genodelabs / genode

Genode OS Framework
https://genode.org/
Other
1.03k stars 249 forks source link

qt5: fix use-after-free on exit #5156

Closed cproc closed 1 month ago

cproc commented 1 month ago

The TouchDevices constructor registers a "post routine" which gets executed by the QApplication destructor and removes all elements of the touch device list:

https://github.com/qt/qtbase/blob/4e158f6bfa7d0747d8da70b3b15a44b52e35bb8a/src/gui/kernel/qtouchdevice.cpp#L207-L219

struct TouchDevices {
    TouchDevices();
    QList<const QTouchDevice *> list;
};
Q_GLOBAL_STATIC(TouchDevices, deviceList)

TouchDevices::TouchDevices()
{
    qAddPostRoutine([]{
        const auto locker = qt_scoped_lock(devicesMutex);
        qDeleteAll(qExchange(deviceList->list, {}));
    });
}

But if the QApplication instance gets destroyed after the device list, which can happen with a static QApplication instance like in the tiled_wm test, the "post routine" accesses the destroyed list and an error message like the following can appear in the log:

Error: slab address 0x7ffff7d91500 freed which is unused
cproc commented 1 month ago

Fixed by bd92083.