https://bugs.kde.org/show_bug.cgi?id=358722
Bug ID: 358722 Summary: ASAN: Use after free Product: kwin Version: git master Platform: Other OS: Linux Status: UNCONFIRMED Severity: normal Priority: NOR Component: compositing Assignee: kwin-bugs-n...@kde.org Reporter: kf...@kde.org Built kwin with ASAN enabled, to detect potential memory leaks. Instead, detected a heap-use-after free when exiting kwin_x11. ==5038==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200001a0b8 at pc 0x7f24ba11fe11 bp 0x7ffc4766d910 sp 0x7ffc4766d908 READ of size 8 at 0x61200001a0b8 thread T0 #0 0x7f24ba11fe10 in KWin::Compositor::hasScene() const /home/kfunk/devel/src/kf5/kwin/composite.h:74:16 #1 0x7f24ba72dee0 in KWin::Workspace::compositing() const /home/kfunk/devel/src/kf5/kwin/composite.cpp:956:28 #2 0x7f24ba72e88b in KWin::Toplevel::compositing() const /home/kfunk/devel/src/kf5/kwin/composite.cpp:1033:12 #3 0x7f24ba7326ab in KWin::Toplevel::addWorkspaceRepaint(QRect const&) /home/kfunk/devel/src/kf5/kwin/composite.cpp:1202:10 #4 0x7f24ba1b1dc5 in KWin::Client::releaseWindow(bool) /home/kfunk/devel/src/kf5/kwin/client.cpp:226:9 #5 0x7f24ba021a8e in KWin::Workspace::~Workspace() /home/kfunk/devel/src/kf5/kwin/workspace.cpp:444:9 #6 0x7f24ba0228b3 in KWin::Workspace::~Workspace() /home/kfunk/devel/src/kf5/kwin/workspace.cpp:427:1 #7 0x7f24ba3e9b4a in KWin::Application::destroyWorkspace() /home/kfunk/devel/src/kf5/kwin/main.cpp:416:5 #8 0x7f24bb432e80 in KWin::ApplicationX11::lostSelection() /home/kfunk/devel/src/kf5/kwin/main_x11.cpp:139:5 #9 0x7f24bb44689c in KWin::ApplicationX11::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/kfunk/devel/build/kf5/kwin/moc_main_x11.cpp:137:17 #10 0x7f24b453a8e9 in QMetaObject::activate(QObject*, int, int, void**) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2b58e9) #11 0x7f24b538ac71 in KSelectionOwner::lostOwnership() /home/kfunk/devel/build/kf5/kwindowsystem/src/moc_kselectionowner.cpp:144:5 #12 0x7f24b5364946 in KSelectionOwner::filterEvent(void*) /home/kfunk/devel/src/kf5/kwindowsystem/src/platforms/xcb/kselectionowner.cpp:378:14 #13 0x7f24b5365569 in KSelectionOwner::Private::nativeEventFilter(QByteArray const&, void*, long*) /home/kfunk/devel/src/kf5/kwindowsystem/src/platforms/xcb/kselectionowner.cpp:117:16 #14 0x7f24b450869e in QAbstractEventDispatcher::filterNativeEvent(QByteArray const&, void*, long*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28369e) #15 0x7f24a5754253 in QXcbConnection::handleXcbEvent(xcb_generic_event_t*) (/usr/lib/x86_64-linux-gnu/libQt5XcbQpa.so.5+0x3d253) #16 0x7f24a5755002 in QXcbConnection::processXcbEvents() (/usr/lib/x86_64-linux-gnu/libQt5XcbQpa.so.5+0x3e002) #17 0x7f24b453b7b0 in QObject::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2b67b0) #18 0x7f24b4e009db in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15b9db) #19 0x7f24b4e05ea5 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x160ea5) #20 0x7f24ba3e30aa in KWin::Application::notify(QObject*, QEvent*) /home/kfunk/devel/src/kf5/kwin/main.cpp:246:26 #21 0x7f24b450bd7a in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x286d7a) #22 0x7f24b450e175 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x289175) #23 0x7f24b455fa71 in QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2daa71) #24 0x7f24a57b7a1c (/usr/lib/x86_64-linux-gnu/libQt5XcbQpa.so.5+0xa0a1c) #25 0x7f24b4509509 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x284509) #26 0x7f24b45115eb in QCoreApplication::exec() (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28c5eb) #27 0x7f24bb436158 in kdemain /home/kfunk/devel/src/kf5/kwin/main_x11.cpp:316:12 #28 0x4ddbc5 in main /home/kfunk/devel/build/kf5/kwin/kwin_x11_dummy.cpp:3:43 #29 0x7f24b2d16a3f in __libc_start_main /build/buildd/glibc-2.21/csu/libc-start.c:289 #30 0x436488 in _start (/home/kfunk/devel/install/kf5/bin/kwin_x11+0x436488) 0x61200001a0b8 is located 248 bytes inside of 264-byte region [0x612000019fc0,0x61200001a0c8) freed by thread T0 here: #0 0x4dcee2 in operator delete(void*) (/home/kfunk/devel/install/kf5/bin/kwin_x11+0x4dcee2) #1 0x7f24ba715a50 in KWin::Compositor::~Compositor() /home/kfunk/devel/src/kf5/kwin/composite.cpp:150:1 #2 0x7f24ba3e9d3a in