xserver: Branch 'master'

[Keith Packard]

 dix/dispatch.c      |    2 +-
 include/dixstruct.h |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

New commits:
commit ea8efb3a997e15d27d362762e6c85d59487f9864
Author: Keith Packard <keithp at keithp.com>
Date:   Wed Nov 2 13:25:33 2016 -0700

    dix: Make sure client is not in output_pending chain after closed (RH 1382444)
    
    I think it is possible that output could get queued to a client during
    CloseDownClient. After it is removed from the pending queue, active
    grabs are released, the client is awoken if sleeping and any work
    queue entries related to the client are processed.
    
    To fix this, move the call removing it from the output_pending chain
    until after clientGone has been set and then check clientGone in
    output_pending_mark.
    
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1382444
    Signed-off-by: Keith Packard <keithp at keithp.com>
    Reviewed-by: Hans de Goede <hdegoede at redhat.com>

diff --git a/dix/dispatch.c b/dix/dispatch.c
index e111377..3d0fe26 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -3406,7 +3406,6 @@ CloseDownClient(ClientPtr client)
             UngrabServer(client);
         }
         mark_client_not_ready(client);
-        xorg_list_del(&client->output_pending);
         BITCLEAR(grabWaiters, client->index);
         DeleteClientFromAnySelections(client);
         ReleaseActiveGrabs(client);
@@ -3435,6 +3434,7 @@ CloseDownClient(ClientPtr client)
         if (ClientIsAsleep(client))
             ClientSignal(client);
         ProcessWorkQueueZombies();
+        output_pending_clear(client);
         CloseDownConnection(client);
 
         /* If the client made it to the Running stage, nClients has
diff --git a/include/dixstruct.h b/include/dixstruct.h
index 3b578f8..d71b0ac 100644
--- a/include/dixstruct.h
+++ b/include/dixstruct.h
@@ -159,7 +159,7 @@ extern struct xorg_list output_pending_clients;
 static inline void
 output_pending_mark(ClientPtr client)
 {
-    if (xorg_list_is_empty(&client->output_pending))
+    if (!client->clientGone && xorg_list_is_empty(&client->output_pending))
         xorg_list_append(&client->output_pending, &output_pending_clients);
 }