diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2017-05-04 14:50:31 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2017-05-05 12:50:57 +1000 |
| commit | 8dcd71b3951bdd105c5782fbb319b5456ca70db8 (patch) | |
| tree | 36d8c117849d28f7def264ab899336e1c16cac02 /src | |
| parent | 9d1fdb0c6deacf11bfa2e32a56ff2ce0df2291c1 (diff) | |
lid: remove the keyboard listener on remove and re-init the listener
If the event listener is added, then removed again on a lid switch on/off
event, the list is set to null. This can trigger two crashes:
* when the keyboard is removed first, the call to
libinput_device_remove_event_listener() dereferences the null pointer
* when the switch is removed first, the call to device_destroy will find a
remaining event listener and assert
https://bugzilla.redhat.com/show_bug.cgi?id=1440927
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Diffstat (limited to 'src')
| -rw-r--r-- | src/evdev-lid.c | 21 |
1 files changed, 19 insertions, 2 deletions
diff --git a/src/evdev-lid.c b/src/evdev-lid.c index a975e35..baf7185 100644 --- a/src/evdev-lid.c +++ b/src/evdev-lid.c @@ -99,6 +99,8 @@ lid_switch_toggle_keyboard_listener(struct lid_switch_dispatch *dispatch, } else { libinput_device_remove_event_listener( &dispatch->keyboard.listener); + libinput_device_init_event_listener( + &dispatch->keyboard.listener); } } @@ -174,6 +176,17 @@ evdev_read_switch_reliability_prop(struct evdev_device *device) } static void +lid_switch_remove(struct evdev_dispatch *evdev_dispatch) +{ + struct lid_switch_dispatch *dispatch = lid_dispatch(evdev_dispatch); + + if (!dispatch->keyboard.keyboard) + return; + + libinput_device_remove_event_listener(&dispatch->keyboard.listener); +} + +static void lid_switch_destroy(struct evdev_dispatch *evdev_dispatch) { struct lid_switch_dispatch *dispatch = lid_dispatch(evdev_dispatch); @@ -197,7 +210,9 @@ lid_switch_pair_keyboard(struct evdev_device *lid_switch, if (dispatch->keyboard.keyboard) { if (bus_kbd != BUS_I8042) return; + libinput_device_remove_event_listener(&dispatch->keyboard.listener); + libinput_device_init_event_listener(&dispatch->keyboard.listener); } dispatch->keyboard.keyboard = keyboard; @@ -225,7 +240,9 @@ lid_switch_interface_device_removed(struct evdev_device *device, if (removed_device == dispatch->keyboard.keyboard) { libinput_device_remove_event_listener( - &dispatch->keyboard.listener); + &dispatch->keyboard.listener); + libinput_device_init_event_listener( + &dispatch->keyboard.listener); dispatch->keyboard.keyboard = NULL; } } @@ -271,7 +288,7 @@ lid_switch_sync_initial_state(struct evdev_device *device, struct evdev_dispatch_interface lid_switch_interface = { lid_switch_process, NULL, /* suspend */ - NULL, /* remove */ + lid_switch_remove, lid_switch_destroy, lid_switch_interface_device_added, lid_switch_interface_device_removed, |