KWin::Application::destroyCompositor() /home/kfunk/devel/src/kf5/kwin/main.cpp:421:5 #3 0x7f24bb432e73 in KWin::ApplicationX11::lostSelection() /home/kfunk/devel/src/kf5/kwin/main_x11.cpp:138:5 #4 0x7f24bb44689c in KWin::ApplicationX11::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/kfunk/devel/build/kf5/kwin/moc_main_x11.cpp:137:17 #5 0x7f24b453a8e9 in QMetaObject::activate(QObject*, int, int, void**) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2b58e9) #6 0x7f24b538ac71 in KSelectionOwner::lostOwnership() /home/kfunk/devel/build/kf5/kwindowsystem/src/moc_kselectionowner.cpp:144:5 #7 0x7f24b5364946 in KSelectionOwner::filterEvent(void*) /home/kfunk/devel/src/kf5/kwindowsystem/src/platforms/xcb/kselectionowner.cpp:378:14 #8 0x7f24b5365569 in KSelectionOwner::Private::nativeEventFilter(QByteArray const&, void*, long*) /home/kfunk/devel/src/kf5/kwindowsystem/src/platforms/xcb/kselectionowner.cpp:117:16 #9 0x7f24b450869e in QAbstractEventDispatcher::filterNativeEvent(QByteArray const&, void*, long*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28369e) previously allocated by thread T0 here: #0 0x4dc922 in operator new(unsigned long) (/home/kfunk/devel/install/kf5/bin/kwin_x11+0x4dc922) #1 0x7f24ba70ecb5 in KWin::Compositor::create(QObject*) /home/kfunk/devel/src/kf5/kwin/composite.cpp:80:227 #2 0x7f24ba01667a in KWin::Workspace::Workspace(QString const&) /home/kfunk/devel/src/kf5/kwin/workspace.cpp:194:24 #3 0x7f24ba3e8f22 in KWin::Application::createWorkspace() /home/kfunk/devel/src/kf5/kwin/main.cpp:373:12 #4 0x7f24bb4390fe in KWin::ApplicationX11::performStartup()::$_3::operator()() const /home/kfunk/devel/src/kf5/kwin/main_x11.cpp:181:9 #5 0x7f24bb438c9e in QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, KWin::ApplicationX11::performStartup()::$_3>::call(KWin::ApplicationX11::performStartup()::$_3, void**) /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:495:13 #6 0x7f24bb438aaf in void QtPrivate::Functor<KWin::ApplicationX11::performStartup()::$_3, 0>::call<QtPrivate::List<>, void>(KWin::ApplicationX11::performStartup()::$_3&, void*, void**) /usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:552:13 #7 0x7f24bb4385cc in QtPrivate::QFunctorSlotObject<KWin::ApplicationX11::performStartup()::$_3, 0, QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) /usr/include/x86_64-linux-gnu/qt5/QtCore/qobject_impl.h:192:17 #8 0x7f24b453a776 in QMetaObject::activate(QObject*, int, int, void**) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2b5776) #9 0x7f24b538aca4 in KSelectionOwner::claimedOwnership() /home/kfunk/devel/build/kf5/kwindowsystem/src/moc_kselectionowner.cpp:150:5 #10 0x7f24b53642e1 in KSelectionOwner::Private::claimSucceeded() /home/kfunk/devel/src/kf5/kwindowsystem/src/platforms/xcb/kselectionowner.cpp:206:10 #11 0x7f24b53649e0 in KSelectionOwner::filterEvent(void*) /home/kfunk/devel/src/kf5/kwindowsystem/src/platforms/xcb/kselectionowner.cpp:391:17 #12 0x7f24b5365569 in KSelectionOwner::Private::nativeEventFilter(QByteArray const&, void*, long*) /home/kfunk/devel/src/kf5/kwindowsystem/src/platforms/xcb/kselectionowner.cpp:117:16 #13 0x7f24b450869e in QAbstractEventDispatcher::filterNativeEvent(QByteArray const&, void*, long*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28369e) SUMMARY: AddressSanitizer: heap-use-after-free /home/kfunk/devel/src/kf5/kwin/composite.h:74 KWin::Compositor::hasScene() const Shadow bytes around the buggy address: 0x0c247fffb3c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c247fffb3d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c247fffb3e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c247fffb3f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c247fffb400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c247fffb410: fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa fa 0x0c247fffb420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c247fffb430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c247fffb440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c247fffb450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c247fffb460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==5038==ABORTING Reproducible: Always -- You are receiving this mail because: You are watching all bug changes.