Repository navigation
rdp-backend/rdprail-shell debug message rearrangement - #15
Merged
Merged
Conversation
Steve Pronovost (spronovo)
approved these changes
May 23, 2021
Hideyuki Nagase (hideyukn88)
pushed a commit
that referenced
this pull request
Oct 20, 2021
Found by Address sanitizer on test-devices:
==10640==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000000580 at pc 0x7fa0f050dcd1 bp 0x7fff41c908e0 sp 0x7fff41c908d8
WRITE of size 8 at 0x60c000000580 thread T0
#0 0x7fa0f050dcd0 in unbind_input_method ../../git/weston/compositor/text-backend.c:852
#1 0x7fa0efd1b20d in destroy_resource ../../git/wayland/src/wayland-server.c:724
#2 0x7fa0efd1f7f1 in for_each_helper ../../git/wayland/src/wayland-util.c:372
#3 0x7fa0efd1fcde in wl_map_for_each ../../git/wayland/src/wayland-util.c:385
#4 0x7fa0efd1b35c in wl_client_destroy ../../git/wayland/src/wayland-server.c:883
#5 0x7fa0f050ea82 in text_backend_destroy ../../git/weston/compositor/text-backend.c:1067
#6 0x7fa0ebb69f2f in shell_destroy ../../git/weston/desktop-shell/shell.c:5012
#7 0x7fa0efd55933 in wl_signal_emit /home/pq/local/include/wayland-server-core.h:478
#8 0x7fa0efd7d061 in weston_compositor_destroy ../../git/weston/libweston/compositor.c:7896
#9 0x7fa0f050a349 in wet_main ../../git/weston/compositor/main.c:3493
#10 0x559c1e794354 in execute_compositor ../../git/weston/tests/weston-test-fixture-compositor.c:432
#11 0x559c1e797dc0 in weston_test_harness_execute_as_client ../../git/weston/tests/weston-test-runner.c:528
#12 0x559c1e786ab8 in fixture_setup ../../git/weston/tests/devices-test.c:39
#13 0x559c1e786b3a in fixture_setup_run_ ../../git/weston/tests/devices-test.c:41
#14 0x559c1e798375 in main ../../git/weston/tests/weston-test-runner.c:661
#15 0x7fa0f016e09a in __libc_start_main ../csu/libc-start.c:308
#16 0x559c1e786769 in _start (/home/pq/build/weston-meson/tests/test-devices+0xc769)
0x60c000000580 is located 0 bytes inside of 120-byte region [0x60c000000580,0x60c0000005f8)
freed by thread T0 here:
#0 0x7fa0f0618fb0 in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0xe8fb0)
#1 0x7fa0f050df1d in input_method_notifier_destroy ../../git/weston/compositor/text-backend.c:902
#2 0x7fa0efd86d77 in wl_signal_emit /home/pq/local/include/wayland-server-core.h:478
#3 0x7fa0efd98086 in weston_seat_release ../../git/weston/libweston/input.c:3475
#4 0x7fa0ebb0d002 in test_seat_release ../../git/weston/tests/weston-test.c:132
#5 0x7fa0ebb0e197 in device_release ../../git/weston/tests/weston-test.c:314
#6 0x7fa0efca88ed in ffi_call_unix64 (/lib/x86_64-linux-gnu/libffi.so.6+0x68ed)
previously allocated by thread T0 here:
#0 0x7fa0f0619518 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0xe9518)
#1 0x7fa0f050a8bf in zalloc ../../git/weston/include/libweston/zalloc.h:38
#2 0x7fa0f050e6f1 in text_backend_seat_created ../../git/weston/compositor/text-backend.c:1011
#3 0x7fa0f050e947 in handle_seat_created ../../git/weston/compositor/text-backend.c:1040
#4 0x7fa0efd86d77 in wl_signal_emit /home/pq/local/include/wayland-server-core.h:478
#5 0x7fa0efd97d57 in weston_seat_init ../../git/weston/libweston/input.c:3440
#6 0x7fa0ebb0ce4b in test_seat_init ../../git/weston/tests/weston-test.c:110
#7 0x7fa0ebb0f699 in wet_module_init ../../git/weston/tests/weston-test.c:592
#8 0x7fa0f04f8d69 in wet_load_module ../../git/weston/compositor/main.c:941
#9 0x7fa0f04f914d in load_modules ../../git/weston/compositor/main.c:1012
#10 0x7fa0f0509ec1 in wet_main ../../git/weston/compositor/main.c:3441
#11 0x559c1e794354 in execute_compositor ../../git/weston/tests/weston-test-fixture-compositor.c:432
#12 0x559c1e797dc0 in weston_test_harness_execute_as_client ../../git/weston/tests/weston-test-runner.c:528
#13 0x559c1e786ab8 in fixture_setup ../../git/weston/tests/devices-test.c:39
#14 0x559c1e786b3a in fixture_setup_run_ ../../git/weston/tests/devices-test.c:41
#15 0x559c1e798375 in main ../../git/weston/tests/weston-test-runner.c:661
#16 0x7fa0f016e09a in __libc_start_main ../csu/libc-start.c:308
Fix UAF by resetting wl_resource user data, and ensuring it is valid
before used.
