Commit 7ef26f9
committed
guard seat_get_focus() NULL dereferences
seat_get_focus() can return NULL when the focus stack is empty. a few
call sites don't check for this and just dereference the result, which
crashes sway.
this happens when a client disconnects abruptly, leaving the seat with
a stale has_focus flag or empty focus stack. whatever touches focus next
dereferences NULL. the two confirmed crash sites were
seat_set_workspace_focus and seat_set_focus_surface (coredumps below).
seat_unfocus_unless_client has the same pattern so a check was added
there too for safety.
cannot remember how this one was triggered:
```
seat_send_unfocus ()
seat_set_workspace_focus ()
seat_set_focus ()
wl_signal_emit_mutable ()
container_begin_destroy ()
view_unmap ()
handle_unmap ()
wl_signal_emit_mutable ()
wlr_surface_unmap ()
destroy_xdg_toplevel ()
destroy_xdg_surface_role_object ()
destroy_xdg_surface ()
xdg_client_handle_resource_destroy ()
wl_client_destroy ()
```
mouse click on empty container (clicked wallpaper, likely just after a
wallpaper engine crash):
```
seat_send_unfocus ()
seat_set_workspace_focus ()
seat_set_focus ()
handle_button ()
wl_signal_emit_mutable ()
handle_pointer_button ()
handle_libinput_readable ()
wl_event_loop_dispatch ()
```
IPC workspace switch (with noctalia workspace widget):
```
seat_send_unfocus ()
seat_set_workspace_focus ()
seat_set_focus ()
workspace_switch ()
cmd_workspace ()
execute_command ()
ipc_client_handle_command ()
ipc_client_handle_readable ()
wl_event_loop_dispatch ()
```
layer surface teardown (restarted noctalia shell):
```
seat_send_unfocus ()
seat_set_focus_surface ()
seat_set_focus_layer ()
handle_node_destroy ()
wl_signal_emit_mutable ()
sway_scene_node_destroy ()
layer_surface_destroy ()
surface_handle_role_resource_destroy ()
```1 parent c57daaf commit 7ef26f9
1 file changed
Lines changed: 9 additions & 5 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1136 | 1136 | | |
1137 | 1137 | | |
1138 | 1138 | | |
1139 | | - | |
1140 | | - | |
| 1139 | + | |
| 1140 | + | |
| 1141 | + | |
| 1142 | + | |
| 1143 | + | |
1141 | 1144 | | |
1142 | | - | |
1143 | 1145 | | |
1144 | 1146 | | |
1145 | 1147 | | |
| |||
1291 | 1293 | | |
1292 | 1294 | | |
1293 | 1295 | | |
1294 | | - | |
| 1296 | + | |
| 1297 | + | |
| 1298 | + | |
1295 | 1299 | | |
1296 | 1300 | | |
1297 | 1301 | | |
| |||
1340 | 1344 | | |
1341 | 1345 | | |
1342 | 1346 | | |
1343 | | - | |
| 1347 | + | |
1344 | 1348 | | |
1345 | 1349 | | |
1346 | 1350 | | |
| |||
0 commit comments