[mutter] wayland: Ensure tablet objects tear down resources properly

[Carlos Garnacho <carlosg src gnome org>]

commit ccf6dcd8650b6fe7cc98dc083938e08a396d7f5b
Author: Carlos Garnacho <carlosg gnome org>
Date:   Tue May 10 15:24:41 2016 +0200

    wayland: Ensure tablet objects tear down resources properly
    
    Otherwise the resource is still linked to a wl_list whose storage
    has been freed, leading to invalid writes.

 src/wayland/meta-wayland-tablet-seat.c |    8 ++++++++
 src/wayland/meta-wayland-tablet-tool.c |    2 ++
 src/wayland/meta-wayland-tablet.c      |    2 ++
 3 files changed, 12 insertions(+), 0 deletions(-)
---
diff --git a/src/wayland/meta-wayland-tablet-seat.c b/src/wayland/meta-wayland-tablet-seat.c
index 30ac47c..6b78cd3 100644
--- a/src/wayland/meta-wayland-tablet-seat.c
+++ b/src/wayland/meta-wayland-tablet-seat.c
@@ -192,6 +192,14 @@ meta_wayland_tablet_seat_new (MetaWaylandTabletManager *manager)
 void
 meta_wayland_tablet_seat_free (MetaWaylandTabletSeat *tablet_seat)
 {
+  struct wl_resource *resource, *next;
+
+  wl_resource_for_each_safe (resource, next, &tablet_seat->resource_list)
+    {
+      wl_list_remove (wl_resource_get_link (resource));
+      wl_list_init (wl_resource_get_link (resource));
+    }
+
   g_signal_handlers_disconnect_by_data (tablet_seat->device_manager,
                                         tablet_seat);
   g_hash_table_destroy (tablet_seat->tablets);
diff --git a/src/wayland/meta-wayland-tablet-tool.c b/src/wayland/meta-wayland-tablet-tool.c
index cbb22b3..2e25e6b 100644
--- a/src/wayland/meta-wayland-tablet-tool.c
+++ b/src/wayland/meta-wayland-tablet-tool.c
@@ -411,6 +411,8 @@ meta_wayland_tablet_tool_free (MetaWaylandTabletTool *tool)
   wl_resource_for_each_safe (resource, next, &tool->resource_list)
     {
       zwp_tablet_tool_v1_send_removed (resource);
+      wl_list_remove (wl_resource_get_link (resource));
+      wl_list_init (wl_resource_get_link (resource));
     }
 
   g_slice_free (MetaWaylandTabletTool, tool);
diff --git a/src/wayland/meta-wayland-tablet.c b/src/wayland/meta-wayland-tablet.c
index a56f66d..1ef18a2 100644
--- a/src/wayland/meta-wayland-tablet.c
+++ b/src/wayland/meta-wayland-tablet.c
@@ -62,6 +62,8 @@ meta_wayland_tablet_free (MetaWaylandTablet *tablet)
   wl_resource_for_each_safe (resource, next, &tablet->resource_list)
     {
       zwp_tablet_v1_send_removed (resource);
+      wl_list_remove (wl_resource_get_link (resource));
+      wl_list_init (wl_resource_get_link (resource));
     }
 
   g_slice_free (MetaWaylandTablet, tablet);