Setting seat->input_method to NULL may not be necessary since it is
being called from seat destroy listener, but added just in case.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.com>
Hideyuki Nagase (hideyukn88)
pushed a commit
that referenced
this pull request
Oct 20, 2021
Avoids an user-after-free when destroying the surface, like in the
following ASAN message:
==25180==ERROR: AddressSanitizer: heap-use-after-free on address 0x6060000589d8 at pc 0x7ff70a4f7102 bp 0x7fff8f7e13b0 sp 0x7fff8f7e13a8
READ of size 8 at 0x6060000589d8 thread T0
#0 0x7ff70a4f7101 in weston_schedule_surface_protection_update ../libweston/compositor.c:1163
#1 0x7ff70a4f743b in weston_surface_update_output_mask ../libweston/compositor.c:1212
#2 0x7ff70a4f7a47 in weston_surface_assign_output ../libweston/compositor.c:1298
#3 0x7ff70a4f7f44 in weston_view_assign_output ../libweston/compositor.c:1348
#4 0x7ff70a4fa12f in weston_view_update_transform ../libweston/compositor.c:1589
#5 0x7ff70a4ffc20 in view_list_add ../libweston/compositor.c:2657
#6 0x7ff70a5000ee in weston_compositor_build_view_list ../libweston/compositor.c:2688
#7 0x7ff70a4fd577 in weston_view_destroy ../libweston/compositor.c:2202
#8 0x7ff70a4fd7df in weston_surface_destroy ../libweston/compositor.c:2239
#9 0x7ff70a4fdbb0 in destroy_surface ../libweston/compositor.c:2285
#10 0x7ff70a4a2d3e in destroy_resource ../src/wayland-server.c:723
#11 0x7ff70a4a8940 in for_each_helper ../src/wayland-util.c:372
#12 0x7ff70a4a8e1f in wl_map_for_each ../src/wayland-util.c:385
#13 0x7ff70a4a3748 in wl_client_destroy ../src/wayland-server.c:882
#14 0x7ff6fe04e866 in shell_destroy ../desktop-shell/shell.c:5004
#15 0x7ff70a4ee923 in wl_signal_emit /home/mvlad/install-amd64/include/wayland-server-core.h:481
#16 0x7ff70a51598d in weston_compositor_destroy ../libweston/compositor.c:7903
#17 0x7ff70a903a58 in wet_main ../compositor/main.c:3493
#18 0x560de7b3b179 in main ../compositor/executable.c:33
#19 0x7ff70a73ecc9 in __libc_start_main ../csu/libc-start.c:308
#20 0x560de7b3b099 in _start (/home/mvlad/install-amd64/bin/weston+0x1099)
0x6060000589d8 is located 56 bytes inside of 64-byte region [0x6060000589a0,0x6060000589e0)
freed by thread T0 here:
#0 0x7ff70a9d3b6f in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xa9b6f)
#1 0x7ff70a5167d2 in cp_destroy_listener ../libweston/content-protection.c:193
#2 0x7ff70a4ee923 in wl_signal_emit /home/mvlad/install-amd64/include/wayland-server-core.h:481
#3 0x7ff70a51598d in weston_compositor_destroy ../libweston/compositor.c:7903
#4 0x7ff70a903a58 in wet_main ../compositor/main.c:3493
#5 0x560de7b3b179 in main ../compositor/executable.c:33
#6 0x7ff70a73ecc9 in __libc_start_main ../csu/libc-start.c:308
previously allocated by thread T0 here:
#0 0x7ff70a9d4037 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xaa037)
#1 0x7ff70a5160aa in zalloc ../include/libweston/zalloc.h:38
#2 0x7ff70a516cda in weston_compositor_enable_content_protection ../libweston/content-protection.c:329
#3 0x7ff7070247e0 in drm_backend_create ../libweston/backend-drm/drm.c:3180
#4 0x7ff707024cae in weston_backend_init ../libweston/backend-drm/drm.c:3250
#5 0x7ff70a515d02 in weston_compositor_load_backend ../libweston/compositor.c:7999
#6 0x7ff70a8fbcfb in load_drm_backend ../compositor/main.c:2614
#7 0x7ff70a900b46 in load_backend ../compositor/main.c:3103
#8 0x7ff70a902ecd in wet_main ../compositor/main.c:3380
#9 0x560de7b3b179 in main ../compositor/executable.c:33
#10 0x7ff70a73ecc9 in __libc_start_main ../csu/libc-start.c:308
SUMMARY: AddressSanitizer: heap-use-after-free ../libweston/compositor.c:1163 in weston_schedule_surface_protection_update
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
Hideyuki Nagase (hideyukn88)
pushed a commit
that referenced
this pull request
Oct 20, 2021
Fixed a leak found by ASan:
Direct leak of 160 byte(s) in 2 object(s) allocated from:
#0 0x7f511fe11518 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0xe9518)
#1 0x7f511fc76373 in zalloc ../../git/wayland/src/wayland-private.h:232
#2 0x7f511fc76373 in proxy_create ../../git/wayland/src/wayland-client.c:422
#3 0x7f511fc79dcc in create_outgoing_proxy ../../git/wayland/src/wayland-client.c:651
#4 0x7f511fc79dcc in wl_proxy_marshal_array_constructor_versioned ../../git/wayland/src/wayland-client.c:736
#5 0x7f511fc7b17b in wl_proxy_marshal_constructor_versioned ../../git/wayland/src/wayland-client.c:873
#6 0x5583e5348f43 in wl_registry_bind /home/pq/local/include/wayland-client-protocol.h:1165
#7 0x5583e535140b in bind_to_singleton_global ../../git/weston/tests/weston-test-client-helper.c:1863
#8 0x5583e5348752 in alpha_blend_monotonic ../../git/weston/tests/alpha-blending-test.c:219
#9 0x5583e5348571 in wrapalpha_blend_monotonic ../../git/weston/tests/alpha-blending-test.c:200
#10 0x5583e53554cc in run_test ../../git/weston/tests/weston-test-runner.c:162
#11 0x5583e5355b6d in run_case ../../git/weston/tests/weston-test-runner.c:277
#12 0x5583e5355913 in for_each_test_case ../../git/weston/tests/weston-test-runner.c:235
#13 0x5583e5355df5 in testsuite_run ../../git/weston/tests/weston-test-runner.c:311
#14 0x7f511aaaf752 in client_thread_routine ../../git/weston/tests/weston-test.c:404
#15 0x7f511f88cfa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.com>
Hideyuki Nagase (hideyukn88)
pushed a commit
that referenced
this pull request
Oct 20, 2021
ASan will detect leaks also outside of the code we build, and sometimes
that external code leaks and we cannot work around it. Then we need to
suppress the leak reports to make our own ASan testing succeed. This
commit only introduces the suppressions file, making use of it CI is for
another time. This file is useful for manual targeted testing as below.
