_output.c (gdb) p output->enabled $3 = false (gdb) The culprit being that since 604674d we always try to perform a commit, even on a disabled output.

This should fix the following backtrace, seen on my desktop with one output disabled: #0 atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178 drm = 0x1ae9c10 output = 0x270f5c0 crtc = 0x0 modeset = false active = false mode_id = 43989232 gamma_lut = 0 prev_vrr_enabled = <optimized out> vrr_enabled = <optimized out> atom = {req = 0x270f5c0, failed = 48} ok = <optimized out> #1 0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339 __PRETTY_FUNCTION__ = "drm_crtc_commit" drm = <optimized out> crtc = 0x0 ok = <optimized out> #2 0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488 conn = 0x270f5c0 unsupported = <optimized out> #3 0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578 conn = 0x270f5c0 #4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837 now = {tv_sec = 7732, tv_nsec = 623813006} pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570} back_buffer = 0x0 scale_updated = <optimized out> geometry_updated = <optimized out> committed = <optimized out> event = {output = 0x0, committed = 4401048, when = 0x29f38f0} #5 0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431 wlr_output = 0x270f5c0 output_box = <optimized out> #6 0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649 current = 0x29f38f0 name = <optimized out> wildcard = true id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000" sway_output = 0x2710720 tmp = 0x2242030 seat = <optimized out> #7 0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108 error = <optimized out> output = <optimized out> background = false #8 0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291 res = <optimized out> argc = 4 argv = 0x2a03370 handler = 0x479230 <handlers+560> cmd = <optimized out> matched_delim = 0 '\000' containers = 0x0 using_criteria = false __PRETTY_FUNCTION__ = "execute_command" exec = 0x28f63c0 "output * dpms off" head = 0x0 res_list = 0x2a2e9d0 #9 0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645 line = <optimized out> res_list = <optimized out> json = <optimized out> length = <optimized out> __PRETTY_FUNCTION__ = "ipc_client_handle_command" buf = 0x2975d20 "output * dpms off" #10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267 pending_length = <optimized out> pending_type = <optimized out> client = 0x2a6ac80 read_available = 31 buf = "i3-ipc\021\000\000\000\000\000\000" received = 14 #11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0 No symbol table info available. #12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0 No symbol table info available. #13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261 No locals. #14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395 verbose = 0 debug = 0 validate = 0 allow_unsupported_gpu = 0 long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, { name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath", has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} config_path = 0x0 usage = 0x45b830 "Usage: sway [options] [command]\n\n -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n -c, --config <config> Specify a config file.\n -C, --validate Check the validity of the config file, th"... c = <optimized out> where the second output is not enabled: (gdb) frame 4 #4 0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837 837 in ../types/wlr_output.c (gdb) p output->enabled $3 = false (gdb) The culprit being that since 604674d we always try to perform a commit, even on a disabled output.

Variables on the stack are released when the parent block is closed. Here, `now` is used outside of the `if` block, causing the following crash when starting Sway with the headless backend: ==49606==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fff94645f90 at pc 0x5558aeae9e29 bp 0x7fff94645df0 sp 0x7fff94645de0 READ of size 16 at 0x7fff94645f90 thread T0 #0 0x5558aeae9e28 in handle_present ../sway/desktop/output.c:834 #1 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29 #2 0x7fdc8d54f77f in wlr_output_send_present ../subprojects/wlroots/types/output/output.c:766 swaywm#3 0x7fdc8d524a28 in output_commit ../subprojects/wlroots/backend/headless/output.c:71 swaywm#4 0x7fdc8d54d2db in wlr_output_commit ../subprojects/wlroots/types/output/output.c:629 swaywm#5 0x5558aeb013cb in output_render ../sway/desktop/render.c:1157 swaywm#6 0x5558aeae549e in output_repaint_timer_handler ../sway/desktop/output.c:544 swaywm#7 0x5558aeae5f8a in damage_handle_frame ../sway/desktop/output.c:606 swaywm#8 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29 swaywm#9 0x7fdc8d6007d5 in output_handle_frame ../subprojects/wlroots/types/wlr_output_damage.c:44 swaywm#10 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29 swaywm#11 0x7fdc8d54ee84 in wlr_output_send_frame ../subprojects/wlroots/types/output/output.c:720 swaywm#12 0x7fdc8d54efc3 in schedule_frame_handle_idle_timer ../subprojects/wlroots/types/output/output.c:728 swaywm#13 0x7fdc8c9dcf5a in wl_event_loop_dispatch_idle (/usr/lib/libwayland-server.so.0+0xaf5a) swaywm#14 0x7fdc8c9dcfb4 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xafb4) swaywm#15 0x7fdc8c9dabc6 in wl_display_run (/usr/lib/libwayland-server.so.0+0x8bc6) swaywm#16 0x5558aeac8e30 in server_run ../sway/server.c:285 swaywm#17 0x5558aeac3c7d in main ../sway/main.c:396 swaywm#18 0x7fdc8be35b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24) swaywm#19 0x5558aea8686d in _start (/home/simon/src/sway/build/sway/sway+0x33f86d)

