[PATCH 1/2] Set to NULL event source after a call to wl_event_source_remove

2014-05-09 Thread Hardening 
This patch sets to NULL event sources after a call to wl_event_source_remove()
has been made.
---
 src/clipboard.c  | 3 ++-
 src/compositor-drm.c | 3 +++
 src/compositor-rpi.c | 1 +
 src/compositor-x11.c | 2 ++
 src/compositor.c | 6 +-
 src/evdev-touchpad.c | 1 +
 src/evdev.c  | 4 +++-
 src/libinput-seat.c  | 1 +
 src/logind-util.c| 2 ++
 xwayland/launcher.c  | 6 +-
 xwayland/selection.c | 9 +++--
 11 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/src/clipboard.c b/src/clipboard.c
index 5a3a02d..0e25dc1 100644
--- a/src/clipboard.c
+++ b/src/clipboard.c
@@ -61,6 +61,7 @@ clipboard_source_unref(struct clipboard_source *source)
 
if (source-event_source) {
wl_event_source_remove(source-event_source);
+   source-event_source = NULL;
close(source-fd);
}
wl_signal_emit(source-base.destroy_signal,
@@ -90,8 +91,8 @@ clipboard_source_data(int fd, uint32_t mask, void *data)
len = read(fd, p, size);
if (len == 0) {
wl_event_source_remove(source-event_source);
-   close(fd);
source-event_source = NULL;
+   close(fd);
} else if (len  0) {
clipboard_source_unref(source);
clipboard-source = NULL;
diff --git a/src/compositor-drm.c b/src/compositor-drm.c
index 5f59789..0110f41 100644
--- a/src/compositor-drm.c
+++ b/src/compositor-drm.c
@@ -2379,7 +2379,9 @@ drm_destroy(struct weston_compositor *ec)
udev_input_destroy(d-input);
 
wl_event_source_remove(d-udev_drm_source);
+   d-udev_drm_source = NULL;
wl_event_source_remove(d-drm_source);
+   d-drm_source = NULL;
 
destroy_sprites(d);
 
@@ -2849,6 +2851,7 @@ drm_compositor_create(struct wl_display *display,
 
 err_udev_monitor:
wl_event_source_remove(ec-udev_drm_source);
+   ec-udev_drm_source = NULL;
udev_monitor_unref(ec-udev_monitor);
 err_drm_source:
wl_event_source_remove(ec-drm_source);
diff --git a/src/compositor-rpi.c b/src/compositor-rpi.c
index 287451d..cbfb770 100644
--- a/src/compositor-rpi.c
+++ b/src/compositor-rpi.c
@@ -213,6 +213,7 @@ static void
 rpi_flippipe_release(struct rpi_flippipe *flippipe)
 {
wl_event_source_remove(flippipe-source);
+   flippipe-source = NULL;
close(flippipe-readfd);
close(flippipe-writefd);
 }
diff --git a/src/compositor-x11.c b/src/compositor-x11.c
index 56b3228..9f171e7 100644
--- a/src/compositor-x11.c
+++ b/src/compositor-x11.c
@@ -485,6 +485,7 @@ x11_output_destroy(struct weston_output *output_base)
(struct x11_compositor *)output-base.compositor;
 
wl_event_source_remove(output-finish_frame_timer);
+   output-finish_frame_timer = NULL;
 
if (compositor-use_pixman) {
pixman_renderer_output_destroy(output_base);
@@ -1424,6 +1425,7 @@ x11_destroy(struct weston_compositor *ec)
struct x11_compositor *compositor = (struct x11_compositor *)ec;
 
wl_event_source_remove(compositor-xcb_source);
+   compositor-xcb_source = NULL;
x11_input_destroy(compositor);
 
weston_compositor_shutdown(ec); /* destroys outputs, too */
diff --git a/src/compositor.c b/src/compositor.c
index cd1ca9a..6ad3387 100644
--- a/src/compositor.c
+++ b/src/compositor.c
@@ -3736,8 +3736,12 @@ weston_compositor_shutdown(struct weston_compositor *ec)
struct weston_output *output, *next;
 
wl_event_source_remove(ec-idle_source);
-   if (ec-input_loop_source)
+   ec-idle_source = NULL;
+
+   if (ec-input_loop_source) {
wl_event_source_remove(ec-input_loop_source);
+   ec-input_loop_source = NULL;
+   }
 
