Commit Graph
1 Commits
Author SHA1 Message Date
klim 4847f97678 Clear surface->data on unmap to fix idle-inhibitor use-after-free
mapnotify() stores the client's scene tree in client_surface(c)->data;
checkidleinhibitor() later reads it back as a wlr_scene_tree and calls
wlr_scene_node_coords() on it. unmapnotify() frees the scene tree with
wlr_scene_node_destroy() but leaves surface->data dangling, so the next
arrange() -> checkidleinhibitor() dereferences freed memory and crashes
(SIGSEGV) whenever an idle inhibitor outlives the unmap.

Reset the pointer to NULL on unmap so the existing !tree guard handles it.
2026-09-08 09:30:56 +02:00