From ccf6dcd8650b6fe7cc98dc083938e08a396d7f5b Mon Sep 17 00:00:00 2001
From: Carlos Garnacho <carlosg@gnome.org>
Date: Tue, 10 May 2016 15:24:41 +0200
Subject: [PATCH] wayland: Ensure tablet objects tear down resources properly

Otherwise the resource is still linked to a wl_list whose storage
has been freed, leading to invalid writes.
---
 src/wayland/meta-wayland-tablet-seat.c | 8 ++++++++
 src/wayland/meta-wayland-tablet-tool.c | 2 ++
 src/wayland/meta-wayland-tablet.c      | 2 ++
 3 files changed, 12 insertions(+)

diff --git a/src/wayland/meta-wayland-tablet-seat.c b/src/wayland/meta-wayland-tablet-seat.c
index 30ac47c23..6b78cd3db 100644
--- a/src/wayland/meta-wayland-tablet-seat.c
+++ b/src/wayland/meta-wayland-tablet-seat.c
@@ -192,6 +192,14 @@ meta_wayland_tablet_seat_new (MetaWaylandTabletManager *manager)
 void
 meta_wayland_tablet_seat_free (MetaWaylandTabletSeat *tablet_seat)
 {
+  struct wl_resource *resource, *next;
+
+  wl_resource_for_each_safe (resource, next, &tablet_seat->resource_list)
+    {
+      wl_list_remove (wl_resource_get_link (resource));
+      wl_list_init (wl_resource_get_link (resource));
+    }
+
   g_signal_handlers_disconnect_by_data (tablet_seat->device_manager,
                                         tablet_seat);
   g_hash_table_destroy (tablet_seat->tablets);
diff --git a/src/wayland/meta-wayland-tablet-tool.c b/src/wayland/meta-wayland-tablet-tool.c
index cbb22b31c..2e25e6bd6 100644
--- a/src/wayland/meta-wayland-tablet-tool.c
+++ b/src/wayland/meta-wayland-tablet-tool.c
@@ -411,6 +411,8 @@ meta_wayland_tablet_tool_free (MetaWaylandTabletTool *tool)
   wl_resource_for_each_safe (resource, next, &tool->resource_list)
     {
       zwp_tablet_tool_v1_send_removed (resource);
+      wl_list_remove (wl_resource_get_link (resource));
+      wl_list_init (wl_resource_get_link (resource));
     }
 
   g_slice_free (MetaWaylandTabletTool, tool);
diff --git a/src/wayland/meta-wayland-tablet.c b/src/wayland/meta-wayland-tablet.c
index a56f66da7..1ef18a25a 100644
--- a/src/wayland/meta-wayland-tablet.c
+++ b/src/wayland/meta-wayland-tablet.c
@@ -62,6 +62,8 @@ meta_wayland_tablet_free (MetaWaylandTablet *tablet)
   wl_resource_for_each_safe (resource, next, &tablet->resource_list)
     {
       zwp_tablet_v1_send_removed (resource);
+      wl_list_remove (wl_resource_get_link (resource));
+      wl_list_init (wl_resource_get_link (resource));
     }
 
   g_slice_free (MetaWaylandTablet, tablet);