/* Destroy all outputs associated with this compositor */
wl_list_for_each_safe(output, next, ec-output_list, link)
diff --git a/src/evdev-touchpad.c b/src/evdev-touchpad.c
index 69f913a..360f87f 100644
--- a/src/evdev-touchpad.c
+++ b/src/evdev-touchpad.c
@@ -663,6 +663,7 @@ touchpad_destroy(struct evdev_dispatch *dispatch)
 
touchpad-filter-interface-destroy(touchpad-filter);
wl_event_source_remove(touchpad-fsm.timer_source);
+   touchpad-fsm.timer_source = NULL;
free(dispatch);
 }
 
diff --git a/src/evdev.c b/src/evdev.c
index 888dfbd..a1bce2c 100644
--- a/src/evdev.c
+++ b/src/evdev.c
@@ -697,8 +697,10 @@ evdev_device_destroy(struct evdev_device *device)
if (dispatch)
dispatch-interface-destroy(dispatch);
 
-   if (device-source)
+   if (device-source) {
wl_event_source_remove(device-source);
+   device-source = NULL;
+   }
if (device-output)
wl_list_remove(device-output_destroy_listener.link);
wl_list_remove(device-link);
diff --git a/src/libinput-seat.c b/src/libinput-seat.c
index a38d470..34f1aab 100644
--- a/src/libinput-seat.c
+++ b/src/libinput-seat.c
@@

Re: [PATCH 1/2] Set to NULL event source after a call to wl_event_source_remove

2014-05-09 Thread Kristian Høgsberg 
On Fri, May 09, 2014 at 04:03:51PM +0200, Hardening wrote:
 This patch sets to NULL event sources after a call to wl_event_source_remove()
 has been made.

We don't generally set freed memory to NULL, unless we rely on testing that
to decide whether the pointer points to an object or not.

Kristian

 ---
  src/clipboard.c  | 3 ++-
  src/compositor-drm.c | 3 +++
  src/compositor-rpi.c | 1 +
  src/compositor-x11.c | 2 ++
  src/compositor.c | 6 +-
  src/evdev-touchpad.c | 1 +
  src/evdev.c  | 4 +++-
  src/libinput-seat.c  | 1 +
  src/logind-util.c| 2 ++
  xwayland/launcher.c  | 6 +-
  xwayland/selection.c | 9 +++--
  11 files changed, 32 insertions(+), 6 deletions(-)
 
 diff --git a/src/clipboard.c b/src/clipboard.c
 index 5a3a02d..0e25dc1 100644
 --- a/src/clipboard.c
 +++ b/src/clipboard.c
 @@ -61,6 +61,7 @@ clipboard_source_unref(struct clipboard_source *source)
  
   if (source-event_source) {
   wl_event_source_remove(source-event_source);
 + source-event_source = NULL;
   close(source-fd);
   }
   wl_signal_emit(source-base.destroy_signal,
 @@ -90,8 +91,8 @@ clipboard_source_data(int fd, uint32_t mask, void *data)
   len = read(fd, p, size);
   if (len == 0) {
   wl_event_source_remove(source-event_source);
 - close(fd);
   source-event_source = NULL;
 + close(fd);
   } else if (len  0) {
   clipboard_source_unref(source);
   clipboard-source = NULL;
 diff --git a/src/compositor-drm.c b/src/compositor-drm.c
 index 5f59789..0110f41 100644
 --- a/src/compositor-drm.c
 +++ b/src/compositor-drm.c
 @@ -2379,7 +2379,9 @@ drm_destroy(struct weston_compositor *ec)
   udev_input_destroy(d-input);
  
   wl_event_source_remove(d-udev_drm_source);
 + d-udev_drm_source = NULL;
   wl_event_source_remove(d-drm_source);
 + d-drm_source = NULL;
  
   destroy_sprites(d);
  
