From aee9fa09f0a54de1b123f5100b233d8bcd617401 Mon Sep 17 00:00:00 2001 From: leiliang Date: Fri, 15 May 2026 16:17:33 +0800 Subject: [PATCH] drm_syncobj_merger: fix memory leak and sync_fd corruption on error Fix a memory leak when waiter_init fails in wlr_drm_syncobj_merger_add(), and prevent the old sync_fd from being closed when sync_file_merge fails in wlr_drm_syncobj_merger_add_sync_file(). --- render/drm_syncobj_merger.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/render/drm_syncobj_merger.c b/render/drm_syncobj_merger.c index 0cfdfcc96..94323f761 100644 --- a/render/drm_syncobj_merger.c +++ b/render/drm_syncobj_merger.c @@ -118,6 +118,7 @@ bool wlr_drm_syncobj_merger_add(struct wlr_drm_syncobj_merger *merger, } if (!wlr_drm_syncobj_timeline_waiter_init(&add->waiter, src_timeline, src_point, flags, loop, export_waiter_handle_ready)) { + free(add); return false; } add->merger = merger; @@ -133,6 +134,9 @@ bool wlr_drm_syncobj_merger_add_sync_file(struct wlr_drm_syncobj_merger *merger, if (merger->sync_fd != -1) { new_sync = sync_file_merge(merger->sync_fd, fd); close(fd); + if (new_sync < 0) { + return false; + } close(merger->sync_fd); } merger->sync_fd = new_sync;