From 04943bc6ac4872a1ad5fa56cb9cadd20beeefa92 Mon Sep 17 00:00:00 2001
From: Kirill Primak <vyivel@eclair.cafe>
Date: Wed, 7 Aug 2024 15:27:02 +0300
Subject: [PATCH] tearing: fix UAF on destroy

Fixes: 9a1c411abd8261c121dcd50dfe54132718768084
(cherry picked from commit 32e5e5232d1b0b5a34b4296a79a4e8cfa32b5090)
---
 sway/desktop/tearing.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sway/desktop/tearing.c b/sway/desktop/tearing.c
index b74c74d2..d8d27645 100644
--- a/sway/desktop/tearing.c
+++ b/sway/desktop/tearing.c
@@ -29,6 +29,8 @@ static void handle_tearing_controller_destroy(struct wl_listener *listener,
 		void *data) {
 	struct sway_tearing_controller *controller =
 		wl_container_of(listener, controller, destroy);
+	wl_list_remove(&controller->set_hint.link);
+	wl_list_remove(&controller->destroy.link);
 	wl_list_remove(&controller->link);
 	free(controller);
 }