Start by suppressing two functions what weston-keyboard client ends up
calling, suppressing leak reports like these:
Indirect leak of 96 byte(s) in 3 object(s) allocated from:
#0 0x7fc109c3d518 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0xe9518)
#1 0x7fc109083d18 (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x20d18)
#2 0x7fc1090849a7 in FcPatternDuplicate (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x219a7)
#3 0x7fc109adf93e (/lib/x86_64-linux-gnu/libcairo.so.2+0xbb93e)
#4 0x7fc109adfc8d (/lib/x86_64-linux-gnu/libcairo.so.2+0xbbc8d)
#5 0x7fc109aa02e7 in cairo_toy_font_face_create (/lib/x86_64-linux-gnu/libcairo.so.2+0x7c2e7)
#6 0x7fc109aa856c in cairo_select_font_face (/lib/x86_64-linux-gnu/libcairo.so.2+0x8456c)
#7 0x5603cb49a06a in redraw_handler ../../git/weston/clients/keyboard.c:378
#8 0x5603cb4b506b in widget_redraw ../../git/weston/clients/window.c:4520
#9 0x5603cb4b55da in surface_redraw ../../git/weston/clients/window.c:4578
#10 0x5603cb4b5750 in idle_redraw ../../git/weston/clients/window.c:4607
#11 0x5603cb4bebe3 in display_run ../../git/weston/clients/window.c:6525
#12 0x5603cb49e55d in main ../../git/weston/clients/keyboard.c:1054
#13 0x7fc1092a709a in __libc_start_main ../csu/libc-start.c:308
#14 0x5603cb499019 in _start (/home/pq/build/weston-meson/clients/weston-keyboard+0x19019)
Indirect leak of 528 byte(s) in 51 object(s) allocated from:
#0 0x7fc109b8e810 in strdup (/lib/x86_64-linux-gnu/libasan.so.5+0x3a810)
#1 0x7fc109082fc4 in FcValueSave (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x1ffc4)
#2 0x7fc109083d2e (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x20d2e)
#3 0x7fc1090852c7 (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x222c7)
#4 0x7fc10908c28b (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x2928b)
#5 0x7fc108603a15 (/lib/x86_64-linux-gnu/libexpat.so.1+0xba15)
#6 0x7fc1086044bb (/lib/x86_64-linux-gnu/libexpat.so.1+0xc4bb)
#7 0x7fc108601f8a (/lib/x86_64-linux-gnu/libexpat.so.1+0x9f8a)
#8 0x7fc108602e7a (/lib/x86_64-linux-gnu/libexpat.so.1+0xae7a)
#9 0x7fc108606a37 in XML_ParseBuffer (/lib/x86_64-linux-gnu/libexpat.so.1+0xea37)
#10 0x7fc10908a0fa (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x270fa)
#11 0x7fc10908a519 (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x27519)
#12 0x7fc10908a73a (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x2773a)
#13 0x7fc10908b48f (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x2848f)
#14 0x7fc108603a15 (/lib/x86_64-linux-gnu/libexpat.so.1+0xba15)
#15 0x7fc1086044bb (/lib/x86_64-linux-gnu/libexpat.so.1+0xc4bb)
#16 0x7fc108601f8a (/lib/x86_64-linux-gnu/libexpat.so.1+0x9f8a)
#17 0x7fc108602e7a (/lib/x86_64-linux-gnu/libexpat.so.1+0xae7a)
#18 0x7fc108606a37 in XML_ParseBuffer (/lib/x86_64-linux-gnu/libexpat.so.1+0xea37)
#19 0x7fc10908a0fa (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x270fa)
#20 0x7fc10908a519 (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x27519)
#21 0x7fc10907c4b3 (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x194b3)
#22 0x7fc10907c715 (/lib/x86_64-linux-gnu/libfontconfig.so.1+0x19715)
#23 0x7fc10906e8e6 (/lib/x86_64-linux-gnu/libfontconfig.so.1+0xb8e6)
#24 0x7fc109070928 in FcConfigSubstituteWithPat (/lib/x86_64-linux-gnu/libfontconfig.so.1+0xd928)
#25 0x7fc109ae2d6b (/lib/x86_64-linux-gnu/libcairo.so.2+0xbed6b)
#26 0x7fc109a8aba2 in cairo_scaled_font_create (/lib/x86_64-linux-gnu/libcairo.so.2+0x66ba2)
#27 0x7fc109a50d1d (/lib/x86_64-linux-gnu/libcairo.so.2+0x2cd1d)
#28 0x7fc109a53be0 (/lib/x86_64-linux-gnu/libcairo.so.2+0x2fbe0)
#29 0x7fc109a4c1df (/lib/x86_64-linux-gnu/libcairo.so.2+0x281df)
#30 0x7fc109aa8dab in cairo_text_extents (/lib/x86_64-linux-gnu/libcairo.so.2+0x84dab)
#31 0x5603cb499af3 in draw_key ../../git/weston/clients/keyboard.c:329
#32 0x5603cb49a30c in redraw_handler ../../git/weston/clients/keyboard.c:392
#33 0x5603cb4b506b in widget_redraw ../../git/weston/clients/window.c:4520
#34 0x5603cb4b55da in surface_redraw ../../git/weston/clients/window.c:4578
#35 0x5603cb4b5750 in idle_redraw ../../git/weston/clients/window.c:4607
#36 0x5603cb4bebe3 in display_run ../../git/weston/clients/window.c:6525
#37 0x5603cb49e55d in main ../../git/weston/clients/keyboard.c:1054
#38 0x7fc1092a709a in __libc_start_main ../csu/libc-start.c:308
#39 0x5603cb499019 in _start (/home/pq/build/weston-meson/clients/weston-keyboard+0x19019)
With the command line
ASAN_OPTIONS=fast_unwind_on_malloc=0,malloc_context_size=50 \
LSAN_OPTIONS=suppressions=/home/pq/git/weston/.gitlab-ci/leak-sanitizer.supp \
./tests/test-viewporter test_viewporter_double_create
Suppressions used:
count bytes template
5 357 cairo_select_font_face
130 9104 cairo_text_extents
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.com>
Hideyuki Nagase (hideyukn88)
pushed a commit
that referenced
this pull request
Oct 20, 2021
Fixes ASan leak:
Direct leak of 80 byte(s) in 1 object(s) allocated from:
#0 0x7fe7791f4518 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0xe9518)
#1 0x7fe779100892 in zalloc ../../git/wayland/src/wayland-private.h:232
#2 0x7fe779100892 in proxy_create ../../git/wayland/src/wayland-client.c:422
#3 0x7fe779100ede in create_outgoing_proxy ../../git/wayland/src/wayland-client.c:651
#4 0x7fe779100ede in wl_proxy_marshal_array_constructor_versioned ../../git/wayland/src/wayland-client.c:736
#5 0x7fe779101226 in wl_proxy_marshal_constructor ../../git/wayland/src/wayland-client.c:834
#6 0x56428c9bc578 in zwp_input_panel_v1_get_input_panel_surface protocol/input-method-unstable-v1-client-protocol.h:678
#7 0x56428c9c0bbb in set_toplevel ../../git/weston/clients/keyboard.c:965
#8 0x56428c9c0c8d in display_output_handler ../../git/weston/clients/keyboard.c:980
#9 0x56428c9ddead in display_handle_mode ../../git/weston/clients/window.c:5700
#10 0x7fe7786668ed in ffi_call_unix64 (/lib/x86_64-linux-gnu/libffi.so.6+0x68ed)
#11 0x7fe7786662be in ffi_call (/lib/x86_64-linux-gnu/libffi.so.6+0x62be)
