Skip to content

Destroy frame queue before display

Sam James requested to merge thesamesam/qtwayland:kde-5.15-backport-UAF-wl-destroy into kde/5.15

Reported downstream in Gentoo at https://bugs.gentoo.org/910315.

kde/5.15 has b981fc82 ('[PATCH 27/51] Reduce memory leakage') backported but this introduces a use-after-free because wl_event_queue_destroy must be called before wl_display_disconnect. So, just backport the upstream fix which sorts out the order.

Upstream review: https://codereview.qt-project.org/c/qt/qtwayland/+/471416 Upstream review (6.x): https://codereview.qt-project.org/c/qt/qtwayland/+/471528

wl_event_queue_destroy accesses the display. Found by running a test under valgrind.

Pick-to: 6.5 Change-Id: Ic89cbd3b6e98b4fc9561b0e63b5fab4886a1ec50 Reviewed-by: David Edmundson davidedmundson@kde.org (cherry picked from commit a76bf824)

Merge request reports