fdo-mirrors/libinput
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/libinput/libinput.git synced 2025-12-20 08:00:08 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

tablet: when destroying a tablet, unlink the tablet tools

Browse source 
If a caller holds a ref to a tablet tool when the device is
destroyed, the tool didn't get removed from the tablet->tool_list.

Later on tool unref the list_remove() would try to reset the pointers
but the list head was long since freed, causing an invalid write.

(cherry picked from commit 7e8298e9ec)

Part-of: <https://gitlab.freedesktop.org/libinput/libinput/-/merge_requests/1375>
This commit is contained in:
Peter Hutterer 2025-11-27 09:15:34 +10:00
parent 5bf134e77b
commit 11063aa28b
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/evdev-tablet.c
View file

@ -2451,6 +2451,8 @@ tablet_destroy(struct evdev_dispatch *dispatch)
struct libinput *li = tablet_libinput_context(tablet);
list_for_each_safe(tool, &tablet->tool_list, link) {
list_remove(&tool->link);
list_init(&tool->link); /* unref may list_remove() too */
libinput_tablet_tool_unref(tool);
}