#12 0x7fe779103fac in wl_closure_invoke ../../git/wayland/src/connection.c:1018
#13 0x7fe779100a48 in dispatch_event ../../git/wayland/src/wayland-client.c:1452
#14 0x7fe779101e43 in dispatch_queue ../../git/wayland/src/wayland-client.c:1598
#15 0x7fe779101e43 in wl_display_dispatch_queue_pending ../../git/wayland/src/wayland-client.c:1840
#16 0x56428c9e031c in handle_display_data ../../git/weston/clients/window.c:6211
#17 0x56428c9e2147 in display_run ../../git/weston/clients/window.c:6553
#18 0x56428c9c1559 in main ../../git/weston/clients/keyboard.c:1053
#19 0x7fe77885e09a in __libc_start_main ../csu/libc-start.c:308
#20 0x56428c9bc029 in _start (/home/pq/build/weston-meson/clients/weston-keyboard+0x19029)
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.com>
Hideyuki Nagase (hideyukn88)
pushed a commit
that referenced
this pull request
Oct 20, 2021
Leak found running drm-formats-test with ASan:
==58755==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 24 byte(s) in 1 object(s) allocated from:
#0 0x7fae74658459 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:154
#1 0x7fae744dbe3a in zalloc ../include/libweston/zalloc.h:38
#2 0x7fae744dbe4e in weston_drm_format_array_create ../libweston/drm-formats.c:44
#3 0x7fae744dd2a2 in weston_drm_format_array_subtract ../libweston/drm-formats.c:410
#4 0x55723c67bed5 in subtract_arrays ../tests/drm-formats-test.c:487
#5 0x55723c67b6bb in wrapsubtract_arrays ../tests/drm-formats-test.c:467
#6 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#7 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#8 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#9 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#10 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#11 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#12 0x55723c680844 in main ../tests/weston-test-runner.c:661
#13 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#14 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Direct leak of 24 byte(s) in 1 object(s) allocated from:
#0 0x7fae74658459 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:154
#1 0x7fae744dbe3a in zalloc ../include/libweston/zalloc.h:38
#2 0x7fae744dbe4e in weston_drm_format_array_create ../libweston/drm-formats.c:44
#3 0x7fae744dd2a2 in weston_drm_format_array_subtract ../libweston/drm-formats.c:410
#4 0x55723c67deca in subtract_arrays_modifier_invalid ../tests/drm-formats-test.c:613
#5 0x55723c67da3d in wrapsubtract_arrays_modifier_invalid ../tests/drm-formats-test.c:593
#6 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#7 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#8 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#9 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#10 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#11 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#12 0x55723c680844 in main ../tests/weston-test-runner.c:661
#13 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#14 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Direct leak of 24 byte(s) in 1 object(s) allocated from:
#0 0x7fae74658459 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:154
#1 0x7fae744dbe3a in zalloc ../include/libweston/zalloc.h:38
#2 0x7fae744dbe4e in weston_drm_format_array_create ../libweston/drm-formats.c:44
#3 0x7fae744dd2a2 in weston_drm_format_array_subtract ../libweston/drm-formats.c:410
#4 0x55723c67c9c0 in subtract_arrays_same_content ../tests/drm-formats-test.c:521
#5 0x55723c67c55b in wrapsubtract_arrays_same_content ../tests/drm-formats-test.c:504
#6 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#7 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#8 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#9 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#10 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#11 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#12 0x55723c680844 in main ../tests/weston-test-runner.c:661
#13 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#14 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Direct leak of 24 byte(s) in 1 object(s) allocated from:
#0 0x7fae74658459 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:154
#1 0x7fae744dbe3a in zalloc ../include/libweston/zalloc.h:38
#2 0x7fae744dbe4e in weston_drm_format_array_create ../libweston/drm-formats.c:44
#3 0x7fae744dd2a2 in weston_drm_format_array_subtract ../libweston/drm-formats.c:410
#4 0x55723c67d1b7 in subtract_arrays_exclusive_formats ../tests/drm-formats-test.c:552
#5 0x55723c67cb23 in wrapsubtract_arrays_exclusive_formats ../tests/drm-formats-test.c:529
#6 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#7 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#8 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#9 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#10 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#11 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#12 0x55723c680844 in main ../tests/weston-test-runner.c:661
#13 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#14 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Direct leak of 24 byte(s) in 1 object(s) allocated from:
#0 0x7fae74658459 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:154
#1 0x7fae744dbe3a in zalloc ../include/libweston/zalloc.h:38
#2 0x7fae744dbe4e in weston_drm_format_array_create ../libweston/drm-formats.c:44
#3 0x7fae744dd2a2 in weston_drm_format_array_subtract ../libweston/drm-formats.c:410
#4 0x55723c67d8d5 in subtract_arrays_exclusive_modifiers ../tests/drm-formats-test.c:584
#5 0x55723c67d31d in wrapsubtract_arrays_exclusive_modifiers ../tests/drm-formats-test.c:561
#6 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#7 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#8 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#9 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#10 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#11 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#12 0x55723c680844 in main ../tests/weston-test-runner.c:661
