[rpms/kmscon] f43: Fix crash on exit

[rpms/kmscon] f43: Fix crash on exit

[Jocelyn Falempe]

            A new commit has been pushed.

            Repo   : rpms/kmscon
            Branch : f43
            Commit : a3339c936f6897bf8d6d34a1628c873727bc8f51
            Author : Jocelyn Falempe <jfalempe@redhat.com>
            Date   : 2026-08-21T17:53:33+02:00
            Stats  : +39/-3 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/kmscon/c/a3339c936f6897bf8d6d34a1628c873727bc8f51?branch=f43

            Log:
            Fix crash on exit

This should fix the following crash:
Aug 20 16:21:34 fedora systemd[1]: Stopping kmsconvt@tty1.service - KMS System Console on tty1...
Aug 20 16:21:34 fedora kernel: kmscon[988]: segfault at 18 ip 000055c0a545c820 sp 00007ffd935f1e50 error 4 in kmscon[24820,55c0a5450000+25000] likely on CPU 0 (core 0, socket 0)
Aug 20 16:21:34 fedora systemd[1]: plymouth-quit.service: Deactivated successfully.
Aug 20 16:21:34 fedora kernel: Code: 85 ff 0f 84 81 00 00 00 4c 89 6d f0 4d 8d 6e 38 48 89 5d e0 49 8b 5e 38 4c 39 eb 75 0d eb 3b 0f 1f 00 48 8b 1b 4c 39 eb 74 30 <48> 8b 43 18 48 85 c0 74 04 48 8b 40 30 48 39 c7 75 e6 48 89 de 4c

        vid = <optimized out>
        d = 0x0
        iter = 0x0
        __ptr = <optimized out>
        vid = <optimized out>
        d = <optimized out>
        iter = <optimized out>
        __ptr = <optimized out>
        s = <optimized out>
        vid = <optimized out>
        ret = 0
        __func__ = <optimized out>
        __ptr = <optimized out>
        __ptr = <optimized out>
        s = <optimized out>
        vid = <optimized out>
        ret = <optimized out>
        __func__ = <optimized out>
        __ptr = <optimized out>
        __ptr = <optimized out>
No locals.
        ret = 0
        conf_ctx = 0x55c0d21a9560
        conf = <optimized out>
        app = {conf_ctx = 0x55c0d21a9560, conf = 0x55c0d21a93c0, exiting = true, eloop = 0x55c0d21abb40, seat_ctx = 0x55c0d21af9e0, seat_conf = 0x55c0d21af840, seat = 0x55c0d21aa8c0, dbus = 0x55c0d21ac190}
        __func__ = "main"

Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>

---
diff --git a/kmscon.spec b/kmscon.spec
index c8fcf50..d978480 100644
--- a/kmscon.spec
+++ b/kmscon.spec
@@ -30,9 +30,7 @@ BuildRequires:  pkgconfig(systemd)
 BuildRequires:  pkgconfig(xkbcommon) >= 0.5.0
 BuildRequires:  pkgconfig(zlib)
 
-# agetty version on Fedora < 45 prints the /etc/issue file twice
-# without this workaround
-Patch: Workaround-agetty-issue-file-on-Fedora.patch
+Patch: seat-Fix-use-after-free-in-kmscon_seat_remove_video.patch
 
 %description
 Kmscon is a simple terminal emulator based on linux kernel mode setting (KMS).

diff --git a/seat-Fix-use-after-free-in-kmscon_seat_remove_video.patch b/seat-Fix-use-after-free-in-kmscon_seat_remove_video.patch
new file mode 100644
index 0000000..bc05216
--- /dev/null
+++ b/seat-Fix-use-after-free-in-kmscon_seat_remove_video.patch
@@ -0,0 +1,38 @@
+From 789b29e1a272ebdd97aae7abcaa221308dbda0f5 Mon Sep 17 00:00:00 2001
+From: Jocelyn Falempe <jfalempe@redhat.com>
+Date: Fri, 21 Aug 2026 09:38:43 +0200
+Subject: [PATCH] seat: Fix use after free in kmscon_seat_remove_video()
+
+As the display is removed from the list during traversal, use the safe
+variant
+
+Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
+---
+ src/seat.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/seat.c b/src/seat.c
+index 299620a..ea0b9b0 100644
+--- a/src/seat.c
++++ b/src/seat.c
+@@ -1015,7 +1015,7 @@ static void kmscon_seat_remove_video(struct kmscon_seat *seat, void *data)
+ {
+ 	struct kmscon_video *vid = data;
+ 	struct kmscon_display *d;
+-	struct shl_dlist *iter;
++	struct shl_dlist *iter, *tmp;
+ 
+ 	if (!seat || !vid)
+ 		return;
+@@ -1026,7 +1026,7 @@ static void kmscon_seat_remove_video(struct kmscon_seat *seat, void *data)
+ 	shl_dlist_unlink(&vid->list);
+ 
+ 	if (vid->video) {
+-		shl_dlist_for_each(iter, &seat->displays)
++		shl_dlist_for_each_safe(iter, tmp, &seat->displays)
+ 		{
+ 			d = shl_dlist_entry(iter, struct kmscon_display, list);
+ 			if (display_video(d->disp) == vid->video)
+-- 
+2.55.0
+