 @@ -2849,6 +2851,7 @@ drm_compositor_create(struct wl_display *display,
  
  err_udev_monitor:
   wl_event_source_remove(ec-udev_drm_source);
 + ec-udev_drm_source = NULL;
   udev_monitor_unref(ec-udev_monitor);
  err_drm_source:
   wl_event_source_remove(ec-drm_source);
 diff --git a/src/compositor-rpi.c b/src/compositor-rpi.c
 index 287451d..cbfb770 100644
 --- a/src/compositor-rpi.c
 +++ b/src/compositor-rpi.c
 @@ -213,6 +213,7 @@ static void
  rpi_flippipe_release(struct rpi_flippipe *flippipe)
  {
   wl_event_source_remove(flippipe-source);
 + flippipe-source = NULL;
   close(flippipe-readfd);
   close(flippipe-writefd);
  }
 diff --git a/src/compositor-x11.c b/src/compositor-x11.c
 index 56b3228..9f171e7 100644
 --- a/src/compositor-x11.c
 +++ b/src/compositor-x11.c
 @@ -485,6 +485,7 @@ x11_output_destroy(struct weston_output *output_base)
   (struct x11_compositor *)output-base.compositor;
  
   wl_event_source_remove(output-finish_frame_timer);
 + output-finish_frame_timer = NULL;
  
   if (compositor-use_pixman) {
   pixman_renderer_output_destroy(output_base);
 @@ -1424,6 +1425,7 @@ x11_destroy(struct weston_compositor *ec)
   struct x11_compositor *compositor = (struct x11_compositor *)ec;
  
   wl_event_source_remove(compositor-xcb_source);
 + compositor-xcb_source = NULL;
   x11_input_destroy(compositor);
  
   weston_compositor_shutdown(ec); /* destroys outputs, too */
 diff --git a/src/compositor.c b/src/compositor.c
 index cd1ca9a..6ad3387 100644
 --- a/src/compositor.c
 +++ b/src/compositor.c
 @@ -3736,8 +3736,12 @@ weston_compositor_shutdown(struct weston_compositor 
 *ec)
   struct weston_output *output, *next;
  
   wl_event_source_remove(ec-idle_source);
 - if (ec-input_loop_source)
 + ec-idle_source = NULL;
 +
 + if (ec-input_loop_source) {
   wl_event_source_remove(ec-input_loop_source);
 + ec-input_loop_source = NULL;
 + }
  
   /* Destroy all outputs associated with this compositor */
   wl_list_for_each_safe(output, next, ec-output_list, link)
 diff --git a/src/evdev-touchpad.c b/src/evdev-touchpad.c
 index 69f913a..360f87f 100644
 --- a/src/evdev-touchpad.c
 +++ b/src/evdev-touchpad.c
 @@ -663,6 +663,7 @@ touchpad_destroy(struct evdev_dispatch *dispatch)
  
   touchpad-filter-interface-destroy(touchpad-filter);
   wl_event_source_remove(touchpad-fsm.timer_source);
 + touchpad-fsm.timer_source = NULL;
   free(dispatch);
  }
  
 diff --git a/src/evdev.c b/src/evdev.c
 index 888dfbd..a1bce2c 100644
 --- a/src/evdev.c
 +++ b/src/evdev.c
 @@ -697,8 +697,10 @@ evdev_device_destroy(struct evdev_device *device)
   if (dispatch)
   dispatch-interface-destroy(dispatch);
  
 - if (device-source)
 + if (device-source) {
   wl_event_source_remove(device-source);
 + device-source = NULL;
 + }
   if (device-output)