GNOME Bugzilla – Bug 770727
wayland: Don't handle input events after capability was removed
Last modified: 2016-09-02 13:12:16 UTC
I have not tried to reproduce the issue, but theoretically it should be able to happen I think. My suspicion is that it causes https://bugzilla.redhat.com/show_bug.cgi?id=1209007 but since it (or its duplicates) has no reproduction steps, it's only a guess.
Created attachment 334615 [details] [review] wayland: Don't handle input events after capability was removed The seat capability updating is synchronous, but input events are asynchronous (first queued then emitted). This means we may end up in a situation where we from libinput first may receive a key event, immediately followed by a device-removed event. Clutter will first queue the key event, then remove the device, immediately triggering the seat capability removal. Later, when the clutter stage processes the queued events, the previously queued key event will be processed, eventually making it into MetaWaylandSeat. Before this patch, MetaWaylandSeat would still forward the key event to MetaWaylandKeyboard, even though it had 'released' it. Doing this would cause referencing potentially freed memory, such as the xkb state that was unreferenced when the seat removed the capability. In order to avoid processing these lingering events, for now, just drop them on the floor if the capability has been removed. Eventually, the event queuing etc needs to be redesigned to work better when used in a Wayland compositor, but for now at least don't access freed memory.
Review of attachment 334615 [details] [review]: Yeah, clutter's async event processing bites again. I think we should do add the same checks in meta_wayland_seat_handle_event() since that will likely lead to a similar use after free.
(In reply to Rui Matos from comment #2) > Review of attachment 334615 [details] [review] [review]: > > Yeah, clutter's async event processing bites again. > > I think we should do add the same checks in meta_wayland_seat_handle_event() > since that will likely lead to a similar use after free. Good point. I'll amend before pushing.
Attachment 334615 [details] pushed as d696fd3 - wayland: Don't handle input events after capability was removed