Xorg crash with input device plug/unplug

[Marko Macek]

Originally filed at:
     https://bugzilla.redhat.com/show_bug.cgi?id=550948

I use an usb-switch device to switch keyboard+mouse between machines. This has
worked fine for 4+ years.

But in Fedora 12 on a new machine I have a problem:

*** glibc detected *** /usr/bin/Xorg: free(): invalid pointer:
0x00000000026bc390 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3384674576]
/usr/bin/Xorg(XIDeleteAllDeviceProperties+0x33)[0x4e2673]
/usr/bin/Xorg[0x425714]
/usr/bin/Xorg(RemoveDevice+0x165)[0x426935]
/usr/bin/Xorg(DeleteInputDeviceRequest+0x54)[0x479144]
/usr/bin/Xorg[0x455c50]
/usr/bin/Xorg[0x455cef]
/usr/lib64/libhal.so.1[0x339220bb68]
/lib64/libdbus-1.so.3(dbus_connection_dispatch+0x336)[0x3389e109d6]
/lib64/libdbus-1.so.3[0x3389e10bff]
/usr/bin/Xorg[0x4558fb]
/usr/bin/Xorg(WakeupHandler+0x4b)[0x43196b]
/usr/bin/Xorg(WaitForSomething+0x1d7)[0x45bd97]
/usr/bin/Xorg[0x42c3b2]
/usr/bin/Xorg[0x421cfa]
/lib64/libc.so.6(__libc_start_main+0xfd)[0x338461eb1d]
/usr/bin/Xorg[0x4218a9]

---

The configuration to reproduce is this

computer - switch - hub - keyboard + 2 mice

It has also happened to me while docking/undocking the laptop.

I can reproduce it reliably (<10 switches) with just one mouse without
valgrind, but with valgrind I could only reproduce it after adding another
mouse.

The problem happens both with radeon (desktop) and intel (laptop) drivers.

The bug above has some valgrind output attached. The most relevant seems
to be:

The most relevant log seems to be:

==3808== Invalid write of size 1
==3808==    at 0x4EB6CC: _XkbSetIndicatorMap (xkb.c:3093)
==3808==    by 0x4EB933: ProcXkbSetIndicatorMap (xkb.c:3160)
==3808==    by 0x42C69B: Dispatch (dispatch.c:445)
==3808==    by 0x421CF9: main (main.c:285)
==3808==  Address 0x88a8568 is 8 bytes inside a block of size 392 free'd
==3808==    at 0x4A04D72: free (vg_replace_malloc.c:325)
==3808==    by 0x50AC4E: SrvXkbFreeKeyboard (XKBAlloc.c:289)
==3808==    by 0x4FE30D: XkbFreeInfo (xkbInit.c:679)
==3808==    by 0x4254C3: FreeDeviceClass (devices.c:671)
==3808==    by 0x425656: FreeAllDeviceClasses (devices.c:801)
==3808==    by 0x425775: CloseDevice (devices.c:849)
==3808==    by 0x426934: RemoveDevice (devices.c:993)
==3808==    by 0x479143: DeleteInputDeviceRequest (xf86Xinput.c:671)
==3808==    by 0x455C4F: remove_device (hal.c:72)
==3808==    by 0x455CEE: device_removed (hal.c:90)
==3808==    by 0x339220BB67: filter_func (libhal.c:1067)
==3808==    by 0x3389E109D5: dbus_connection_dispatch (dbus-connection.c:4444)


Start of log:

==3808== Memcheck, a memory error detector
==3808== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==3808== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info
==3808== Command: /usr/bin/Xorg.1 :0 -auth /root/.serverauth.3791
==3808==

X.Org X Server 1.7.1
Release Date: 2009-10-23
X Protocol Version 11, Revision 0
Build Operating System:  2.6.18-164.2.1.el5
Current Operating System: Linux amdbox 2.6.31.9-174.fc12.x86_64 #1 SMP
Mon Dec 21 05:33:33 UTC 2009 x86_64
Kernel command line: ro root=UUID=ecf9b10b-b481-4264-9575-b63508588dc4
LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us
rhgb quiet
Build Date: 05 November 2009  07:43:10PM
Build ID: xorg-x11-server 1.7.1-7.fc12
Current version of pixman: 0.16.4
         Before reporting problems, check http://bodhi.fedoraproject.org/
         to make sure that you have the latest version.
Markers: (--) probed, (**) from config file, (==) default setting,
         (++) from command line, (!!) notice, (II) informational,
         (WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(==) Log file: "/var/log/Xorg.0.log", Time: Tue Jan 19 18:04:54 2010
(==) Using default built-in configuration (30 lines)
(II) [KMS] Kernel modesetting enabled.

	Mark