#13 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#14 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Indirect leak of 320 byte(s) in 5 object(s) allocated from:
#0 0x7fae74658279 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7fae74473bc3 in wl_array_add (/usr/lib/libwayland-client.so.0+0xabc3)
#2 0x7fae74473c10 in wl_array_copy (/usr/lib/libwayland-client.so.0+0xac10)
#3 0x7fae744dbfe0 in add_format_and_modifiers ../libweston/drm-formats.c:108
#4 0x7fae744dd389 in weston_drm_format_array_subtract ../libweston/drm-formats.c:418
#5 0x55723c67d1b7 in subtract_arrays_exclusive_formats ../tests/drm-formats-test.c:552
#6 0x55723c67cb23 in wrapsubtract_arrays_exclusive_formats ../tests/drm-formats-test.c:529
#7 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#8 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#9 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#10 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#11 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#12 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#13 0x55723c680844 in main ../tests/weston-test-runner.c:661
#14 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#15 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Indirect leak of 256 byte(s) in 1 object(s) allocated from:
#0 0x7fae74658652 in __interceptor_realloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:164
#1 0x7fae74473b76 in wl_array_add (/usr/lib/libwayland-client.so.0+0xab76)
#2 0x7fae744dc19f in weston_drm_format_array_add_format ../libweston/drm-formats.c:166
#3 0x7fae744dbfb7 in add_format_and_modifiers ../libweston/drm-formats.c:104
#4 0x7fae744dd389 in weston_drm_format_array_subtract ../libweston/drm-formats.c:418
#5 0x55723c67d1b7 in subtract_arrays_exclusive_formats ../tests/drm-formats-test.c:552
#6 0x55723c67cb23 in wrapsubtract_arrays_exclusive_formats ../tests/drm-formats-test.c:529
#7 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#8 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#9 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#10 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#11 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#12 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#13 0x55723c680844 in main ../tests/weston-test-runner.c:661
#14 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#15 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Indirect leak of 256 byte(s) in 1 object(s) allocated from:
#0 0x7fae74658652 in __interceptor_realloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:164
#1 0x7fae74473b76 in wl_array_add (/usr/lib/libwayland-client.so.0+0xab76)
#2 0x7fae744dc19f in weston_drm_format_array_add_format ../libweston/drm-formats.c:166
#3 0x7fae744dd3de in weston_drm_format_array_subtract ../libweston/drm-formats.c:426
#4 0x55723c67bed5 in subtract_arrays ../tests/drm-formats-test.c:487
#5 0x55723c67b6bb in wrapsubtract_arrays ../tests/drm-formats-test.c:467
#6 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#7 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#8 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#9 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#10 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#11 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#12 0x55723c680844 in main ../tests/weston-test-runner.c:661
#13 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#14 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Indirect leak of 128 byte(s) in 2 object(s) allocated from:
#0 0x7fae74658279 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7fae74473bc3 in wl_array_add (/usr/lib/libwayland-client.so.0+0xabc3)
#2 0x7fae74473c10 in wl_array_copy (/usr/lib/libwayland-client.so.0+0xac10)
#3 0x7fae744dbfe0 in add_format_and_modifiers ../libweston/drm-formats.c:108
#4 0x7fae744dd389 in weston_drm_format_array_subtract ../libweston/drm-formats.c:418
#5 0x55723c67bed5 in subtract_arrays ../tests/drm-formats-test.c:487
#6 0x55723c67b6bb in wrapsubtract_arrays ../tests/drm-formats-test.c:467
#7 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#8 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#9 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#10 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#11 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#12 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#13 0x55723c680844 in main ../tests/weston-test-runner.c:661
#14 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#15 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Indirect leak of 96 byte(s) in 3 object(s) allocated from:
#0 0x7fae74658652 in __interceptor_realloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:164
#1 0x7fae74473b76 in wl_array_add (/usr/lib/libwayland-client.so.0+0xab76)
#2 0x7fae744dd142 in modifiers_subtract ../libweston/drm-formats.c:384
#3 0x7fae744dd408 in weston_drm_format_array_subtract ../libweston/drm-formats.c:431
#4 0x55723c67bed5 in subtract_arrays ../tests/drm-formats-test.c:487
#5 0x55723c67b6bb in wrapsubtract_arrays ../tests/drm-formats-test.c:467
#6 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#7 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#8 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#9 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#10 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#11 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#12 0x55723c680844 in main ../tests/weston-test-runner.c:661
#13 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#14 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Indirect leak of 64 byte(s) in 1 object(s) allocated from:
#0 0x7fae74658652 in __interceptor_realloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:164
#1 0x7fae74473b76 in wl_array_add (/usr/lib/libwayland-client.so.0+0xab76)
#2 0x7fae744dd142 in modifiers_subtract ../libweston/drm-formats.c:384
