From ca19014af011f5a6433fb6763fa1350c03a77f65 Mon Sep 17 00:00:00 2001
From: JiDe Zhang <zccrs@live.com>
Date: Fri, 8 Sep 2023 21:36:56 +0800
Subject: [PATCH] xwayland: fix double free wlr_xwayland_shell_v1

---
 include/wlr/xwayland/shell.h    |  1 +
 include/wlr/xwayland/xwayland.h |  1 +
 xwayland/shell.c                |  3 +++
 xwayland/xwayland.c             | 10 ++++++++++
 4 files changed, 15 insertions(+)

diff --git a/include/wlr/xwayland/shell.h b/include/wlr/xwayland/shell.h
index 6cd3d93e..da5cb990 100644
--- a/include/wlr/xwayland/shell.h
+++ b/include/wlr/xwayland/shell.h
@@ -21,6 +21,7 @@ struct wlr_xwayland_shell_v1 {
 	struct wl_global *global;
 
 	struct {
+		struct wl_signal destroy;
 		struct wl_signal new_surface; // struct wlr_xwayland_surface_v1
 	} events;
 
diff --git a/include/wlr/xwayland/xwayland.h b/include/wlr/xwayland/xwayland.h
index 6761eff0..68c8c0ac 100644
--- a/include/wlr/xwayland/xwayland.h
+++ b/include/wlr/xwayland/xwayland.h
@@ -49,6 +49,7 @@ struct wlr_xwayland {
 	struct wl_listener server_ready;
 	struct wl_listener server_destroy;
 	struct wl_listener seat_destroy;
+	struct wl_listener shell_destroy;
 
 	void *data;
 };
diff --git a/xwayland/shell.c b/xwayland/shell.c
index 9c5a9d20..1f7e11af 100644
--- a/xwayland/shell.c
+++ b/xwayland/shell.c
@@ -179,6 +179,7 @@ struct wlr_xwayland_shell_v1 *wlr_xwayland_shell_v1_create(
 
 	wl_list_init(&shell->surfaces);
 	wl_signal_init(&shell->events.new_surface);
+	wl_signal_init(&shell->events.destroy);
 
 	shell->display_destroy.notify = handle_display_destroy;
 	wl_display_add_destroy_listener(display, &shell->display_destroy);
@@ -193,6 +194,8 @@ void wlr_xwayland_shell_v1_destroy(struct wlr_xwayland_shell_v1 *shell) {
 		return;
 	}
 
+	wl_signal_emit_mutable(&shell->events.destroy, NULL);
+
 	struct wlr_xwayland_surface_v1 *xwl_surface, *tmp;
 	wl_list_for_each_safe(xwl_surface, tmp, &shell->surfaces, link) {
 		xwl_surface_destroy(xwl_surface);
diff --git a/xwayland/xwayland.c b/xwayland/xwayland.c
index b66dde65..98d00fc4 100644
--- a/xwayland/xwayland.c
+++ b/xwayland/xwayland.c
@@ -63,6 +63,12 @@ static void handle_server_ready(struct wl_listener *listener, void *data) {
 	wl_signal_emit_mutable(&xwayland->events.ready, NULL);
 }
 
+static void handle_shell_destroy(struct wl_listener *listener, void *data) {
+	struct wlr_xwayland *xwayland =
+		wl_container_of(listener, xwayland, shell_destroy);
+	xwayland->shell_v1 = NULL;
+}
+
 void wlr_xwayland_destroy(struct wlr_xwayland *xwayland) {
 	if (!xwayland) {
 		return;
@@ -71,6 +77,7 @@ void wlr_xwayland_destroy(struct wlr_xwayland *xwayland) {
 	wl_list_remove(&xwayland->server_destroy.link);
 	wl_list_remove(&xwayland->server_start.link);
 	wl_list_remove(&xwayland->server_ready.link);
+	wl_list_remove(&xwayland->shell_destroy.link);
 	free(xwayland->cursor);
 
 	wlr_xwayland_set_seat(xwayland, NULL);
@@ -125,6 +132,9 @@ struct wlr_xwayland *wlr_xwayland_create(struct wl_display *wl_display,
 	xwayland->server_ready.notify = handle_server_ready;
 	wl_signal_add(&xwayland->server->events.ready, &xwayland->server_ready);
 
+	xwayland->shell_destroy.notify = handle_shell_destroy;
+	wl_signal_add(&xwayland->shell_v1->events.destroy, &xwayland->shell_destroy);
+
 	return xwayland;
 }