https://bugs.kde.org/show_bug.cgi?id=522618
Zamundaaa <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Latest Commit| |https://invent.kde.org/plas | |ma/kwin/-/commit/c37f40748f | |b728d74680a91962716afb2ab3e | |c4b Status|CONFIRMED |RESOLVED --- Comment #4 from Zamundaaa <[email protected]> --- Git commit c37f40748fb728d74680a91962716afb2ab3ec4b by Xaver Hugl, on behalf of Nick Haghiri. Committed on 16/07/2026 at 17:03. Pushed by zamundaaa into branch 'master'. drm: don't dereference a stale commit in the page-flip handler pageFlipHandler() casts the page-flip event's user_data to a DrmCommit and dereferences it before checking anything. That pointer can be stale, and a duplicate event from the driver leaves it dangling and the handler hits a use-after-free. Even keying a pending-commits set by the commit pointer is not quite safe: a freed commit's address can be reused by a new one, so a stale event for the old commit would match the new one's entry. user_data is now the DrmGpu, which never has this problem. Pending flips are tracked per-gpu in a map keyed by crtc id, which comes from the kernel event itself and can't be stale. The handler only completes a flip if the map still has an entry for that crtc; erasing it consumes the entry so a duplicate event can't be handled twice. doCommit()/doPageflip() hold the gpu's lock across the ioctl and register only on success, instead of registering before the ioctl and rolling that back on failure. dispatchEvents() takes the same lock only around the map lookup, not the whole event, so a commit's ioctl+register can never interleave with a lookup for it, without holding the lock through pageFlipped() and whatever it calls into (which can reach back into a different pipeline's own commit-thread lock). M +18 -3 src/backends/drm/drm_commit.cpp M +24 -2 src/backends/drm/drm_gpu.cpp M +9 -0 src/backends/drm/drm_gpu.h https://invent.kde.org/plasma/kwin/-/commit/c37f40748fb728d74680a91962716afb2ab3ec4b -- You are receiving this mail because: You are watching all bug changes.
