server: on exit, destroy backends first

This fixes a UAF caused by trying to update the xcursor in a
output destroy handler, in turn caused by destroying the backend.

Fixes: #2539

diff --git a/src/server.c b/src/server.c
index bffea515199fcafd8d2f82a8af2258569212069c..7093903fa2076a5d5f4197a7e8ebf4152fa70157 100644 (file)
--- a/src/server.c
+++ b/src/server.c
@@ -757,9 +757,9 @@ server_finish(struct server *server)
                wl_event_source_remove(sighup_source);
        }
        wl_display_destroy_clients(server->wl_display);
+       wlr_backend_destroy(server->backend);
        wlr_allocator_destroy(server->allocator);
        wlr_renderer_destroy(server->renderer);
-       wlr_backend_destroy(server->backend);
        seat_finish(server);
        workspaces_destroy(server);
        wlr_scene_node_destroy(&server->scene->tree.node);