Compare commits

...

3 Commits

Author SHA1 Message Date
outfoxxed d56c07ceb3
core/reloader: simplify generation teardown
The extra complexity previously masked the use after free in 6c95267.
2024-05-31 00:27:18 -07:00
outfoxxed 84bb4098ad
core/reloader: fix incorrect generation teardown on hard reload 2024-05-31 00:26:34 -07:00
outfoxxed 6c9526761c
wayland: fix UAF in layershell surface destructor 2024-05-31 00:24:58 -07:00
5 changed files with 39 additions and 22 deletions

View File

@ -14,7 +14,6 @@
#include <qqmlcontext.h>
#include <qqmlengine.h>
#include <qqmlincubator.h>
#include <qtimer.h>
#include <qtmetamacros.h>
#include "iconimageprovider.hpp"
@ -47,32 +46,30 @@ EngineGeneration::EngineGeneration(const QDir& rootPath, QmlScanner scanner)
}
EngineGeneration::~EngineGeneration() {
g_generations.remove(this->engine);
delete this->engine;
if (this->engine != nullptr) {
qFatal() << this << "destroyed without calling destroy()";
}
}
void EngineGeneration::destroy() {
// Multiple generations can detect a reload at the same time.
delete this->watcher;
QObject::disconnect(this->watcher, nullptr, this, nullptr);
this->watcher->deleteLater();
this->watcher = nullptr;
// Yes all of this is actually necessary.
if (this->engine != nullptr && this->root != nullptr) {
QObject::connect(this->root, &QObject::destroyed, this, [this]() {
// The timer seems to fix *one* of the possible qml item destructor crashes.
QTimer::singleShot(0, [this]() {
// Garbage is not collected during engine destruction.
this->engine->collectGarbage();
// prevent further js execution between garbage collection and engine destruction.
this->engine->setInterrupted(true);
QObject::connect(this->engine, &QObject::destroyed, this, [this]() { delete this; });
g_generations.remove(this->engine);
// Even after all of that there's still multiple failing assertions and segfaults.
// Pray you don't hit one.
// Note: it appeats *some* of the crashes are related to values owned by the generation.
// Test by commenting the connect() above.
this->engine->deleteLater();
this->engine = nullptr;
});
// Garbage is not collected during engine destruction.
this->engine->collectGarbage();
delete this->engine;
this->engine = nullptr;
delete this;
});
this->root->deleteLater();

View File

@ -65,7 +65,7 @@ void RootWrapper::reloadGraph(bool hard) {
auto* obj = component.beginCreate(generation->engine->rootContext());
if (obj == nullptr) {
QString error = "failed to create root component\n" + component.errorString();
const QString error = "failed to create root component\n" + component.errorString();
qWarning().noquote() << error;
delete generation;
@ -78,7 +78,7 @@ void RootWrapper::reloadGraph(bool hard) {
auto* newRoot = qobject_cast<ShellRoot*>(obj);
if (newRoot == nullptr) {
QString error = "root component was not a Quickshell.ShellRoot";
const QString error = "root component was not a Quickshell.ShellRoot";
qWarning().noquote() << error;
delete obj;
delete generation;
@ -96,7 +96,11 @@ void RootWrapper::reloadGraph(bool hard) {
auto isReload = this->generation != nullptr;
generation->onReload(hard ? nullptr : this->generation);
if (hard) delete this->generation;
if (hard && this->generation != nullptr) {
this->generation->destroy();
}
this->generation = generation;
qInfo() << "Configuration Loaded";

View File

@ -7,7 +7,6 @@
#include <private/qwaylandsurface_p.h>
#include <private/qwaylandwindow_p.h>
#include <qlogging.h>
#include <qpoint.h>
#include <qrect.h>
#include <qsize.h>
#include <qtversionchecks.h>
@ -18,6 +17,10 @@
#include "shell_integration.hpp"
#include "window.hpp"
#if QT_VERSION < QT_VERSION_CHECK(6, 7, 0)
#include <qpoint.h>
#endif
// clang-format off
[[nodiscard]] QtWayland::zwlr_layer_shell_v1::layer toWaylandLayer(const WlrLayer::Enum& layer) noexcept;
[[nodiscard]] QtWayland::zwlr_layer_surface_v1::anchor toWaylandAnchors(const Anchors& anchors) noexcept;
@ -72,7 +75,10 @@ QSWaylandLayerSurface::QSWaylandLayerSurface(
}
QSWaylandLayerSurface::~QSWaylandLayerSurface() {
this->ext->surface = nullptr;
if (this->ext != nullptr) {
this->ext->surface = nullptr;
}
this->destroy();
}
@ -106,6 +112,7 @@ void QSWaylandLayerSurface::applyConfigure() {
}
void QSWaylandLayerSurface::setWindowGeometry(const QRect& geometry) {
if (this->ext == nullptr) return;
auto size = constrainedSize(this->ext->mAnchors, geometry.size());
this->set_size(size.width(), size.height());
}

View File

@ -13,6 +13,12 @@
#include "shell_integration.hpp"
#include "surface.hpp"
LayershellWindowExtension::~LayershellWindowExtension() {
if (this->surface != nullptr) {
this->surface->ext = nullptr;
}
}
LayershellWindowExtension* LayershellWindowExtension::get(QWindow* window) {
auto v = window->property("layershell_ext");

View File

@ -2,6 +2,7 @@
#include <qobject.h>
#include <qscreen.h>
#include <qtclasshelpermacros.h>
#include <qtmetamacros.h>
#include <qtypes.h>
#include <qwindow.h>
@ -56,6 +57,8 @@ class LayershellWindowExtension: public QObject {
public:
LayershellWindowExtension(QObject* parent = nullptr): QObject(parent) {}
~LayershellWindowExtension() override;
Q_DISABLE_COPY_MOVE(LayershellWindowExtension);
// returns the layershell extension if attached, otherwise nullptr
static LayershellWindowExtension* get(QWindow* window);