From 99dbcf1b8caba93acb5479d1c7ad754ff3fd0540 Mon Sep 17 00:00:00 2001 From: Alban Browaeys Date: Sat, 8 Feb 2025 16:10:40 +0100 Subject: [PATCH] input-capture/session: Disconnect on_keymap_changed on session finalize When Input Capture was enabled on Input Leap server startup and then finalized when Input Leap server was stopped, switching keymap was still triggering its on_keymap_changed callback, but on a freed session thus triggering use after free a segfault. Fixes: 2fb3bdf77 - input-capture: Hook up capturing of events to active session Closes: https://gitlab.gnome.org/GNOME/mutter/-/issues/3360 Part-of: --- src/backends/meta-input-capture-session.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/backends/meta-input-capture-session.c b/src/backends/meta-input-capture-session.c index 14973e3e7..4f9d85427 100644 --- a/src/backends/meta-input-capture-session.c +++ b/src/backends/meta-input-capture-session.c @@ -1188,6 +1188,10 @@ static void meta_input_capture_session_finalize (GObject *object) { MetaInputCaptureSession *session = META_INPUT_CAPTURE_SESSION (object); + MetaBackend *backend = + meta_dbus_session_manager_get_backend (session->session_manager); + + g_signal_handlers_disconnect_by_func (backend, on_keymap_changed, session); g_clear_pointer (&session->barriers, g_hash_table_unref);