Skip to content

backend: Keep a refcount on backend's current_device

Olivier Fourdan requested to merge ofourdan/mutter:last-device-use-after-free into master

Otherwise we might run into a use-after-free and crash on (virtual) device removal:

 Invalid read of size 8
   at clutter_input_device_get_device_type (clutter-input-device.c:811)
   by update_last_device (meta-backend.c:1282)
   by g_main_dispatch (gmain.c:3325)
   by g_main_context_dispatch (gmain.c:4016)
   by g_main_context_iterate.constprop.0 (gmain.c:4092)
   by g_main_loop_run (gmain.c:4290)
   by meta_run_main_loop (main.c:708)
   by meta_run (main.c:723)
   by main (main.c:550)
 Address is 32 bytes inside a block of size 504 free'd
   at free (vg_replace_malloc.c:538)
   by g_type_free_instance (gtype.c:1939)
   by clutter_event_free (clutter-event.c:1420)
   by _clutter_stage_process_queued_events (clutter-stage.c:830)
   by handle_frame_clock_before_frame (clutter-stage-view.c:1064)
   by clutter_frame_clock_dispatch (clutter-frame-clock.c:405)
   by frame_clock_source_dispatch (clutter-frame-clock.c:456)
   by g_main_dispatch (gmain.c:3325)
   by g_main_context_dispatch (gmain.c:4016)
   by g_main_context_iterate.constprop.0 (gmain.c:4092)
   by g_main_loop_run (gmain.c:4290)
   by meta_run_main_loop (main.c:708)
   by meta_run (main.c:723)
 Block was alloc'd at
   at malloc (vg_replace_malloc.c:307)
   by g_malloc (gmem.c:106)
   by g_slice_alloc (gslice.c:1025)
   by g_slice_alloc0 (gslice.c:1051)
   by g_type_create_instance (gtype.c:1839)
   by g_object_new_internal (gobject.c:1939)
   by g_object_new_valist (gobject.c:2264)
   by g_object_new (gobject.c:1782)
   by meta_input_device_native_new_virtual (meta-input-device-native.c:1365)
   by meta_virtual_input_device_native_constructed (meta-virtual-input-device-native.c:705)
   by g_object_new_internal (gobject.c:1979)
   by g_object_new_valist (gobject.c:2264)

Suggested-by: Carlos Garnacho carlosg@gnome.org

CC @carlosg

Edited by Olivier Fourdan

Merge request reports