libinput: allow evdev_device_set_output(dev, NULL)

Removing the output association from an evdev_device is more than just
setting the pointer to NULL, one also needs to remove the destroy
listener and flag the destroy listener as unused (notify == NULL).

evdev_device_set_output() can already remove associations, so let it
also handle an assignment to NULL output.

Fix notify_output_destroy() to handle removing an association correctly.
Previously, the listener was left "used", which would mean the next call
to evdev_device_set_output() would have wl_list_remove()'d, accessing
freed memory. This could be triggered by having a touchscreen with a
specified output association, and unplugging then re-plugging the
corresponding output.

Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>

diff --git a/libweston/libinput-device.c b/libweston/libinput-device.c
index 62f4cee..dbbaae3 100644 (file)
--- a/libweston/libinput-device.c
+++ b/libweston/libinput-device.c
@@ -442,7 +442,7 @@ notify_output_destroy(struct wl_listener *listener, void *data)
                                      struct weston_output, link);
                evdev_device_set_output(device, output);
        } else {
-               device->output = NULL;
+               evdev_device_set_output(device, NULL);
        }
 }
 
@@ -557,6 +557,14 @@ evdev_device_set_output(struct evdev_device *device,
                device->output_destroy_listener.notify = NULL;
        }
 
+       if (!output) {
+               weston_log("output for input device %s removed\n",
+                          libinput_device_get_sysname(device->device));
+
+               device->output = NULL;
+               return;
+       }
+
        weston_log("associating input device %s with output %s "
                   "(%s by udev)\n",
                   libinput_device_get_sysname(device->device),