Variables on the stack are released when the parent block is closed. Here, `now` is used outside of the `if` block, causing the following crash when starting Sway with the headless backend: ==49606==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fff94645f90 at pc 0x5558aeae9e29 bp 0x7fff94645df0 sp 0x7fff94645de0 READ of size 16 at 0x7fff94645f90 thread T0 #0 0x5558aeae9e28 in handle_present ../sway/desktop/output.c:834 #1 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29 #2 0x7fdc8d54f77f in wlr_output_send_present ../subprojects/wlroots/types/output/output.c:766 #3 0x7fdc8d524a28 in output_commit ../subprojects/wlroots/backend/headless/output.c:71 #4 0x7fdc8d54d2db in wlr_output_commit ../subprojects/wlroots/types/output/output.c:629 #5 0x5558aeb013cb in output_render ../sway/desktop/render.c:1157 #6 0x5558aeae549e in output_repaint_timer_handler ../sway/desktop/output.c:544 #7 0x5558aeae5f8a in damage_handle_frame ../sway/desktop/output.c:606 #8 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29 #9 0x7fdc8d6007d5 in output_handle_frame ../subprojects/wlroots/types/wlr_output_damage.c:44 #10 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29 #11 0x7fdc8d54ee84 in wlr_output_send_frame ../subprojects/wlroots/types/output/output.c:720 #12 0x7fdc8d54efc3 in schedule_frame_handle_idle_timer ../subprojects/wlroots/types/output/output.c:728 #13 0x7fdc8c9dcf5a in wl_event_loop_dispatch_idle (/usr/lib/libwayland-server.so.0+0xaf5a) #14 0x7fdc8c9dcfb4 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xafb4) #15 0x7fdc8c9dabc6 in wl_display_run (/usr/lib/libwayland-server.so.0+0x8bc6) #16 0x5558aeac8e30 in server_run ../sway/server.c:285 #17 0x5558aeac3c7d in main ../sway/main.c:396 #18 0x7fdc8be35b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24) #19 0x5558aea8686d in _start (/home/simon/src/sway/build/sway/sway+0x33f86d)

ascent12 added 2 commits May 13, 2017 20:37

DPMS support

599d1bc

More accurate refresh rates (mHz)

3000b86

ddevault reviewed May 13, 2017

View reviewed changes

ascent12 added 2 commits May 14, 2017 01:24

Merge branch 'master' into refresh

eac603b

Changed to signed

409065b

ddevault merged commit 66e02e9 into swaywm:master May 13, 2017

ascent12 deleted the refresh branch May 13, 2017 13:53

martinetd mentioned this pull request Aug 18, 2017

output: default scale to 1 #104

Merged

martinetd mentioned this pull request Nov 1, 2017

rootston: fix startup with no config #366

Merged

acrisci mentioned this pull request Nov 19, 2017

rootston: xwayland ready listener #432

Merged

acrisci mentioned this pull request Jun 23, 2018

Implement pointer-constraints-unstable-v1 protocol #852

Merged

soreau mentioned this pull request Nov 6, 2018

rootston: blackscreen and freeze after switching to and from X #1359

Closed

wsinnema mentioned this pull request Feb 11, 2019

Rootston crashes when used with tablet tool #1536

Closed

Emantor mentioned this pull request May 30, 2019

wlr_output: remove idle_done on output destroy #1708

Merged

jpeeler mentioned this pull request Nov 18, 2019

sway 1.2 freezing (but not crashing) after monitors power back on #1857

Open

alejor mentioned this pull request May 5, 2020

Crash when menu popup open and cursor gets out quickly #2161

Closed

travankor mentioned this pull request Aug 31, 2020

Crash with chromium ozone #2056

Open

vyivel mentioned this pull request Sep 18, 2021

libseat/backend/seatd: fatal error when switching VTs #3200

Closed

pelikan mentioned this pull request Sep 25, 2021

unlink wlr_device from wlr_session before calling libseat #3219

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

More accurate refresh rates (mHz) #4

More accurate refresh rates (mHz) #4

ascent12 commented May 13, 2017

ddevault May 13, 2017

ascent12 May 13, 2017

ddevault May 13, 2017

ddevault commented May 13, 2017

More accurate refresh rates (mHz) #4

More accurate refresh rates (mHz) #4

Conversation

ascent12 commented May 13, 2017

ddevault May 13, 2017

Choose a reason for hiding this comment

ascent12 May 13, 2017

Choose a reason for hiding this comment

ddevault May 13, 2017

Choose a reason for hiding this comment

ddevault commented May 13, 2017