Cancel timers on DEVICE_OFF to avoid potential invalid memory dereference

0001-Cancel-timers-on-DEVICE_OFF.patch

@@ -0,0 +1,31 @@
+From 2278b26da892318be3f1266edaf9a4d3fe5ae582 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Fri, 24 Feb 2017 14:05:02 +1000
+Subject: [PATCH] Cancel timers on DEVICE_OFF
+
+Otherwise we run the risk of having a timer trigger after we removed the
+device. Since we pass InputInfoPtrs and WacomDevicePtrs to the timers as
+arguments, these may have been freed by the time a timer triggers.
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/xf86Wacom.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/xf86Wacom.c b/src/xf86Wacom.c
+index b4cf25b..26b4e9c 100644
+--- a/src/xf86Wacom.c
++++ b/src/xf86Wacom.c
+@@ -854,6 +854,9 @@ static int wcmDevProc(DeviceIntPtr pWcm, int what)
+ 			break;
+ 
+ 		case DEVICE_OFF:
++			TimerCancel(priv->tap_timer);
++			TimerCancel(priv->serial_timer);
++			TimerCancel(priv->touch_timer);
+ 			wcmDisableTool(pWcm);
+ 			wcmUnlinkTouchAndPen(pInfo);
+ 			if (pInfo->fd >= 0)
+-- 
+2.9.3
+

xorg-x11-drv-wacom.spec

@@ -9,7 +9,7 @@
 Summary:    Xorg X11 wacom input driver
 Name:       xorg-x11-drv-wacom
 Version:    0.34.0
-Release:    3%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
+Release:    4%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
 URL:        http://www.x.org
 License:    GPLv2+
 Group:      User Interface/X Hardware Support
@@ -23,6 +23,7 @@ Source0: http://prdownloads.sourceforge.net/linuxwacom/xf86-input-wacom-%{versio
 %endif
 
 Patch01: 0001-Revert-to-update-properties-with-a-timer-func.patch
+Patch02: 0001-Cancel-timers-on-DEVICE_OFF.patch
 
 ExcludeArch: s390 s390x
 
@@ -44,6 +45,7 @@ X.Org X11 wacom input driver for Wacom tablets.
 %prep
 %setup -q -n %{tarball}-%{?gitdate:%{gitdate}}%{!?gitdate:%{version}}
 %patch01 -p1
+%patch02 -p1
 
 %build
 autoreconf --force -v --install || exit 1
@@ -96,6 +98,9 @@ X.Org X11 wacom input driver development files.
 %{_bindir}/isdv4-serial-debugger
 
 %changelog
+* Mon Feb 27 2017 Peter Hutterer <peter.hutterer@redhat.com> 0.34.0-4
+- Cancel timers on DEVICE_OFF to avoid potential invalid memory dereference
+
 * Thu Feb 23 2017 Peter Hutterer <peter.hutterer@redhat.com> 0.34.0-3
 - Don't update properties from within the input thread