#3 0x7fae744dd408 in weston_drm_format_array_subtract ../libweston/drm-formats.c:431
#4 0x55723c67d8d5 in subtract_arrays_exclusive_modifiers ../tests/drm-formats-test.c:584
#5 0x55723c67d31d in wrapsubtract_arrays_exclusive_modifiers ../tests/drm-formats-test.c:561
#6 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#7 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#8 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#9 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#10 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#11 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#12 0x55723c680844 in main ../tests/weston-test-runner.c:661
#13 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#14 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Indirect leak of 32 byte(s) in 1 object(s) allocated from:
#0 0x7fae74658279 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7fae74473bc3 in wl_array_add (/usr/lib/libwayland-client.so.0+0xabc3)
#2 0x7fae744dc19f in weston_drm_format_array_add_format ../libweston/drm-formats.c:166
#3 0x7fae744dd3de in weston_drm_format_array_subtract ../libweston/drm-formats.c:426
#4 0x55723c67d8d5 in subtract_arrays_exclusive_modifiers ../tests/drm-formats-test.c:584
#5 0x55723c67d31d in wrapsubtract_arrays_exclusive_modifiers ../tests/drm-formats-test.c:561
#6 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#7 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#8 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#9 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#10 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#11 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#12 0x55723c680844 in main ../tests/weston-test-runner.c:661
#13 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#14 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Indirect leak of 32 byte(s) in 1 object(s) allocated from:
#0 0x7fae74658279 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7fae74473bc3 in wl_array_add (/usr/lib/libwayland-client.so.0+0xabc3)
#2 0x7fae744dc19f in weston_drm_format_array_add_format ../libweston/drm-formats.c:166
#3 0x7fae744dd3de in weston_drm_format_array_subtract ../libweston/drm-formats.c:426
#4 0x55723c67deca in subtract_arrays_modifier_invalid ../tests/drm-formats-test.c:613
#5 0x55723c67da3d in wrapsubtract_arrays_modifier_invalid ../tests/drm-formats-test.c:593
#6 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#7 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#8 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#9 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#10 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#11 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#12 0x55723c680844 in main ../tests/weston-test-runner.c:661
#13 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#14 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Indirect leak of 32 byte(s) in 1 object(s) allocated from:
#0 0x7fae74658279 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7fae74473bc3 in wl_array_add (/usr/lib/libwayland-client.so.0+0xabc3)
#2 0x7fae744dc19f in weston_drm_format_array_add_format ../libweston/drm-formats.c:166
#3 0x7fae744dd3de in weston_drm_format_array_subtract ../libweston/drm-formats.c:426
#4 0x55723c67c9c0 in subtract_arrays_same_content ../tests/drm-formats-test.c:521
#5 0x55723c67c55b in wrapsubtract_arrays_same_content ../tests/drm-formats-test.c:504
#6 0x55723c67e9a9 in run_test ../tests/weston-test-runner.c:162
#7 0x55723c67f0af in run_case ../tests/weston-test-runner.c:277
#8 0x55723c67ee48 in for_each_test_case ../tests/weston-test-runner.c:235
#9 0x55723c67f358 in testsuite_run ../tests/weston-test-runner.c:311
#10 0x55723c680381 in weston_test_harness_execute_standalone ../tests/weston-test-runner.c:572
#11 0x55723c6803b1 in fixture_setup_run_ ../tests/weston-test-runner.c:610
#12 0x55723c680844 in main ../tests/weston-test-runner.c:661
#13 0x7fae742c4b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
#14 0x55723c67442d in _start (/home/lele/weston/build/tests/test-drm-formats+0x642d)
Signed-off-by: Leandro Ribeiro <leandro.ribeiro@collabora.com>
Timo Hendricks (thendricks0)
pushed a commit
to thendricks0/weston-mirror
that referenced
this pull request
Nov 17, 2025
This patch fixes the following trace:
#0 0x7f07d1bcecfa in weston_desktop_surface_get_surface ../libweston-desktop/surface.c:585
microsoft#1 0x7f07d1bfc9b8 in move_grab_motion ../desktop-shell/shell.c:1499
microsoft#2 0x7f07e539f841 in notify_motion ../libweston/input.c:1794
microsoft#3 0x7f07e1e8ace4 in handle_pointer_motion ../libweston/libinput-device.c:132
microsoft#4 0x7f07e1e8cad5 in evdev_device_process_event ../libweston/libinput-device.c:535
microsoft#5 0x7f07e1e89311 in udev_input_process_event ../libweston/libinput-seat.c:208
microsoft#6 0x7f07e1e8932f in process_event ../libweston/libinput-seat.c:218
microsoft#7 0x7f07e1e8935f in process_events ../libweston/libinput-seat.c:228
microsoft#8 0x7f07e1e8940a in udev_input_dispatch ../libweston/libinput-seat.c:239
microsoft#9 0x7f07e1e89437 in libinput_source_dispatch ../libweston/libinput-seat.c:249
microsoft#10 0x7f07e53122b1 in wl_event_loop_dispatch ../src/event-loop.c:1027
microsoft#11 0x7f07e5310114 in wl_display_run ../src/wayland-server.c:1408
microsoft#12 0x7f07e579c7ba in wet_main ../compositor/main.c:3589
microsoft#13 0x555611d6b17d in main ../compositor/executable.c:33
microsoft#14 0x7f07e55be7fc in __libc_start_main ../csu/libc-start.c:332
microsoft#15 0x555611d6b099 in _start (/home/mvlad/install-amd64/bin/weston+0x1099)
A highly unlikely, but still valid operation, is to close/destroy the
window while still having it grabbed and moved around, basically having
an in-flight destruction of grabbed moving window. Another situation
would be that the client terminates abruptly (crashing for instance),
while being dragged which might take down the compositor.
