[PATCH v3] Allow driver to call DeleteInputDeviceRequest during UnInit

[Peter Hutterer]

On Sun, Jan 17, 2010 at 05:59:03PM +0100, Oldřich Jedlička wrote:
> When the input driver (like xf86-input-wacom) removes it's devices
> during a call to UnInit, the CloseDownDevices() cannot handle it. The
> "next" variable can become a pointer to freed memory.
> 
> The patch introduces order-independent device freeing mechanism by
> remembering the already freed device ids. The devices can reorder any
> time during freeing. No device will be double-freed - if the removing
> failed for any reason; some implementations of DeleteInputDeviceRequest
> don't free the devices already.
> 
> Signed-off-by: Oldřich Jedlička <oldium.pro at seznam.cz>
> ---
>  dix/devices.c |   44 +++++++++++++++++++++++++++++++++-----------
>  1 files changed, 33 insertions(+), 11 deletions(-)
> 
> diff --git dix/devices.c dix/devices.c
> index 245a95b..ef199b7 100644
> --- dix/devices.c
> +++ dix/devices.c
> @@ -878,13 +878,43 @@ CloseDevice(DeviceIntPtr dev)
>  }
>  
>  /**
> + * Shut down all devices of one list and free all resources.
> + */
> +static
> +void
> +CloseDeviceList(DeviceIntPtr *listHead)
> +{
> +    /* Used to mark devices that we tried to free */
> +    Bool freedIds[MAXDEVICES];
> +    DeviceIntPtr dev;
> +    int i;
> +
> +    if (listHead == NULL)
> +        return;
> +
> +    for (i = 0; i < MAXDEVICES; i++)
> +        freedIds[i] = FALSE;
> +
> +    dev = *listHead;
> +    while (dev != NULL)
> +    {
> +        freedIds[dev->id] = TRUE;
> +        DeleteInputDeviceRequest(dev);
> +
> +        dev = *listHead;
> +        while (dev != NULL && freedIds[dev->id])
> +            dev = dev->next;
> +    }
> +}
> +
> +/**
>   * Shut down all devices, free all resources, etc.
>   * Only useful if you're shutting down the server!
>   */
>  void
>  CloseDownDevices(void)
>  {
> -    DeviceIntPtr dev, next;
> +    DeviceIntPtr dev;
>  
>      /* Float all SDs before closing them. Note that at this point resources
>       * (e.g. cursors) have been freed already, so we can't just call
> @@ -897,16 +927,8 @@ CloseDownDevices(void)
>              dev->u.master = NULL;
>      }
>  
> -    for (dev = inputInfo.devices; dev; dev = next)
> -    {
> -	next = dev->next;
> -        DeleteInputDeviceRequest(dev);
> -    }
> -    for (dev = inputInfo.off_devices; dev; dev = next)
> -    {
> -	next = dev->next;
> -        DeleteInputDeviceRequest(dev);
> -    }
> +    CloseDeviceList(&inputInfo.devices);
> +    CloseDeviceList(&inputInfo.off_devices);
>  
>      CloseDevice(inputInfo.pointer);
>      CloseDevice(inputInfo.keyboard);
> -- 
> 1.6.6

Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>

thanks, merged.

Cheers,
  Peter