Xorg crash when removing an input device

[Peter Hutterer]

Fabrice Ménard wrote:
> Hi,
> 
> Using input hotplug, I noticed that the server crashes when I remove a device 
> with the following command
> dbus-send --system --type=method_call --print-reply \
>        --dest=org.x.config.display0 /org/x/config/0 org.x.config.input.remove\
>         uint32:X
> (where X is the device number given by listDevices)
> 
> The bug comes from a double freed memory.  When a device is removed 
> DeleteInputDeviceRequest (in xf86Xinput.c) calls RemoveDevice(pDev) then 
> xf86DeleteInput (in xf86Helper.c) and this latter frees something 
> (xfree(pInp)) that has been previously freed by RemoveDevice.
> 
> This proposed patch is ok for me but I don't know if xf86DeleteInput is called 
> outside DeleteInputDeviceRequest (therefore without calling RemoveDevice)

what driver are you using?