This could happen for both touch/pointer grab operations and could cause
a NULL pointer access while accessing desktop_surface when being used
to retrieve the underlying weston_surface.
With this patch we check for a valid desktop_surface and return early
if that's not the case.
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
(cherry picked from commit d03f013)
Timo Hendricks (thendricks0)
pushed a commit
to thendricks0/weston-mirror
that referenced
this pull request
Nov 17, 2025
This fixes the following weston_view leak at compositor shutdown:
#0 0x7f4250247987 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
microsoft#1 0x7f424fd37aa3 in zalloc ../include/libweston/zalloc.h:38
microsoft#2 0x7f424fd3a05f in weston_view_create ../libweston/compositor.c:386
microsoft#3 0x7f423be7be6a in weston_desktop_surface_create_desktop_view ../libweston-desktop/surface.c:364
microsoft#4 0x7f423be7c0a8 in weston_desktop_surface_create_view ../libweston-desktop/surface.c:404
microsoft#5 0x7f423beae91d in desktop_surface_added ../desktop-shell/shell.c:2273
microsoft#6 0x7f423be77db1 in weston_desktop_api_surface_added ../libweston-desktop/libweston-desktop.c:138
microsoft#7 0x7f423be80c73 in weston_desktop_xdg_toplevel_ensure_added ../libweston-desktop/xdg-shell.c:362
microsoft#8 0x7f423be8207a in weston_desktop_xdg_toplevel_committed ../libweston-desktop/xdg-shell.c:697
microsoft#9 0x7f423be84d45 in weston_desktop_xdg_surface_committed ../libweston-desktop/xdg-shell.c:1374
microsoft#10 0x7f423be7b382 in weston_desktop_surface_surface_committed ../libweston-desktop/surface.c:174
microsoft#11 0x7f424fd378a6 in wl_signal_emit /home/mvlad/install-amd64/include/wayland-server-core.h:481
microsoft#12 0x7f424fd510e2 in weston_surface_commit_state ../libweston/compositor.c:4062
microsoft#13 0x7f424fd51161 in weston_surface_commit ../libweston/compositor.c:4068
microsoft#14 0x7f424fd516ef in surface_commit ../libweston/compositor.c:4146
microsoft#15 0x7f424fb597e9 (/usr/lib/x86_64-linux-gnu/libffi.so.8+0x77e9)
With commit 'libweston, desktop-shell: Add a wrapper for weston_surface
reference' we've removed an explicit weston_view_destroy() call due to a
UAF which would've happen if we had close animations enabled, upon
terminating a client. In that patch I've incorrectly wrote this happened
when animations are off, but in fact it happened when they're on, see the
following trace:
READ of size 8 at 0x616000026498 thread T0
#0 0x7f757fba8797 in weston_signal_emit_mutable ../shared/signal.c:52
microsoft#1 0x7f757fb4bba1 in weston_view_destroy ../libweston/compositor.c:2269
microsoft#2 0x7f756bca89c0 in desktop_shell_destroy_surface ../desktop-shell/shell.c:275
microsoft#3 0x7f756bcb379e in fade_out_done_idle_cb ../desktop-shell/shell.c:2228
microsoft#4 0x7f757faec1da in wl_event_loop_dispatch_idle ../src/event-loop.c:969
microsoft#5 0x7f757faec31d in wl_event_loop_dispatch ../src/event-loop.c:1032
microsoft#6 0x7f757faea114 in wl_display_run ../src/wayland-server.c:1408
microsoft#7 0x7f757ff777ba in wet_main ../compositor/main.c:3589
microsoft#8 0x55f765c8d17d in main ../compositor/executable.c:33
microsoft#9 0x7f757fd997fc in __libc_start_main ../csu/libc-start.c:332
microsoft#10 0x55f765c8d099 in _start (/home/mvlad/install-amd64/bin/weston+0x1099)
0x616000026498 is located 24 bytes inside of 608-byte region [0x616000026480,0x6160000266e0)
freed by thread T0 here:
#0 0x7f758004c4d7 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
microsoft#1 0x7f757fb4bdc8 in weston_view_destroy ../libweston/compositor.c:2295
microsoft#2 0x7f757fb4c14d in weston_surface_unref ../libweston/compositor.c:2334
microsoft#3 0x7f756bca898b in desktop_shell_destroy_surface ../desktop-shell/shell.c:273
microsoft#4 0x7f756bcb379e in fade_out_done_idle_cb ../desktop-shell/shell.c:2228
microsoft#5 0x7f757faec1da in wl_event_loop_dispatch_idle ../src/event-loop.c:969
This patch re-introduces it to avoid leaking the view upon compositor
shutdown, but it does it in tandem with weston_desktop_surface_unlink_view(),
(which was added in a later patch) and before weston_surface_unref() call.
This way we should be safe to terminate/close clients with additional views
created by libweston-desktop (pop-ups), but also in other different situations.
Verified it in the following circumstances:
- terminating a client with close animation on
- terminating a client with close animations off
- shutting down the compositor with clients running, with and
without close animations
- terminating top-level clients with additional pop-ups with both with
and without close animations
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
(cherry picked from commit ab42159)
Timo Hendricks (thendricks0)
pushed a commit
to thendricks0/weston-mirror
that referenced
this pull request
Nov 17, 2025
Co-authored-by: Hideyuki Nagase <hideyukn@ntdev.microsoft.com>
Ben Hillis (benhillis)
pushed a commit
that referenced
this pull request
May 19, 2026
Fixes the following UAF:
==191==ERROR: AddressSanitizer: heap-use-after-free on address 0x518000000360 at pc 0x7f1ee142f5df bp 0x7ffe60aaf010 sp 0x7ffe60aaf008
READ of size 8 at 0x518000000360 thread T0
#0 0x7f1ee142f5de in output_destroyed_listener ../tests/weston-test.c:166
#1 0x7f1ee25f08eb in wl_signal_emit_mutable ../src/wayland-server.c:2401
#2 0x7f1ee274c7f8 in weston_compositor_remove_output ../libweston/compositor.c:7877
#3 0x7f1ee274fa92 in weston_output_release ../libweston/compositor.c:8641
#4 0x7f1ee146e5f8 in drm_output_destroy ../libweston/backend-drm/drm.c:2626
#5 0x7f1ee27552df in weston_compositor_shutdown ../libweston/compositor.c:9941
#6 0x7f1ee2756a89 in weston_compositor_destroy ../libweston/compositor.c:10369
#7 0x7f1ee286bed8 in wet_main ../frontend/main.c:4934
#8 0x56113c4244d6 in execute_compositor ../tests/weston-test-fixture-compositor.c:431
#9 0x56113c42856b in weston_test_harness_execute_as_client ../tests/weston-test-runner.c:570
#10 0x56113c412e1d in fixture_setup ../tests/drm-writeback-screenshot-test.c:48
#11 0x56113c412e9e in fixture_setup_run_ ../tests/drm-writeback-screenshot-test.c:50
#12 0x56113c428bb6 in main ../tests/weston-test-runner.c:726
#13 0x7f1ee22ccca7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#14 0x7f1ee22ccd64 in __libc_start_main_impl ../csu/libc-start.c:360
#15 0x56113c412860 in _start (/home/mvlad/vkms/weston/b/tests/test-drm-writeback-screenshot+0xe860) (BuildId: 9f9e2ed12b9317dd859498374500f2406c32e5d3)
0x518000000360 is located 736 bytes inside of 792-byte region [0x518000000080,0x518000000398)
freed by thread T0 here:
#0 0x7f1ee298e8f8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x7f1ee1433002 in wet_module_init ../tests/weston-test.c:882
#2 0x7f1ee2851425 in wet_load_module ../frontend/main.c:989
#3 0x7f1ee28519eb in load_modules ../frontend/main.c:1069
#4 0x7f1ee286b711 in wet_main ../frontend/main.c:4865
#5 0x56113c4244d6 in execute_compositor ../tests/weston-test-fixture-compositor.c:431
#6 0x56113c42856b in weston_test_harness_execute_as_client ../tests/weston-test-runner.c:570
#7 0x56113c412e1d in fixture_setup ../tests/drm-writeback-screenshot-test.c:48
#8 0x56113c412e9e in fixture_setup_run_ ../tests/drm-writeback-screenshot-test.c:50
#9 0x56113c428bb6 in main ../tests/weston-test-runner.c:726
#10 0x7f1ee22ccca7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
previously allocated by thread T0 here:
#0 0x7f1ee298f610 in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
#1 0x7f1ee142edc5 in zalloc ../include/libweston/zalloc.h:38
#2 0x7f1ee1432cba in wet_module_init ../tests/weston-test.c:840
#3 0x7f1ee2851425 in wet_load_module ../frontend/main.c:989
#4 0x7f1ee28519eb in load_modules ../frontend/main.c:1069
#5 0x7f1ee286b711 in wet_main ../frontend/main.c:4865
#6 0x56113c4244d6 in execute_compositor ../tests/weston-test-fixture-compositor.c:431
#7 0x56113c42856b in weston_test_harness_execute_as_client ../tests/weston-test-runner.c:570
#8 0x56113c412e1d in fixture_setup ../tests/drm-writeback-screenshot-test.c:48
#9 0x56113c412e9e in fixture_setup_run_ ../tests/drm-writeback-screenshot-test.c:50
#10 0x56113c428bb6 in main ../tests/weston-test-runner.c:726
#11 0x7f1ee22ccca7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains.
1: replace weston_log used in RDP backand and RDP-RAIL shell with RDP's own scope logging.
2: add state tracking to RDP clipboard to assist debugging.
3: support clearing WSLg side clipboard when client sends 0 format list (when client's clipboard is cleared).
4: disable optional RDP-RAIL shell key-bindings including zapping and rotate.
5: remove zoom functionality from RDP-RAIL shell key-bindings since it doesn't work and doesn't make sense with RAIL.